Fault analysis method and device, medium and program product

Abstract

The invention discloses a fault analysis method and device, a medium and a program product, and relates to the technical field of computers, and the method comprises the steps: when a target application program triggers system call, capturing user mode data through a user mode probe, and capturing kernel mode data through a kernel mode probe, i.e., through a double-probe cooperation mode, the user mode data is captured; and the effect of directly and clearly observing and tracking the specific calling sequence, hierarchical relationship and other information among the functions in the kernel of the operating system is achieved. Meanwhile, an incidence relation is established between the user mode data and the kernel mode data through tracking identification information, a function call chain is constructed, the function call chain is input into a preset analysis engine to be analyzed, and a fault analysis result is obtained, so that system full-link tracking is achieved, the problem that fault and anomaly analysis of a kernel layer of an existing operating system is difficult is solved, and the fault analysis efficiency is improved. And the efficiency and the accuracy of fault analysis are improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a fault analysis method, device, medium, and program product. Background Art

[0002] During the development and operation of computer operating systems (such as Linux, Windows, and other operating systems), analyzing and locating faults and anomalies that occur at the operating system kernel level is particularly important for ensuring stable system operation, improving system performance, and enhancing system security.

[0003] However, after a user-mode application triggers a system call to kernel mode, existing tools for monitoring and recording the interaction between the process and the operating system kernel can only capture call entry and exit information. They cannot directly and clearly observe and track the specific call sequence and hierarchical relationships between functions within the kernel. When a system call exception occurs during kernel execution, it is difficult to track the specific location of the failure, making kernel-level fault and exception analysis extremely difficult. Summary of the Invention

[0004] The present application provides a fault analysis method, device, medium and program product to at least solve the problem in the related art that when an exception occurs in a system call during the execution of the operating system kernel, it is difficult to trace the specific fault location, which causes great difficulties in fault and exception analysis at the operating system kernel level.

[0005] This application provides a fault analysis method, including: In response to a target application triggering a system call, capturing user-state data based on a user-state probe; Capture kernel-mode data based on kernel-mode probes and user-mode data; Generate tracking identification information based on user state data and kernel state data, establish an association relationship between the user state data and kernel state data based on the tracking identification information, and build a function call chain; The function call chain is input into a preset analysis engine, and the function call chain is analyzed based on the preset analysis engine to obtain a fault analysis result.

[0006] The present application also provides a fault analysis device, comprising: A first information acquisition module is configured to capture user-state data based on a user-state probe in response to a target application triggering a system call; A second information acquisition module is used to capture kernel state data based on kernel state probes and user state data; A function call chain building module is used to generate tracking identification information based on user state data and kernel state data, and to establish an association relationship between the user state data and the kernel state data based on the tracking identification information to build a function call chain; The fault analysis module is used to input the function call chain into the preset analysis engine, analyze the function call chain based on the preset analysis engine, and obtain the fault analysis result.

[0007] The present application also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-mentioned fault analysis methods when executing the computer program.

[0008] The present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned fault analysis methods are implemented.

[0009] The present application also provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned fault analysis methods when executed by a processor.

[0010] Through this application, since user-state probes and kernel-state probes are set up, not only can user-state data such as user-state space system call entry and exit information be captured through user-state probes, but kernel-state data related to system calls in the operating system kernel can also be captured through kernel-state probes. That is, through the collaborative approach of dual probes, the effect of being able to directly and clearly observe and track the specific call sequence, hierarchical relationship, and other information between various functions in the operating system kernel can be achieved. At the same time, the user-state data and kernel-state data are associated with each other through tracking identification information, a function call chain is constructed, and the function call chain is input into the preset analysis engine for analysis to obtain the fault analysis results, thus realizing full-link tracking of the system, solving the current problem of difficulty in fault and exception analysis at the operating system kernel level, and improving the efficiency and accuracy of fault analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0012] Figure 1 A flowchart of a fault analysis method provided in an embodiment of the present application; Figure 2 A flowchart of another fault analysis method provided in an embodiment of the present application; Figure 3A schematic diagram of the structure of a fault analysis device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0013] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0014] It should be noted that, in the description of this application, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. The terms "first," "second," etc., in this application are used to distinguish similar objects, and are not used to describe a particular order or sequence.

[0015] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0016] Figure 1 This is a flowchart of a fault analysis method provided in an embodiment of the present application. The method can be executed by an electronic device, which can be exemplarily understood as a device such as a mobile phone, tablet computer, laptop computer, desktop computer, smart TV, etc. Figure 1 As shown, this fault analysis method can be applied to computer operating systems (such as Linux, Windows, and other operating systems) to achieve coordinated monitoring and analysis of user and kernel states (such as fault analysis), real-time monitoring and analysis of key data structures in kernel state, and performance analysis and optimization of network protocol stacks and file systems. It can also be applied to technical fields such as cloud computing, big data, and artificial intelligence for troubleshooting and performance tuning. This fault analysis method may include the following steps: S110 : In response to a target application triggering a system call, capturing user-state data based on a user-state probe.

[0017] In the embodiment of the present application, the target application may be any application in the operating system. For example, the target application may be a database service, etc.

[0018] System calls are interfaces between user programs and the operating system kernel, allowing programs to request the kernel to provide services such as file operations, process management, and network communications.

