Application memory overflow fault positioning method, system and device and medium

Abstract

The invention discloses an application memory overflow fault positioning method, system and device and a medium, and the method comprises the steps: configuring a detection strategy in an application container node, carrying out the snapshot capture processing of a memory overflow event according to the detection strategy to obtain a memory snapshot, carrying out the application language recognition processing of the memory snapshot to obtain an application language, and storing the application language. And performing fault mode identification processing on the memory snapshot according to the application language to obtain a fault mode, performing analysis processing on the memory use condition of the application container node according to the fault mode to obtain an analysis result, and performing memory tracking processing on the analysis result to obtain a fault positioning result. The embodiment of the invention can automatically process the memory overflow fault, and can be widely applied to the technical field of computers.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to an application memory overflow fault positioning method, system, device and medium. BACKGROUND

[0002] In the cloud native computing environment, container technology has become a standard way to deploy and run applications. When an application in a container attempts to use resources exceeding its configured memory limit, the system triggers a memory overflow error, which can cause the application to crash and affect the availability of services. In the related art, when an application encounters a memory overflow error in a cloud native environment, developers and operators usually need to manually intervene to identify the root cause of the problem by analyzing memory snapshots or log files. However, in actual applications, it is found that this process not only consumes time, but also can cause service interruption time to be prolonged, especially in production environments with high availability requirements, affecting the efficiency of locating the root cause of the problem and the running efficiency of the application.

[0003] To sum up, the technical problems existing in the related art need to be improved. SUMMARY

[0004] The main purpose of the embodiments of the present application is to provide an application memory overflow fault positioning method, system, device and medium, which can improve the fault positioning efficiency of memory overflow.

[0005] To achieve the above-mentioned purpose, one aspect of the embodiments of the present application provides an application memory overflow fault positioning method, which comprises:

[0006] configuring a detection strategy in an application container node;

[0007] performing snapshot capture processing on a memory overflow event according to the detection strategy to obtain a memory snapshot;

[0008] performing application language recognition processing on the memory snapshot to obtain an application language;

[0009] performing fault mode recognition processing on the memory snapshot according to the application language to obtain a fault mode;

[0010] performing analysis processing on the memory usage of the application container node according to the fault mode to obtain an analysis result;

[0011] performing memory tracking processing on the analysis result to obtain a fault positioning result.

[0012] In some embodiments, the configuring a detection strategy in an application container node comprises:

[0013] performing control group setting processing on the application container node to obtain a container resource limit parameter;

[0014] According to the container resource limit parameter, the exchange partition of the application container node is processed by policy classification setting, and the detection policy is obtained.

[0015] In some embodiments, the memory overflow event is captured by snapshot according to the detection policy, and a memory snapshot is obtained, including:

[0016] The memory usage parameter is obtained through a resource state query interface;

[0017] According to the detection policy, the memory usage parameter is detected to obtain a detection result;

[0018] According to the detection result, a memory overflow event is generated to obtain a memory overflow event;

[0019] The memory overflow event is captured by snapshot to obtain the memory snapshot.

[0020] In some embodiments, the application language is obtained by recognizing the memory snapshot according to the application language, including:

[0021] The file feature is obtained by analyzing the memory snapshot;

[0022] The running feature is obtained by analyzing the memory snapshot;

[0023] The application language is obtained by comprehensively determining the memory snapshot according to the file feature and the running feature.

[0024] In some embodiments, the fault mode is obtained by identifying the memory snapshot according to the application language, including:

[0025] The memory analysis tool is obtained by analyzing tool matching according to the application language;

[0026] The memory feature is obtained by extracting the memory snapshot according to the memory analysis tool;

[0027] The matching mode is obtained by matching the memory feature according to the rule engine;

[0028] The abnormal detection result is obtained by detecting the memory feature according to the machine learning model;

[0029] The fault mode is determined according to the matching mode and the abnormal detection result.

[0030] In some embodiments, the analyzing the memory usage of the application container node according to the failure mode comprises:

[0031] tracking the object life cycle of the application container node according to the failure mode to obtain a target life cycle;

[0032] analyzing the memory usage index of the target life cycle to obtain an analysis result.

[0033] In some embodiments, the memory tracking the analysis result to obtain a failure positioning result comprises:

[0034] performing time series analysis on the analysis result to obtain an object path;

[0035] matching the object path according to a symbol table to obtain a parsed symbol;

[0036] performing code positioning on the parsed symbol to obtain a target code;

[0037] performing heat calculation on the target code to obtain the failure positioning result.

