Root cause positioning method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses a root cause positioning method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a plurality of call chain logs when a target system breaks down, analyzing each call chain log to obtain each candidate root cause node corresponding to the target system, and node attribute information of each candidate root cause node, the calling edges correspond to the candidate root cause nodes; according to the attribute information of each node, generating a node feature vector corresponding to each candidate root cause node, and performing feature extraction on the node attribute information of the called node in each calling edge to obtain an edge feature vector corresponding to each calling edge; through the pre-constructed root cause positioning model, the target root cause node corresponding to the target system is determined in the candidate root cause nodes according to the calling edges, the node feature vectors and the edge feature vectors, and the fault processing efficiency of the target system is improved.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a root cause localization method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the rapid development of the Internet, the number of business operations carried by computer distributed systems is increasing, and their security is becoming more and more important. The ability to handle system failures in a timely and accurate manner has become a key factor affecting their security.

[0003] In existing technologies, fault handling is typically performed by verifying whether each calling node corresponding to the system is abnormal, which results in low efficiency in fault handling. Summary of the Invention

[0004] This invention provides a root cause localization method, apparatus, electronic device, and storage medium, which improves the efficiency of fault handling in target systems.

[0005] In a first aspect, embodiments of the present invention provide a root cause localization method, comprising:

[0006] Obtain multiple call chain logs when the target system fails, and parse each call chain log to obtain each candidate root cause node corresponding to the target system, the node attribute information of each candidate root cause node, and the call edge corresponding to each candidate root cause node;

[0007] Based on the attribute information of each node, a node feature vector corresponding to each candidate root cause node is generated, and the node attribute information of the called node in each calling edge is extracted to obtain the edge feature vector corresponding to each calling edge.

[0008] By using a pre-built root cause localization model, the target root cause node corresponding to the target system is determined from among the candidate root cause nodes based on each calling edge, each node feature vector, and each edge feature vector.

[0009] Secondly, embodiments of the present invention also provide a root cause localization device, comprising:

[0010] The log parsing module is used to obtain multiple call chain logs when the target system fails, and parse each call chain log to obtain each candidate root cause node corresponding to the target system, the node attribute information of each candidate root cause node, and the call edge corresponding to each candidate root cause node.

[0011] The feature extraction module is used to generate node feature vectors corresponding to each candidate root cause node based on the attribute information of each node, and to extract features from the node attribute information of the called node in each calling edge to obtain the edge feature vectors corresponding to each calling edge.

[0012] The root cause localization module is used to determine the target root cause node corresponding to the target system from among the candidate root cause nodes by using a pre-built root cause localization model, based on the feature vectors of each calling edge, each node, and each edge feature vector.

[0013] Thirdly, embodiments of the present invention also provide an electronic device, the electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to execute the root cause localization method provided in any embodiment of the present invention.

[0014] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing computer instructions that are used to cause a processor to execute and implement the root cause localization method of any embodiment of the present invention.

[0015] The technical solution of this invention obtains candidate root cause nodes corresponding to the target system, node attribute information of each candidate root cause node, and call edges corresponding to each candidate root cause node; generates node feature vectors corresponding to each candidate root cause node based on the node attribute information, and extracts features from the node attribute information of the called nodes in each call edge to obtain edge feature vectors corresponding to each call edge; and determines the target root cause node corresponding to the target system among the candidate root cause nodes by using a pre-constructed root cause localization model based on each call edge, node feature vector, and edge feature vector. This avoids the low efficiency of fault handling of the target system caused by verifying whether each call node corresponding to the target system is abnormal one by one, thus improving the efficiency of fault handling of the target system.

[0016] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of a root cause localization method provided in Embodiment 1 of the present invention;

[0019] Figure 2 This is a flowchart of another root cause localization method provided in Embodiment 2 of the present invention;

[0020] Figure 3 This is a schematic diagram of the structure of a root cause localization device according to Embodiment 3 of the present invention;

[0021] Figure 4 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] Example 1

[0025] Figure 1 This is a flowchart of a root cause localization method according to Embodiment 1 of the present invention. This embodiment is applicable to the localization of the root cause node that causes the failure of the target system. The method can be executed by a root cause localization device, which can be implemented in hardware and / or software and can be configured in an electronic device such as a computer.

[0026] like Figure 1 As shown, this embodiment discloses a root cause localization method, including:

[0027] S110. Obtain multiple call chain logs when the target system fails, and parse each call chain log to obtain each candidate root cause node corresponding to the target system, the node attribute information of each candidate root cause node, and the call edge corresponding to each candidate root cause node.

[0028] In this embodiment, the target system can be understood as a distributed computer system that requires locating the root cause node leading to its failure. Each call chain log contains node attribute information for a candidate root cause node. A candidate root cause node can be understood as a node that may cause a failure in the target system. The node attribute information may include the node identifier, call chain number, parent call node identifier, service name, hostname, error reason, call duration, and timestamp of the candidate root cause node. It should be noted that when the candidate root cause node is the first node in its call chain, the parent call node identifier recorded in its corresponding call chain log is empty.