[0019] The user-mode probe is a lightweight probe module deployed in user-mode space. It captures user-mode data by hooking system call entry and exit functions. When capturing user-mode data, the user-mode probe supports at least 64 layers of function call hierarchy depth, ensuring complete capture of call chain information in complex application scenarios. This prevents the loss of critical function information due to call stack truncation, which can affect subsequent fault location and performance bottleneck analysis. Hierarchy refers to the hierarchical relationship of function calls.

[0020] In an embodiment of the present application, user-state data may include call stack information, system call parameters and return values, basic context information and other relevant data of the user-state space during the system call process, and may also include metadata such as the timestamp corresponding to the system call and resource usage data.

[0021] Among them, the call stack refers to the stack structure in the memory used to manage function call relationships when the program is running. Its core function is to record the complete context information of the function call.

[0022] The call stack information may include the address of the calling function (such as the memory address of the user-mode function, etc.), the function call hierarchy relationship (that is, the complete call chain from the user-mode function to the system call function), etc.

[0023] System call parameters can include input parameter values ​​passed to system calls from user state for file operations, network requests, and other operations. Parameters related to file operations can include information such as the file path, file open mode (e.g., read-only, read-write), and permission mask; parameters related to network requests can include information such as the port number and the length of the data being transferred.

[0024] The return value may include file descriptors, error codes, and other output results returned after the system call is executed.

[0025] Basic context information may include call timestamps, process information, thread information, etc. The call timestamp can be used to subsequently correlate with the time sequence of kernel-mode function execution; the process information may include process identification information to locate the specific user-mode process being executed; and the thread information may include thread identification information.

[0026] Specifically, the electronic device responds to the target application triggering a system call through the system call interface, and replaces the second function name and the second memory offset address in the system call table based on the first function name and the first memory offset address corresponding to the user-state probe, that is, replaces the function mapping relationship and the call entry probe in the system call table to hijack the system call entry and exit, and triggers the stack expansion function corresponding to the stack expansion library to start, traces the complete call chain from the current system call function to the upper-level application function, obtains the calling function address, hierarchical relationship and other information, and then captures the user-state data.

[0027] For example, using the Linux operating system as an example, a user-mode probe uses a preset mechanism (such as the LD_PRELOAD mechanism) to hijack the system call entry point of the system call interface. By replacing the system call-related function pointers in the system call interface, the target application's calls to the system call function are intercepted. When the target application initiates a system call, it first passes through the user-mode probe's interception logic, capturing the user-mode data. This ensures that system calls can be monitored in user mode, avoiding the security and stability risks associated with directly manipulating the kernel's system call table, while also enabling the capture of call stack information.

[0028] S120 , capturing kernel-state data based on the kernel-state probe and the user-state data.

[0029] In the embodiments of this application, a kernel-mode probe is a probe module deployed in kernel-mode space based on dynamic instrumentation technology (such as Kernel Probes, KProbes) and Function Tracer (FTrace) technology. It monitors kernel function execution in real time and captures kernel-mode data. This allows operations personnel to flexibly add or modify probe logic without affecting system stability.

[0030] Kernel state data can include the function hierarchy (i.e., the complete kernel call path), the entry and exit timestamps for each kernel function, and resource monitoring data. The entry and exit timestamps for each kernel function are measured in nanoseconds, and resource monitoring data can include CPU resource utilization and memory usage.

[0031] Specifically, after the electronic device obtains the user-state data based on the user-state probe, it parses the user-state data based on the kernel-state probe, determines the call stack address of the user-state data, and performs a tracking operation based on the call stack address and a preset function tracer to capture the kernel-state data.

[0032] S130 : Generate tracking identification information based on the user state data and the kernel state data, establish an association relationship between the user state data and the kernel state data based on the tracking identification information, and construct a function call chain.

[0033] In an embodiment of the present application, the tracking identification information can be understood as identification information used to uniquely track user-state data and kernel-state data, that is, the entire cross-stack complete call path identification information from the target application initiating the system call to the kernel completing the processing.

[0034] Specifically, after acquiring user-state data and kernel-state data, the electronic device may generate tracking identification information based on a preset identification generation rule and the user-state data and kernel-state data, and establish an association relationship between the user-state data and the kernel-state data based on the tracking identification information, that is, bind the user-state data and the kernel-state data based on the tracking identification information to construct a function call chain. The preset identification generation rule is a pre-set rule for generating tracking identification information, and can be set according to specific business scenarios and user needs, and is not limited here.

[0035] S140: Input the function call chain into a preset analysis engine, analyze the function call chain based on the preset analysis engine, and obtain a fault analysis result.

[0036] In an embodiment of the present application, the preset analysis engine can be used to perform data analysis during the system call process, i.e., fault location, streaming data processing of data (such as user-state data and kernel-state data), and data visualization processing.

[0037] Fault analysis results may include information such as fault probability score and fault type.

[0038] Specifically, after constructing the function call chain, the electronic device inputs the function call chain into a preset analysis engine, analyzes the user-state data and kernel-state data in the function call chain based on the anomaly detection model in the preset analysis engine, and obtains a fault analysis result.

[0039] Through the embodiment of the present application, since user-state probes and kernel-state probes are set up, not only can user-state data such as user-state space system call entry and exit information be captured through the user-state probe, but also kernel-state data related to system calls in the operating system kernel can be captured through the kernel-state probe. That is, through the collaborative approach of the two probes, the effect of being able to directly and clearly observe and track the specific call sequence, hierarchical relationship, and other information between various functions in the operating system kernel can be achieved. At the same time, the user-state data and kernel-state data are associated with each other through tracking identification information, a function call chain is constructed, and the function call chain is input into the preset analysis engine for analysis to obtain the fault analysis results, thus realizing full-link tracking of the system, solving the current problem of difficulty in fault and exception analysis at the operating system kernel level, and improving the efficiency and accuracy of fault analysis.