[0038] To achieve the above object, another aspect of the embodiment of the application proposes an application memory overflow failure positioning system, the system comprises:

[0039] a policy configuration module configured to configure a detection policy in an application container node;

[0040] a snapshot capturing module configured to capture a snapshot of a memory overflow event according to the detection policy to obtain a memory snapshot;

[0041] a language recognition module configured to recognize an application language of the memory snapshot to obtain the application language;

[0042] a failure recognition module configured to recognize a failure mode of the memory snapshot according to the application language to obtain the failure mode;

[0043] a memory analysis module configured to analyze the memory usage of the application container node according to the failure mode to obtain an analysis result;

[0044] a failure positioning module configured to memory track the analysis result to obtain a failure positioning result.

[0045] To achieve the above object, another aspect of the embodiment of the application proposes an electronic device, the electronic device comprises a memory and a processor, the memory stores a computer program, and the processor implements the method described above when executing the computer program.

[0046] To achieve the above object, another aspect of the embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method described above.

[0047] To achieve the above object, another aspect of the embodiment of the present application provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the method described above

[0048] The embodiment of the present application at least has the following beneficial effects: the present application provides an application memory overflow fault positioning method, system, device and medium, the scheme is configured by detecting strategy in the application container node, the memory snapshot is obtained by snapshot capturing processing of the memory overflow event according to the detection strategy, the application language is obtained by application language recognition processing of the memory snapshot, the fault mode is obtained by fault mode identification processing of the memory snapshot according to the application language, the analysis result is obtained by analyzing and processing the memory usage of the application container node according to the fault mode, and the fault positioning result is obtained by memory tracking processing of the analysis result. The embodiment of the present application can automatically process the memory overflow fault, can quickly locate the problem root, and improves the stability and reliability of cloud native application. BRIEF DESCRIPTION OF DRAWINGS

[0049] Figure 1 It is a flow chart of an application memory overflow fault positioning method provided by the embodiment of the present application;

[0050] Figure 2 It is a strategy configuration framework schematic diagram provided by the embodiment of the present application;

[0051] Figure 3 It is a mode identification process schematic diagram provided by the embodiment of the present application;

[0052] Figure 4 It is an object tracking schematic diagram provided by the embodiment of the present application;

[0053] Figure 5 It is a time series analysis schematic diagram provided by the embodiment of the present application;

[0054] Figure 6 It is a code level root cause positioning schematic diagram provided by the embodiment of the present application;

[0055] Figure 7 It is a system architecture schematic diagram provided by the embodiment of the present application;

[0056] Figure 8 It is a structure schematic diagram of an application memory overflow fault positioning system provided by the embodiment of the present application;

[0057] Figure 9 Figure 1 is a schematic diagram of a hardware structure of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0058] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not intended to limit the present application. When the following description refers to the accompanying drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with embodiments of the present application. They are only examples of systems and methods consistent with some aspects of the embodiments of the present application as detailed in the appended claims.

[0059] It can be understood that the terms "first", "second", and the like used in the present application can be used herein to describe various concepts, but unless specifically stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of the present application, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information. Depending on the context, the word "if" as used herein can be interpreted as "when" or "upon" or "in response to determining".

[0060] The terms "at least one", "multiple", "each", "any", and the like used in the present application include one, two or more than two, multiple includes two or more than two, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0061] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0062] In cloud-native computing environments, container technology has become a standard way to deploy and run applications. Containers ensure that each application can only access the resources allocated to it through resource isolation mechanisms, including memory. When an application within a container attempts to use more resources than its configured memory limit, the system triggers an Out of Memory (OOM) error, which can cause the application to crash and affect the availability of the service.

[0063] In the related art, when an application encounters a memory overflow error in a cloud-native environment, developers and operation and maintenance personnel usually need to manually intervene to identify the root cause of the problem by analyzing memory snapshots or log files. This process not only takes time, but also can cause service interruption time to be extended, especially in production environments with high availability requirements.