[0040] In an embodiment of the present application, after capturing user-state data based on the user-state probe, the fault analysis method may further include: writing the user-state data into a circular buffer based on the user-state probe; triggering an interrupt based on the user-state probe and a preset interrupt function to notify the kernel-state probe to obtain user-state data from the circular buffer.

[0041] In an embodiment of the present application, a preset interrupt function is used to trigger an interrupt to notify the kernel-mode probe to store new data in the ring buffer. For example, the preset interrupt function may be an ioctl() function.

[0042] In the embodiment of the present application, the ring buffer adopts a dual-pointer lock-free design and can be used to store user-state data and metadata corresponding to the user-state data.

[0043] In an embodiment of the present application, data mapping is achieved by setting up a ring buffer area, and the kernel-state probe is notified by triggering an interrupt through an interrupt function, thereby achieving zero-copy communication between user-state data and kernel-state data, reducing communication overhead during data transmission.

[0044] In the embodiment of the present application, before writing the user-state data into the ring buffer based on the user-state probe, the fault analysis method may further include: creating the ring buffer.

[0045] Among them, creating a circular buffer area can specifically include: initiating a memory mapping system call to the system kernel based on a user-mode probe and a preset memory mapping system call function to send memory mapping parameters to the system kernel; performing memory area allocation and mapping operations based on the system kernel and memory mapping parameters to obtain a target mapping area; dividing the target mapping area into a circular queue based on the system kernel to obtain a circular buffer area, the circular buffer area includes a producer pointer and a consumer pointer, and the producer pointer and the consumer pointer perform data synchronization based on a lock-free mechanism.

[0046] In an embodiment of the present application, the preset memory mapping system call function is a function for mapping a memory area of ​​a file or device to an address space of a process. Exemplarily, the preset memory mapping system call function may be an mmap() function.

[0047] The memory mapping parameters may include a mapping type, an area size of a ring buffer, etc. The mapping type may be a shared memory.

[0048] The producer pointer is used to point to the location where the user-mode probe writes data. The consumer pointer is used to point to the location where the kernel-mode probe reads data.

[0049] In an embodiment of the present application, a ring buffer is constructed through a preset memory mapping system call function, and data synchronization is performed in the ring buffer based on a lock-free mechanism, thereby achieving zero-copy sharing between user state and kernel state, and combining interrupt notification to achieve microsecond-level data synchronization.

[0050] In an embodiment of the present application, writing user-state data to a circular buffer based on a user-state probe may specifically include: encapsulating and packaging the user-state data based on the user-state probe to obtain the encapsulated and packaged user-state data, and writing the encapsulated and packaged user-state data to the circular buffer based on an atomic operation.

[0051] Among them, encapsulating and packaging the user-state data based on the user-state probe to obtain the encapsulated and packaged user-state data can specifically include: determining the data encapsulation structure based on the user-state probe and a preset grammatical structure; writing the target field in the user-state data corresponding to the data encapsulation structure to the target position in the data encapsulation structure based on the user-state probe to obtain a structured data object; performing binary conversion on the structured data object based on the user-state probe to obtain the encapsulated and packaged user-state data.

[0052] In embodiments of the present application, a preset syntax structure is used to define a structured data model, specifying the fields that need to be encapsulated and the encapsulation format of the fields. For example, the fields that need to be encapsulated may include a function address field, which is encapsulated as a hexadecimal string or integer type; system call parameters, which are encapsulated according to type definitions, such as a string type for file paths and an integer / floating point type for numeric parameters; return values, which are encapsulated according to type definitions, such as an integer type for file descriptors and an enumeration type for error codes; and metadata. The preset syntax structure may be a Protocol Buffers syntax structure, a binary data serialization format.

[0053] Specifically, after obtaining user-state data, the electronic device determines the data encapsulation structure based on the user-state probe and the preset grammatical structure, and writes the target field in the user-state data corresponding to the data encapsulation structure to the target position in the data encapsulation structure according to the data encapsulation structure to obtain a structured data object, and converts the structured data object into a compact binary byte stream to obtain the encapsulated and packaged user-state data. In this way, the user-state data can be processed based on the user-state probe, which can avoid the system kernel from directly parsing complex data structures and reduce the attack surface. At the same time, by encapsulating and packaging the user-state data, the data volume is greatly reduced, and it is converted into a binary data serialization format. Compared with other text formats, the data volume can be further reduced, thereby reducing the bandwidth and storage overhead in cross-state transmission.

[0054] Furthermore, after obtaining the user-state data after encapsulation and packaging, the electronic device writes the encapsulated and packaged user-state data into the ring buffer based on atomic operations, ensuring that the update operations of the producer pointer and the consumer pointer are atomic, avoiding data confusion when multiple threads or processes operate the pointers at the same time, and avoiding the performance overhead brought by the use of mutex locks, etc., realizing lock-free data transmission and improving the efficiency of data transmission.

[0055] In an embodiment of the present application, after the electronic device obtains user-state data based on the user-state probe, the preset interrupt function triggers an interrupt to notify the kernel-state probe to obtain the user-state data from the circular buffer area. After obtaining the user-state data based on the kernel-state data, the kernel-state data is captured based on the kernel-state probe and the user-state data.

[0056] Capturing kernel-state data based on kernel-state probes and user-state data can specifically include: parsing user-state data based on kernel-state probes, obtaining the call stack address corresponding to the user-state data, and determining the kernel symbol corresponding to the call stack address; obtaining the target function corresponding to the kernel symbol based on the kernel-state probe, executing the target function, and capturing the execution parameters corresponding to the target function, and determining the execution parameters as kernel-state data.

[0057] Determining the kernel symbol corresponding to the call stack address may specifically include: determining the kernel symbol corresponding to the call stack address based on a kernel state probe and a preset address symbol conversion function.

[0058] The preset address-to-symbol conversion function is used to provide a conversion function for a function address and symbol. It searches for the corresponding kernel symbol based on the function address, thereby mapping the user-state function in the user-state data to the kernel-state function. For example, the preset address-to-symbol conversion function may be the kallsyms_lookup() function, which converts the user-state glibc_open address based on the kallsyms_lookup() function to obtain the kernel function sys_open.

[0059] Furthermore, based on the kernel state probe, the target function corresponding to the kernel symbol is obtained, the target function is executed, and the execution parameters corresponding to the target function are captured, and the execution parameters are determined as kernel state data. Specifically, it can include: obtaining the target function based on the kernel state probe, and determining whether the target function has registered the kernel state probe; when it is determined that the target function has registered the kernel state probe, activating the preset function tracer to perform the tracking operation, capturing the execution parameters corresponding to the target function, and determining the execution parameters as kernel state data.

[0060] When it is determined that the target function has not registered a kernel-state probe, the function address corresponding to the target function is registered with the kernel-state probe management system, a breakpoint instruction is inserted at the target function entry based on the system kernel, the memory resources required by the kernel-state probe are allocated, the kernel-state probe status is recorded, and the target function is associated with the kernel-state probe management list to register the target function with the kernel-state probe; when the registration is successful, the preset function tracker is activated to perform a tracking operation, the execution parameters corresponding to the target function are captured, and the execution parameters are determined as kernel-state data; when the registration fails, a rollback operation is performed.

[0061] In this embodiment, kernel-mode data capture is performed through intelligent decision-making logic. If a kernel-mode probe has been registered for the target function, the function tracer is directly activated; if not, the kernel-mode probe is dynamically loaded, enabling real-time tracking of the target function without precompiling or restarting the kernel. This allows for the dynamic addition, modification, or removal of probes without affecting system stability, avoiding the time-consuming and tedious process of recompiling the kernel that is traditionally required.

[0062] In an embodiment of the present application, after acquiring the kernel-state data, the electronic device generates tracking identification information based on the user-state data and the kernel-state data.

[0063] Generating tracking identification information based on user-state data and kernel-state data can specifically include: obtaining a first timestamp, first process identification information, and first thread identification information corresponding to the user-state data, and a second timestamp, second process identification information, and second thread identification information corresponding to the kernel-state data; calculating a first hash value corresponding to the user-state data and a second hash value corresponding to the kernel-state data; generating tracking identification information based on a preset identification generation rule and at least one of the first timestamp, first process identification information, first thread identification information, second timestamp, second process identification information, second thread identification information, first hash value, and second hash value.

[0064] The preset identifier generation rule may include the arrangement order of various character strings when generating the tracking identifier information.

[0065] The specific implementation of calculating the first hash value corresponding to the user-state data and the second hash value corresponding to the kernel-state data is similar to the existing implementation of calculating the hash value, and is not described in detail here.

[0066] In an embodiment of the present application, when generating tracking identification information, the timestamps corresponding to user-state data and kernel-state data can be taken into account to avoid time conflicts. At the same time, process identification information and thread identification information are taken into account to distinguish different execution entities. The collision probability is further reduced by adding random numbers or hash values, ensuring that the generated tracking identification information meets the global unique identification requirements across stacks, processes, and time.

[0067] In an embodiment of the present application, after obtaining a function call chain, the electronic device preprocesses the function call chain to reduce the amount of data transmitted when the preprocessed function call chain is input into a preset analysis engine. The preprocessing may include one or more of filtering, compression, and priority marking.

[0068] Before inputting the function call chain into the preset analysis engine, the fault analysis method may further include: filtering the function call chain to obtain a filtered function call chain; performing priority marking on the function call chain data in the filtered function call chain to obtain a target function call chain; and compressing the target function call chain to obtain a compressed target function call chain.

[0069] Specifically, the electronic device can filter the data in the function call chain based on the kernel state probe and preset filtering rules, filter out irrelevant functions such as the kernel scheduler and idle tasks, determine the priority of each function call chain data based on the preset priority rules and the kernel module name corresponding to the function call chain data in the filtered function call chain, and perform priority marking on the function call chain data in the filtered function call chain. At the same time, the target function call chain (including tracking identification information) is compressed based on a preset compression algorithm (such as the lossless compression LZ4 algorithm) to obtain the compressed target function call chain.

[0070] In an embodiment of the present application, by filtering the function call chain, irrelevant data can be eliminated, reducing the processing resource usage of non-critical path data such as schedulers and idle tasks. At the same time, adding priority tags can improve the efficiency of troubleshooting and performance tuning, ensuring that problems in core system paths are discovered and processed first, accelerating fault response, shortening fault location time, and compression processing can reduce overhead during data transmission and improve transmission efficiency.