[0064] Therefore, in the embodiments of the present application, an application memory overflow fault positioning method is provided. The method comprises the following steps: configuring a detection strategy in an application container node; performing snapshot capture processing on a memory overflow event according to the detection strategy to obtain a memory snapshot; performing application language identification processing on the memory snapshot to obtain an application language; performing fault mode identification processing on the memory snapshot according to the application language to obtain a fault mode; performing analysis processing on a memory usage of the application container node according to the fault mode to obtain an analysis result; and performing memory tracking processing on the analysis result to obtain a fault positioning result. The embodiments of the present application can automatically process memory overflow faults, quickly locate the root cause of the problem, and improve the stability and reliability of cloud-native applications.

[0065] The application memory overflow fault positioning method provided by the embodiments of the present application relates to the technical field of computers. The application memory overflow fault positioning method provided by the embodiments of the present application can be applied to a terminal, can be applied to a server, and can also be software running in a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, a vehicle-mounted terminal, and the like, but is not limited thereto. The server end can be configured as a standalone physical server, can be configured as a server cluster or a distributed system composed of multiple physical servers, can be configured as a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs, big data, and artificial intelligence platforms, and the server can also be a node server in a blockchain network. The software can be an application that implements the application memory overflow fault positioning method, and the like, but is not limited to the above forms.

[0066] The application is operable in a variety of general purpose or special purpose computing system environments or configurations. Examples of computing systems, environments, and / or configurations that can be suitable for use with the application include personal computers, server computers, handheld or laptop devices, tablet devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like. The application can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and the like, that perform particular tasks or implement particular abstract data types. The application can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in local and remote computer storage media including memory storage devices.

[0067] Figure 1 is an optional flowchart of an application memory overflow fault positioning method provided by an embodiment of the application, Figure 1 The method in the application can include, but is not limited to, steps S101 to S106.

[0068] Step S101, configuring a detection strategy in an application container node;

[0069] Step S102, performing snapshot capture processing on a memory overflow event according to the detection strategy, to obtain a memory snapshot;

[0070] Step S103, performing application language recognition processing on the memory snapshot, to obtain an application language;

[0071] Step S104, performing fault mode recognition processing on the memory snapshot according to the application language, to obtain a fault mode;

[0072] Step S105, performing analysis processing on a memory usage of the application container node according to the fault mode, to obtain an analysis result;

[0073] Step S106, performing memory tracking processing on the analysis result, to obtain a fault positioning result.

[0074] The steps S101 to S106 shown in the embodiments of the present application can add specific parameters in the container configuration according to the detection strategy and save them in a preset directory in a specific format by configuring the detection strategy in the application container node. The memory snapshot is obtained by performing snapshot capturing processing on the memory overflow event according to the detection strategy, which can automatically generate a memory snapshot when the container has a memory overflow error and save the memory snapshot in a preset directory in a specific format. The embodiments of the present application can detect the memory usage state of the container in real time, discover potential memory overflow risks in time, and trigger the subsequent analysis process immediately when the memory overflow event occurs. The application language is obtained by performing application language recognition processing on the memory snapshot, the appropriate memory analysis tool can be automatically selected according to the application language, then the fault mode recognition is performed on the memory snapshot, which can recognize typical memory overflow problem modes such as memory leakage and memory fragmentation, analyze the memory usage of the application container node according to the fault mode, obtain the key object or data structure causing the memory overflow according to the analysis result, and locate the specific code line or function by performing memory allocation and release path tracking on the key object or data structure, so as to obtain the final fault location result.

[0075] In some embodiments, the configuring the detection strategy in the application container node comprises:

[0076] performing control group setting processing on the application container node to obtain a container resource limit parameter;

[0077] performing policy hierarchical setting processing on the swap partition of the application container node according to the container resource limit parameter to obtain the detection strategy.

[0078] In the embodiments of the present application, the control group (cgroup) can be set in the application container node to limit, record and isolate the physical resources used by the process group, such as CPU, memory, disk I / O, etc. The container resource limit parameter can be set in the control group in the embodiments of the present application, which can include the upper limit of memory, etc., and then the swap partition of the application container node is set according to the container resource limit parameter. Please refer to Figure 2The embodiment of the application injects control group parameters, sets an upper limit parameter of memory, sets a corresponding policy for a swap of an application container node, calculates a swap usage rate according to the policy, determines whether a memory overflow event is triggered, and triggers snapshot capture according to the memory overflow event. The policy is hierarchically set as a basic policy: setting a maximum swap (memory.swap.max) to 2 times a physical memory, a strict policy: setting a swap of a financial container to be disabled (memory.swap.max=0), and an elastic policy: setting a swap automatic expansion and contraction threshold (80% to 100%). The embodiment of the application can also set a multi-level early warning mechanism and perform early warning by calculating the swap usage rate.