[0071] In an embodiment of the present application, a function call chain is input into a preset analysis engine, and the function call chain is analyzed based on the preset analysis engine to obtain a fault analysis result, which may specifically include: inputting the compressed target function call chain into the preset analysis engine, and the preset analysis engine parses the compressed target function call chain and extracts target data, where the target data includes at least one of the function time consumption, error code and resource occupancy data corresponding to the compressed target function call chain; inputting the target data into an anomaly detection model of the preset analysis engine, and the anomaly detection model analyzes the target data to obtain a fault analysis result, where the fault analysis result includes a fault probability score and a fault type.

[0072] In an embodiment of the present application, when the electronic device inputs the function call chain into the preset analysis engine based on the kernel state probe, the preset analysis engine receives the function call chain data through a socket-based communication mechanism, thereby improving the efficiency of data transmission, and processing data according to the core shards of the central processing unit, with an independent queue for each core, and performing dynamic current limiting based on the token bucket algorithm to dynamically adjust the consumption rate, avoid memory overflow, and ensure the normal operation of the system under high load.

[0073] When the operating system is a Linux operating system, the socket-based communication mechanism may be Netlink, a standard communication mechanism between the Linux kernel and the user space.

[0074] Specifically, dynamic flow control based on the token bucket algorithm can include: a preset analysis engine generates tokens in a token bucket at a preset token generation rate. Each token corresponds to data processing permissions of a certain size (e.g., 1 KB of data corresponds to 1 token). When data corresponding to a function call chain enters the preset analysis engine, it must obtain tokens from the bucket before it can be processed. When the data input rate exceeds the token generation rate (the bucket is exhausted), the engine triggers backpressure control to suspend the reception of new data or cache it in a temporary queue until tokens are regenerated in the bucket. If the input rate falls below a preset threshold, tokens accumulate in the bucket (the bucket has a maximum capacity limit) to cope with sudden traffic bursts. The preset threshold can be dynamically adjusted based on system load to balance processing efficiency and system stability.

[0075] In the embodiment of the present application, the function duration is the execution time of each function, that is, the time difference between the entry timestamp and the exit timestamp.

[0076] Error codes are standardized error identifiers returned when a system call fails. They are unified symbols used to describe the cause of the failure in the system. For example, ENOMEM indicates insufficient memory, EACCES indicates insufficient permissions, and ENOENT indicates a file does not exist.

[0077] The failure probability score reflects the probability of a failure occurring. For example, a failure probability score greater than 90 indicates a high probability of failure, while a score less than 50 indicates normal or low risk. The failure type is determined based on the corresponding relationship between the failure probability score and the failure type.

[0078] In the embodiment of the present application, the anomaly detection model may be a model constructed based on a Bayesian network structure, or may be other models that can be used for anomaly detection, which is not limited here.

[0079] In the embodiment of the present application, analysis can be performed through the anomaly detection model in the preset analysis engine, the link is automated, the efficiency and accuracy of fault analysis are improved, and labor costs are reduced.

[0080] In an embodiment of the present application, after obtaining the fault analysis results, the fault analysis method may further include: generating target control instructions based on the fault analysis results and a preset historical knowledge base, the target control instructions including a processing strategy for the target fault corresponding to the fault analysis results; executing the target control instructions to perform fault processing; and / or; generating alarm information based on the fault analysis results, and feeding back the alarm information to the user.

[0081] The preset historical knowledge base stores fault characteristics, corresponding tuning measures, and execution effects.

[0082] Specifically, after the electronic device obtains the fault analysis result, if the fault analysis result is that a fault exists, the fault characteristics are determined based on the fault type and the data corresponding to the fault, the fault characteristics are matched with the fault characteristics in the preset historical knowledge base, the corresponding tuning measures are determined, the tuning measures are determined as the processing strategy, the target control instructions are generated based on the processing strategy, and the target control instructions are executed to perform fault processing.

[0083] In an embodiment of the present application, after obtaining the fault analysis results, corresponding target control instructions can be generated to perform fault handling, and / or alarm information can be generated based on the fault analysis results and the alarm information can be fed back to the user, thereby improving the efficiency of fault handling and being able to feed back the fault information to the user in a timely manner, thereby improving the user experience.

[0084] In an embodiment of the present application, the electronic device may also send the fault analysis results and the processing strategy corresponding to the target control instruction to a preset rendering tool based on a preset analysis engine, and perform data rendering and display based on the preset rendering tool.

[0085] In an embodiment of the present application, the electronic device may further send resource usage data corresponding to a function call chain to a first preset rendering tool based on a preset analysis engine, render the resource usage data based on the first preset rendering tool, determine the CPU hotspot path, and display the CPU hotspot path in the form of a flame graph; send the target function call hierarchical relationship corresponding to the function call chain to a second preset rendering tool based on the preset analysis engine, render it based on the second preset rendering tool, and present the dependency relationship between functions in the form of a topology graph; send the target call timing corresponding to the function call chain to a third preset rendering tool based on the preset analysis engine, render it based on the third preset rendering tool, and display the cross-state call chain timing (i.e., function calls across user state and kernel state) in the form of a timeline view. The first preset rendering tool may be a Perfetto rendering tool, the second preset rendering tool may be a Cytoscape.js rendering tool, and the third preset rendering tool may be a Chrome Tracing rendering tool. Thus, users can intuitively see relevant information about the function call chain, improving the user experience.