[0079] In some embodiments, the snapshot capture processing of the memory overflow event according to the detection policy obtains a memory snapshot, and includes:

[0080] The memory usage parameter is obtained through a resource state query interface;

[0081] The memory usage parameter is detected according to the detection policy to obtain a detection result;

[0082] The memory overflow event is generated according to the detection result to obtain a memory overflow event;

[0083] The memory overflow event is captured to obtain the memory snapshot.

[0084] In the embodiment of the application, the corresponding parameters can be obtained through an application programming interface of an integrated container orchestration platform. The memory usage parameter is obtained through a resource state query interface, and the memory usage parameter is monitored based on a control group. Then, the memory usage parameter is detected according to a pre-set detection policy, a corresponding memory event trigger signal is generated according to the detection result, and a memory overflow event is generated. The system generates an event by monitoring a memory overflow event trigger signal, including an action and an application self-reported memory error. It can be envisaged that the embodiment of the application can set a memory usage early warning threshold, which can alarm in advance when the memory is tight but not completely exhausted. The embodiment of the application continuously monitors the memory usage of the container, and the system can respond quickly when the memory overflow event occurs, ensuring the timeliness and accuracy of the memory snapshot capture.

[0085] In some embodiments, the application language recognition processing of the memory snapshot obtains an application language, and includes:

[0086] The file feature analysis processing of the memory snapshot obtains a file feature;

[0087] performing running feature analysis processing on the memory snapshot to obtain a running feature;

[0088] performing application language comprehensive determination processing on the memory snapshot according to the file feature and the running feature to obtain the application language.

[0089] In the embodiment of the present application, by performing file feature analysis processing on the memory snapshot, the file feature can be obtained by analyzing the file extension and the shebang of the memory snapshot. By analyzing the file extension, the programming language used by the application corresponding to the memory snapshot can be obtained, and by analyzing the shebang, the programming language used by the execution mode can be obtained, thereby obtaining the corresponding file feature. The shebang is a string line composed of a hash sign and an exclamation mark (#!), which appears in the first two characters of the first line of a text file, and is used to specify the interpreter of the command. The embodiment of the present application also performs running feature analysis processing on the memory snapshot to obtain the running feature. The running feature is obtained by detecting the existence of the process and the global interpreter lock. During program running, the virtual machine process in JAVA language can be detected, and the existence of the global interpreter lock (GIL) in Python language can be detected. By detecting whether the virtual machine process exists during running, it can be judged whether JAVA language is used. The embodiment of the present application can obtain the corresponding application language by comprehensively judging the static file feature and the running feature of the memory snapshot.

[0090] In some embodiments, the fault mode recognition processing on the memory snapshot according to the application language to obtain a fault mode comprises:

[0091] performing analysis tool matching processing according to the application language to obtain a memory analysis tool;

[0092] performing feature extraction processing on the memory snapshot according to the memory analysis tool to obtain a memory feature;

[0093] performing pattern matching processing on the memory feature according to a rule engine to obtain a matching pattern;

[0094] performing anomaly detection processing on the memory feature according to a machine learning model to obtain an anomaly detection result;

[0095] determining the fault mode according to the matching pattern and the anomaly detection result.

[0096] In the embodiment of the present application, according to the identified application language, the corresponding memory analysis tool can be matched, and by the memory analysis tool, the memory feature can be obtained by performing feature extraction processing on the memory snapshot, thereby performing fault mode recognition processing according to the memory feature. Please refer to Figure 3The application embodiment extracts time series and other features from the memory snapshot through a memory analysis tool or a feature extraction layer in a recognition engine, then performs pattern matching according to a rule engine, and performs abnormality detection processing on the memory features according to a machine learning model. The machine learning model can be an LSTM model for memory pattern recognition. Finally, a comprehensive judgment is made according to the matching pattern and the abnormality detection result, and the fault pattern corresponding to the memory overflow event can be identified.

[0097] In some embodiments, the analysis processing of the memory usage of the application container node according to the fault pattern obtains an analysis result, including:

[0098] According to the fault pattern, the object lifecycle tracking processing of the application container node is performed to obtain a target lifecycle;

[0099] The memory usage indicators of the target lifecycle are analyzed and processed to obtain an analysis result.

[0100] In the application embodiment, the object lifecycle tracking of the application container node can be performed according to the identified fault pattern, please refer to Figure 4 , the allocation point of the application container node can be determined according to the identified fault pattern, so as to identify the memory allocator corresponding to the allocation point. According to the memory allocator, the object lifecycle of the application container node can be obtained. In a feasible embodiment, the object lifecycle includes object creation, reference establishment, object recycling and memory release. Specifically, the object creation processing is performed through the memory allocator, the corresponding reference of the object is established, and finally the object recycling processing is performed to release the memory of the object. The application embodiment can analyze and monitor the usage indicators of the memory in the target lifecycle by tracking the object lifecycle, so as to obtain an analysis result.

[0101] In some embodiments, the memory tracking processing of the analysis result obtains a fault positioning result, including:

[0102] The time series analysis processing of the analysis result obtains an object path;

[0103] The matching processing of the object path according to the symbol table obtains a parsed symbol;

[0104] The code positioning processing of the parsed symbol obtains a target code;

[0105] The heat calculation processing of the target code obtains the fault positioning result.

[0106] In the application embodiment, the code line or function causing the memory overflow event can be located by performing the memory tracking processing on the analysis result. Please refer toFigure 5 According to the analysis result, the snapshot can be subjected to object set searching processing, so that a corresponding live object can be obtained according to object set matching, so that the live object can be subjected to path analysis processing, and an object path is obtained. Please refer to Figure 6 According to the object path, memory analysis processing can be performed. The corresponding memory object is obtained according to the object path, and the object type and allocation stack are obtained through analysis. The allocation stack is subjected to symbol resolution and matching processing in combination with a symbol table, and the resolved symbol is obtained. The code positioning processing is performed according to the resolved symbol. The corresponding code file is located by analyzing an abstract syntax tree (AST), and the heat of the code file is calculated. The final code line can be located by querying the ranking of the code related to the word. The heat calculation is a common method in defect positioning. A suspicious score is calculated for each code element such as a statement by analyzing the coverage information of the program running, such as statement coverage. The input condition triggering the fault is generated by the symbol interpretation analysis, and the dependent relationship is traced back from the crash point in combination with dynamic program slicing, so as to locate the code line set related to the fault. Then, the execution heat of each code is calculated based on the heat algorithm using the test coverage data, that is, the association strength of the failure test coverage and the total failure test, and finally a sorted list is output in descending order of suspicious degree, so as to accurately identify the potential defect code.

[0107] Next, the scheme of the embodiments of the present application will be described and explained in detail in combination with specific application examples:

[0108] The embodiments of the present application can be applied to the detection scene of cloud native application. Please refer to Figure 7 The embodiments of the present application perform event monitoring on the container platform. The corresponding control group is sampled by a monitoring agent (Agent). The memory overrun is detected by a control group monitor. The memory snapshot is captured and generated by a snapshot capturer when the memory overflow event is triggered according to the memory parameters by a memory overflow detector. The memory snapshot is transmitted to a monitoring platform. The memory snapshot file is stored in a distributed manner by the monitoring platform. The application language of the memory snapshot is identified by a multi-language analysis engine. The corresponding symbol table is obtained by connecting the symbol table database through the code repository. The memory snapshot is analyzed by a diagnosis console, and the code positioning is performed in combination with the symbol table. Finally, the corresponding code of the memory overflow event is returned to the operation and maintenance platform.

[0109] Please refer to Figure 8 The embodiments of the present application also provide a memory overflow fault positioning system. The system can implement the above method. The system comprises:

[0110] The policy configuration module 801 is configured to configure a detection policy in an application container node.

[0111] The snapshot capturing module 802 is configured to perform snapshot capturing processing on the memory overflow event according to the detection policy, to obtain a memory snapshot.

[0112] The language recognition module 803 is configured to perform application language recognition processing on the memory snapshot, to obtain an application language.

[0113] The fault recognition module 804 is configured to perform fault mode recognition processing on the memory snapshot according to the application language, to obtain a fault mode.

[0114] The memory analysis module 805 is configured to perform analysis processing on a memory usage condition of the application container node according to the fault mode, to obtain an analysis result.

[0115] The fault positioning module 806 is configured to perform memory tracking processing on the analysis result, to obtain a fault positioning result.