[0086] Figure 2 A flowchart of another fault analysis method provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the fault analysis method may specifically include the following steps: S210 : In response to a target application triggering a system call, capturing user-state data based on a user-state probe.

[0087] S220. Encapsulate and package the user-state data based on the user-state probe, write the encapsulated and packaged user-state data into the circular buffer, and trigger an interrupt based on the user-state probe and the preset interrupt function to notify the kernel-state probe to obtain the user-state data from the circular buffer.

[0088] S230 , obtaining user-state data from the ring buffer based on the kernel-state probe, parsing the user-state data, obtaining a call stack address corresponding to the user-state data, and determining a kernel symbol corresponding to the call stack address.

[0089] S240 , obtaining a target function corresponding to the kernel symbol based on the kernel state probe, executing the target function, and capturing execution parameters corresponding to the target function, and determining the execution parameters as kernel state data.

[0090] S250 , generating tracking identification information based on the user state data and the kernel state data, establishing an association relationship between the user state data and the kernel state data based on the tracking identification information, and constructing a function call chain.

[0091] S260: Preprocess the function call chain to obtain a preprocessed function call chain.

[0092] S270. Input the preprocessed function call chain into a preset analysis engine, which parses and processes the preprocessed function call chain and extracts target data. The target data is input into an anomaly detection model of the preset analysis engine, which performs analysis based on the target data to obtain a fault analysis result. And / or, the preset analysis engine calls a preset rendering tool, which renders and displays data of the preprocessed function call chain based on the preset rendering tool.

[0093] It should be noted that the specific implementation of steps S210 to S270 is similar to the implementation of the relevant steps in the above embodiments of the present application, and will not be repeated here.

[0094] Through the embodiment of the present application, since user-state probes and kernel-state probes are set up, not only user-state data such as user-state space system call entry and exit information can be captured through the user-state probe, but also kernel-state data related to system calls in the operating system kernel can be captured through the kernel-state probe. That is, through the collaborative approach of the two probes, the effect of being able to directly and clearly observe and track the specific call sequence, hierarchical relationship and other information between various functions in the operating system kernel can be achieved. At the same time, the ring buffer area is constructed through the preset memory mapping system call function, and the data in the ring buffer area is synchronized based on the lock-free mechanism, realizing zero-copy sharing between user state and kernel state, and at the same time combining interrupt notifications to achieve microsecond-level data synchronization. After establishing an association relationship between user-state data and kernel-state data through tracking identification information, a function call chain is constructed, and the function call chain is pre-processed and input into the preset analysis engine for analysis to obtain the fault analysis result, the whole-link tracking of the system is realized, which solves the problem of difficulty in fault and exception analysis at the current operating system kernel level, and also improves the efficiency and accuracy of fault analysis.

[0095] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0096] An embodiment of the present application further provides a fault analysis device, which can be provided in an electronic device and can be understood as a partial functional module in the above-mentioned electronic device.

[0097] like Figure 3 As shown, the fault analysis device 300 may include a first information acquisition module 310 , a second information acquisition module 320 , a function call chain construction module 330 and a fault analysis module 340 .

[0098] The first information acquisition module 310 may be configured to capture user-mode data based on a user-mode probe in response to a target application triggering a system call.

[0099] The second information acquisition module 320 may be configured to capture kernel-state data based on kernel-state probes and user-state data.

[0100] The function call chain construction module 330 can be used to generate tracking identification information based on user state data and kernel state data, and establish an association relationship between the user state data and kernel state data based on the tracking identification information to construct a function call chain.

[0101] The fault analysis module 340 may be configured to input the function call chain into a preset analysis engine, analyze the function call chain based on the preset analysis engine, and obtain a fault analysis result.

[0102] Through the embodiment of the present application, since user-state probes and kernel-state probes are set up, not only can user-state data such as user-state space system call entry and exit information be captured through the user-state probe, but also kernel-state data related to system calls in the operating system kernel can be captured through the kernel-state probe. That is, through the collaborative approach of the two probes, the effect of being able to directly and clearly observe and track the specific call sequence, hierarchical relationship, and other information between various functions in the operating system kernel can be achieved. At the same time, the user-state data and kernel-state data are associated with each other through tracking identification information, a function call chain is constructed, and the function call chain is input into the preset analysis engine for analysis to obtain the fault analysis results, thus realizing full-link tracking of the system, solving the current problem of difficulty in fault and exception analysis at the operating system kernel level, and improving the efficiency and accuracy of fault analysis.

[0103] In some embodiments of the present application, the fault analysis device 300 may further include an information interaction module.

[0104] The information interaction module may be configured to write the user state data into the ring buffer area based on the user state probe after the user state data is captured based on the user state probe; An interrupt is triggered based on the user-mode probe and the preset interrupt function to notify the kernel-mode probe to obtain user-mode data from the ring buffer.

[0105] In some embodiments of the present application, the fault analysis device 300 may further include a ring buffer area creation module.

[0106] The circular buffer creation module can be used to initiate a memory mapping system call to the system kernel based on the user state probe and a preset memory mapping system call function before writing the user state data into the circular buffer based on the user state probe, so as to send memory mapping parameters to the system kernel; Perform memory area allocation and mapping operations based on the system kernel and memory mapping parameters to obtain the target mapping area; Based on the system kernel, the target mapping area is divided into a circular queue to obtain a circular buffer area. The circular buffer area includes a producer pointer and a consumer pointer. The producer pointer and the consumer pointer synchronize data based on a lock-free mechanism.

[0107] In some embodiments of the present application, the information interaction module can be specifically used to encapsulate and package user-state data based on user-state probes, obtain the encapsulated and packaged user-state data, and write the encapsulated and packaged user-state data into the ring buffer based on atomic operations.

[0108] In some embodiments of the present application, the information interaction module may also be specifically configured to determine a data encapsulation structure based on a user-state probe and a preset grammatical structure; Based on the user state probe, the target field corresponding to the data encapsulation structure in the user state data is written into the target position in the data encapsulation structure to obtain a structured data object; Based on the user-state probe, the structured data object is converted into binary form to obtain the encapsulated and packaged user-state data.

[0109] In some embodiments of the present application, the second information acquisition module 320 may be specifically configured to parse the user-state data based on the kernel-state probe, obtain the call stack address corresponding to the user-state data, and determine the kernel symbol corresponding to the call stack address; A target function corresponding to a kernel symbol is obtained based on a kernel state probe, the target function is executed, and execution parameters corresponding to the target function are captured, and the execution parameters are determined as kernel state data.

[0110] In some embodiments of the present application, the second information acquisition module 320 may also be specifically configured to determine a kernel symbol corresponding to the call stack address based on a kernel state probe and a preset address symbol conversion function.

[0111] The second information acquisition module 320 may also be specifically configured to acquire a target function based on the kernel state probe, and determine whether the target function has registered the kernel state probe; When it is determined that the target function has registered a kernel state probe, a preset function tracer is activated to perform a trace operation, the execution parameters corresponding to the target function are captured, and the execution parameters are determined as kernel state data.

[0112] In some embodiments of the present application, the fault analysis device 300 may further include a probe registration module.

[0113] The probe registration module can be used to, after determining whether the target function has registered the kernel-state probe, register the function address corresponding to the target function with the kernel-state probe management system when it is determined that the target function has not registered the kernel-state probe, insert a breakpoint instruction at the target function entry based on the system kernel, allocate memory resources required by the kernel-state probe, record the kernel-state probe status, and associate the target function with the kernel-state probe management list to register the target function with the kernel-state probe; When the registration is successful, the preset function tracer is activated to perform the trace operation, capture the execution parameters corresponding to the target function, and determine the execution parameters as kernel state data; In case of registration failure, a rollback operation is performed.

[0114] In some embodiments of the present application, the function call chain construction module 330 may be specifically configured to obtain a first timestamp, first process identification information, and first thread identification information corresponding to the user state data, and a second timestamp, second process identification information, and second thread identification information corresponding to the kernel state data; Calculate a first hash value corresponding to the user-state data and a second hash value corresponding to the kernel-state data; The tracking identification information is generated based on a preset identification generation rule and at least one of the first timestamp, the first process identification information, the first thread identification information, the second timestamp, the second process identification information, the second thread identification information, the first hash value, and the second hash value.

[0115] In some embodiments of the present application, the fault analysis device 300 may further include a data preprocessing module.

[0116] The data preprocessing module can be used to filter the function call chain before inputting it into the preset analysis engine to obtain a filtered function call chain; Priority marking is performed on the function call chain data in the filtered function call chain to obtain a target function call chain; The target function call chain is compressed to obtain a compressed target function call chain.

[0117] In some embodiments of the present application, the fault analysis module 340 may be specifically configured to input the compressed target function call chain into a preset analysis engine, which parses the compressed target function call chain and extracts target data, where the target data includes at least one of function duration, error code, and resource usage data corresponding to the compressed target function call chain. The target data is input into the anomaly detection model of the preset analysis engine. The anomaly detection model analyzes the target data to obtain the fault analysis results. The fault analysis results include the fault probability score and the fault type.

[0118] In some embodiments of the present application, the fault analysis device 300 may further include, after obtaining the fault analysis result, generating a target control instruction based on the fault analysis result and a preset historical knowledge base, the target control instruction including a processing strategy for a target fault corresponding to the fault analysis result; Execute target control instructions to handle faults; and / or; Generate alarm information based on the fault analysis results and feed the alarm information back to the user.

[0119] For the description of the features in the embodiment corresponding to the fault analysis device 300, reference can be made to the relevant description of the embodiment corresponding to the fault analysis method, which will not be repeated here.

[0120] An embodiment of the present application further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any of the above-mentioned fault analysis method embodiments.

[0121] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps of any of the above-mentioned fault analysis method embodiments when running.

[0122] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0123] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any of the above-mentioned fault analysis method embodiments are implemented.

[0124] An embodiment of the present application further provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above-mentioned fault analysis method embodiments are implemented.

[0125] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0126] The above is a detailed introduction to a fault analysis method, device, medium and program product provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only intended to help understand the method and core ideas of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A fault analysis method, characterized in that: include: In response to a target application triggering a system call, capturing user-state data based on a user-state probe; Capturing kernel-state data based on the kernel-state probe and the user-state data; generating tracking identification information based on the user state data and the kernel state data, and establishing an association relationship between the user state data and the kernel state data based on the tracking identification information to construct a function call chain; The function call chain is input into a preset analysis engine, and the function call chain is analyzed based on the preset analysis engine to obtain a fault analysis result.

2. The fault analysis method according to claim 1, characterized in that: After capturing the user state data based on the user state probe, the method further includes: Writing the user state data into a ring buffer based on the user state probe; An interrupt is triggered based on the user-state probe and a preset interrupt function to notify the kernel-state probe to obtain the user-state data from the ring buffer.