[0116] It can be understood that the content in the above method embodiments is applicable to the present system embodiments, the present system embodiments specifically implement the functions of the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0117] The present application also provides an electronic device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the above method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a vehicle-mounted computer, etc.

[0118] It can be understood that the content in the above method embodiments is applicable to the present device embodiments, the present device embodiments specifically implement the functions of the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0119] Please refer to Figure 9 , Figure 9 The hardware structure of the electronic device of another embodiment is illustrated, which includes:

[0120] The processor 901 can be implemented in a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, etc., and is configured to execute a related program to implement the technical solutions provided by the present application.

[0121] The memory 902 can be implemented in the form of a Read Only Memory (ROM), a static storage device, a dynamic storage device, or a Random Access Memory (RAM), etc. The memory 902 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present specification are implemented by software or firmware, the related program codes are stored in the memory 902 and are called and executed by the processor 901 to perform the above-mentioned method of the embodiments of the present application;

[0122] The input / output interface 903 is configured to realize information input and output.

[0123] The communication interface 904 is configured to realize the communication interaction between the device and other devices, and can realize the communication through a wired manner (for example, a USB, a network cable, etc.) or a wireless manner (for example, a mobile network, WIFI, Bluetooth, etc.).

[0124] The bus 905 is configured to transmit information between various components (for example, the processor 901, the memory 902, the input / output interface 903, and the communication interface 904) of the device.

[0125] The processor 901, the memory 902, the input / output interface 903, and the communication interface 904 are connected to each other through the bus 905 to realize the communication connection between the device.

[0126] The embodiments of the present application also provide a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the above-mentioned method.

[0127] It can be understood that the content in the above method embodiments is applicable to the present storage medium embodiments. The present storage medium embodiments specifically implement the same functions as the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0128] The embodiments of the present application also provide a computer program product, which includes a computer program. The computer program is executed by a processor to implement the above-mentioned method.

[0129] It can be understood that the content in the above method embodiments is applicable to the present program product embodiments. The present program product embodiments specifically implement the same functions as the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0130] The memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. In addition, the memory can include a high-speed random access memory and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory that is remotely arranged relative to the processor, and these remote memories can be connected to the processor through a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0131] The application embodiment provides an application memory overflow fault positioning method, system, device and medium. The scheme configures a detection strategy in an application container node, performs snapshot capture processing on a memory overflow event according to the detection strategy to obtain a memory snapshot, performs application language recognition processing on the memory snapshot to obtain an application language, performs fault mode recognition processing on the memory snapshot according to the application language to obtain a fault mode, analyzes and processes a memory usage of the application container node according to the fault mode to obtain an analysis result, and performs memory tracking processing on the analysis result to obtain a fault positioning result. The application embodiment can automatically process a memory overflow fault, can quickly locate a problem root cause, and improves stability and reliability of a cloud native application.

[0132] The application embodiment can automatically locate a root cause from memory snapshot capture to the whole process without manual intervention, realizes full-automatic diagnosis, can monitor a container memory state in real time, can capture a memory snapshot immediately when a memory overflow event occurs, ensures timeliness of data, improves an automation degree, and speeds up a response speed. In addition, the application embodiment directly maps a memory problem to a code level, greatly shortens a fault diagnosis time, improves accuracy of analysis precision, can support a plurality of mainstream programming languages and container orchestration platforms, has good universality and scalability, and expands an application memory overflow fault positioning application range. The application embodiment can quickly and accurately locate a root cause when a cloud native application encounters a memory overflow fault, significantly improves stability and reliability of a system, reduces a fault processing time, and improves user experience.

[0133] The embodiments described in the application embodiment are used to more clearly illustrate the technical solutions of the application embodiment, and do not constitute a limitation on the technical solutions provided by the application embodiment. Those skilled in the art can know that, with the evolution of technology and the appearance of new application scenarios, the technical solutions provided by the application embodiment are also applicable to similar technical problems.

[0134] Those skilled in the art can understand that the technical solutions shown in the figure do not constitute a limitation on the application embodiment, can include more or fewer steps than the figure, or combine certain steps or different steps.

[0135] The system embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separated, i.e., can be located in one place, or can be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiment.

[0136] Those skilled in the art can understand that all or some steps in the method disclosed above, and the functional modules / units in the system, the device can be implemented as software, firmware, hardware and appropriate combinations thereof.

[0137] The terms "first", "second", "third", "fourth" and the like in the description of the application and in the claims of the foregoing drawings, if any, are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the use of the terms so

[0138] It should be understood that in this application, "at least one" means one or more, and "multiple" means two or more. "And / or" is used to describe the relationship between the associated objects, which means that there can be three relationships, for example, "A and / or B" can mean that only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally represents that the associated objects before and after are in an "or" relationship. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c, can mean a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0139] In several embodiments provided in the present application, it should be understood that the disclosed system and method can be implemented in other manners. For example, the system embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between different units, can be indirect couplings or communication connections through some interfaces, and electrical, mechanical or other forms.

[0140] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they can be located in one place, or can be distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0141] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0142] If the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes multiple instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program storage media.

[0143] The preferred embodiments of the present application are described above with reference to the accompanying drawings, but this does not limit the scope of the present application. Any modifications, equivalent replacements and improvements made by those skilled in the art without departing from the scope and spirit of the present application should be within the scope of the present application.

Claims

1. A method for locating memory overflow faults, characterized in that, The method includes the following steps: Configure the detection policy in the application container node; The memory overflow event is captured using the detection strategy to obtain a memory snapshot. The memory snapshot is subjected to application language recognition processing to obtain the application language; The memory snapshot is subjected to fault mode identification processing according to the application language to obtain the fault mode; The memory usage of the application container node is analyzed and processed according to the fault mode to obtain the analysis results; The analysis results are then subjected to memory tracing to obtain the fault location results.

2. The method according to claim 1, characterized in that, Configuring the detection policy in the application container node includes: The application container node is configured with control groups to obtain container resource limit parameters; The detection policy is obtained by configuring the switching partition of the application container node according to the container resource limitation parameters.

3. The method according to claim 1, characterized in that, The step of performing snapshot capture processing on the memory overflow event according to the detection strategy to obtain a memory snapshot includes: Memory usage parameters are obtained through the resource status query interface; The memory usage parameters are detected and processed according to the detection strategy to obtain the detection results; Based on the detection results, a memory overflow event is generated and processed to obtain the memory overflow event. The memory overflow event is captured using a snapshot process to obtain the memory snapshot.

4. The method according to claim 1, characterized in that, The process of performing application language recognition processing on the memory snapshot to obtain the application language includes: File feature analysis is performed on the memory snapshot to obtain file features; The memory snapshot is subjected to runtime feature analysis to obtain runtime features; The application language is determined by performing a comprehensive application language determination process on the memory snapshot based on the file characteristics and the running characteristics.

5. The method according to claim 1, characterized in that, The step of performing fault mode identification processing on the memory snapshot according to the application language to obtain the fault mode includes: The memory analysis tool is obtained by performing analysis tool matching processing based on the application language. The memory snapshot is processed by the memory analysis tool to obtain memory features; The matching pattern is obtained by performing pattern matching on the memory features according to the rule engine. Anomaly detection results are obtained by performing anomaly detection processing on the memory features based on a machine learning model. The fault mode is determined based on the matching pattern and the anomaly detection result.

6. The method according to claim 1, characterized in that, The analysis and processing of the memory usage of the application container node based on the fault mode to obtain the analysis results includes: Based on the fault mode, the application container node is subjected to object lifecycle tracking to obtain the target lifecycle; The memory usage metrics of the target lifecycle are analyzed and processed to obtain the analysis results.

7. The method according to any one of claims 1 to 6, characterized in that, The process of performing memory tracing on the analysis results to obtain fault location results includes: The analysis results are subjected to time series analysis to obtain the object path; The object path is matched according to the symbol table to obtain the parsed symbols; The parsed symbols are then processed to locate the target code. The target code is subjected to heat calculation to obtain the fault location result.

8. A memory overflow fault location system, characterized in that, The system includes: The policy configuration module is used to configure detection policies in application container nodes; The snapshot capture module is used to perform snapshot capture processing on the memory overflow event according to the detection strategy to obtain a memory snapshot; The language recognition module is used to perform application language recognition processing on the memory snapshot to obtain the application language; The fault identification module is used to perform fault mode identification processing on the memory snapshot according to the application language to obtain the fault mode; The memory analysis module is used to analyze and process the memory usage of the application container node according to the fault mode, and obtain the analysis results. The fault location module is used to perform memory tracing processing on the analysis results to obtain the fault location results.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

Images