3. The fault analysis method according to claim 2, characterized in that: Before writing the user-state data into the ring buffer based on the user-state probe, the method further includes: Initiating a memory mapping system call to the system kernel based on the user state probe and a preset memory mapping system call function to send memory mapping parameters to the system kernel; Perform memory area allocation and mapping operations based on the system kernel and the memory mapping parameters to obtain a target mapping area; The target mapping area is divided into a circular queue based on the system kernel to obtain the circular buffer area, which includes a producer pointer and a consumer pointer. The producer pointer and the consumer pointer perform data synchronization based on a lock-free mechanism.

4. The fault analysis method according to claim 2, characterized in that: The step of writing the user state data into a ring buffer based on the user state probe comprises: The user state data is encapsulated and packaged based on the user state probe to obtain the encapsulated and packaged user state data, and the encapsulated and packaged user state data is written into the ring buffer based on an atomic operation.

5. The fault analysis method according to claim 4, characterized in that: The encapsulating and packaging the user state data based on the user state probe to obtain the encapsulated and packaged user state data includes: Determining a data encapsulation structure based on the user-state probe and a preset grammatical structure; Writing a target field corresponding to the data encapsulation structure in the user-state data into a target position in the data encapsulation structure based on the user-state probe to obtain a structured data object; The structured data object is subjected to binary conversion processing based on the user-state probe to obtain the user-state data after the encapsulation and packaging processing.

6. The fault analysis method according to claim 1, characterized in that: The capturing of kernel-state data based on the kernel-state probe and the user-state data includes: Parsing the user-state data based on the kernel-state probe, obtaining a call stack address corresponding to the user-state data, and determining a kernel symbol corresponding to the call stack address; A target function corresponding to the kernel symbol is acquired based on the kernel state probe, the target function is executed, and execution parameters corresponding to the target function are captured, and the execution parameters are determined as the kernel state data.

7. The fault analysis method according to claim 6, characterized in that: Determining the kernel symbol corresponding to the call stack address includes: Determining a kernel symbol corresponding to the call stack address based on the kernel state probe and a preset address symbol conversion function; The step of acquiring a target function corresponding to the kernel symbol based on the kernel state probe, executing the target function, capturing execution parameters corresponding to the target function, and determining the execution parameters as the kernel state data includes: Acquire the target function based on the kernel state probe, and determine whether the target function has registered the kernel state probe; When it is determined that the target function has registered the kernel-state probe, a preset function tracer is activated to perform a trace operation, an execution parameter corresponding to the target function is captured, and the execution parameter is determined as the kernel-state data.

8. The fault analysis method according to claim 7, characterized in that: After determining whether the target function has registered the kernel state probe, the method further includes: When it is determined that the target function has not registered the kernel-state probe, registering a function address corresponding to the target function with a kernel-state probe management system, inserting a breakpoint instruction at an entry of the target function based on a system kernel, allocating memory resources required by the kernel-state probe, recording a kernel-state probe state, and associating the target function with a kernel-state probe management list to register the target function with the kernel-state probe; When the registration is successful, activating the preset function tracker to perform a tracking operation, capturing the execution parameters corresponding to the target function, and determining the execution parameters as the kernel state data; In case of registration failure, a rollback operation is performed.

9. The fault analysis method according to claim 1, characterized in that: The generating of tracking identification information based on the user state data and the kernel state data includes: Obtaining a first timestamp, first process identification information, and first thread identification information corresponding to the user state data, and a second timestamp, second process identification information, and second thread identification information corresponding to the kernel state data; Calculating a first hash value corresponding to the user state data and a second hash value corresponding to the kernel state data; The tracking identification information is generated based on a preset identification generation rule and at least one of the first timestamp, the first process identification information, the first thread identification information, the second timestamp, the second process identification information, the second thread identification information, the first hash value, and the second hash value.

10. The fault analysis method according to claim 1, characterized in that: Before inputting the function call chain into a preset analysis engine, the method further includes: Filtering the function call chain to obtain a filtered function call chain; performing priority marking processing on the function call chain data in the filtered function call chain to obtain a target function call chain; The target function call chain is compressed to obtain a compressed target function call chain.

11. The fault analysis method according to claim 10, characterized in that: Inputting the function call chain into a preset analysis engine, and analyzing the function call chain based on the preset analysis engine to obtain a fault analysis result, includes: Inputting the compressed target function call chain into the preset analysis engine, the preset analysis engine parsing the compressed target function call chain and extracting target data, the target data including at least one of function time consumption, error code, and resource usage data corresponding to the compressed target function call chain; The target data is input into the anomaly detection model of the preset analysis engine, and the anomaly detection model performs analysis based on the target data to obtain the fault analysis result, which includes a fault probability score and a fault type.

12. The fault analysis method according to claim 1 or 11, characterized in that: After obtaining the fault analysis result, the method further includes: generating a target control instruction based on the fault analysis result and a preset historical knowledge base, wherein the target control instruction includes a processing strategy for a target fault corresponding to the fault analysis result; executing the target control instruction to perform fault processing; and / or; Generate warning information based on the fault analysis result, and feed the warning information back to the user.

13. An electronic device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the fault analysis method according to any one of claims 1 to 12 when executing the computer program.

14. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the fault analysis method according to any one of claims 1 to 12.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the fault analysis method according to any one of claims 1 to 12 are implemented.

Images