[0029] In this step, specifically, the call chain logs can be parsed to obtain the candidate root cause nodes corresponding to the target system, as well as the node attribute information of each candidate root cause node. Then, based on the node attribute information of each candidate root cause node, the call relationships between the candidate root cause nodes can be determined. Finally, based on the call relationships between the candidate root cause nodes, the call edges corresponding to each candidate root cause node can be determined. A call edge can be understood as an edge consisting of two candidate root cause nodes that have a direct call relationship.

[0030] S120. Based on the attribute information of each node, generate a node feature vector corresponding to each candidate root cause node, and extract features from the node attribute information of the called node in each calling edge to obtain the edge feature vector corresponding to each calling edge.

[0031] In this embodiment, a node feature vector can be understood as a vector used to describe the node features of a candidate root cause node. An edge feature vector can be understood as a vector used to describe the edge features of a calling edge.

[0032] In this step, specifically, based on the attribute information of each node, the node features corresponding to each candidate root cause node can be determined, and based on the node features corresponding to each candidate root cause node, a node feature vector corresponding to each candidate root cause node can be generated. The node features can include at least one of the following: the number of times the error cause occurred, the time taken to be called, and the probability of historical root causes.

[0033] Feature extraction can be performed on the node attribute information of the called node in each calling edge to obtain the edge features corresponding to each calling edge. Based on the edge features corresponding to each calling edge, an edge feature vector corresponding to each calling edge can be generated. Among them, the edge features can be the calling time and / or whether an error reason is included.

[0034] S130. Using a pre-built root cause localization model, the target root cause node corresponding to the target system is determined from among the candidate root cause nodes based on each calling edge, each node feature vector, and each edge feature vector.

[0035] In this embodiment, the root cause localization model can be a graph neural network model. The target root cause node can be understood as a candidate root cause node that leads to the failure of the target system.

[0036] In this step, specifically, a call edge vector corresponding to each call edge can be generated based on the node identifier of each candidate root cause node in each call edge. Then, using a pre-built root cause localization model, the target root cause node corresponding to the target system can be determined from each candidate root cause node based on each call edge vector, each node feature vector, and each edge feature vector.

[0037] The technical solution of this embodiment obtains multiple call chain logs when the target system fails, and parses each call chain log to obtain each candidate root cause node corresponding to the target system, the node attribute information of each candidate root cause node, and the call edge corresponding to each candidate root cause node. Based on the node attribute information, a node feature vector corresponding to each candidate root cause node is generated, and the node attribute information of the called node in each call edge is extracted to obtain the edge feature vector corresponding to each call edge. Through a pre-constructed root cause localization model, the target root cause node corresponding to the target system is determined from each candidate root cause node based on each call edge, each node feature vector, and each edge feature vector. This solves the problem that the method of verifying whether each call node corresponding to the target system is abnormal one by one is used to handle the system fault, which leads to low efficiency in handling the target system fault, and improves the efficiency of handling the target system fault.

[0038] Example 2

[0039] Figure 2 This is a flowchart of another root cause localization method provided by Embodiment 2 of the present invention. This embodiment is a further optimization and extension based on the above embodiments and can be combined with various optional technical solutions in the above embodiments.

[0040] like Figure 2 As shown, this embodiment discloses a root cause localization method, including:

[0041] S210. Obtain multiple call chain logs when the target system fails, and parse each call chain log to obtain each candidate root cause node corresponding to the target system, the node attribute information of each candidate root cause node, and the call edge corresponding to each candidate root cause node.

[0042] Optionally, after parsing the logs of each call chain to obtain the candidate root cause nodes corresponding to the target system, the node attribute information of each candidate root cause node, and the call edges corresponding to each candidate root cause node, the method further includes: generating a call relationship graph corresponding to the target system based on the candidate root cause nodes corresponding to the target system, the node attribute information of each candidate root cause node, and the call edges corresponding to each candidate root cause node.

[0043] Specifically, candidate root cause nodes can be defined based on their node type and node name. The node type can include service and host; when the node type is service, the node name of the candidate root cause node is the service name; when the node type is host, the node name of the candidate root cause node is the host name. For example, assuming that the node type of each candidate root cause node corresponding to the target system is service, and the node names of each candidate root cause node are "frontend", "cart-service", and "payment-service", then the candidate root cause nodes corresponding to the target system can be defined as "service:frontend", "service:cart-service", and "service:payment-service".

[0044] Then, based on each candidate root cause node corresponding to the target system, a node list corresponding to the target system can be generated, and based on the call edges corresponding to each candidate root cause node, an edge list corresponding to the target system can be generated. Next, based on the node list and edge list corresponding to the target system, a topology graph corresponding to the target system can be generated. Finally, based on the node attribute information of each candidate root cause node, the above topology graph can be updated to obtain the call relationship graph corresponding to the target system.

[0045] Optionally, after obtaining the call relationship graph corresponding to the target system, sensitive fields and fields to be encrypted can be identified in the node attribute information corresponding to the clicked node. Sensitive fields can be anonymized, and fields to be encrypted can be encrypted to provide security protection for sensitive and encrypted fields in the call relationship graph. The sensitive and encrypted fields can be determined according to user needs; for example, the hostname can be identified as a sensitive field, and the error reason as a field to be encrypted.

[0046] Optionally, after obtaining the call relationship graph corresponding to the target system, the call relationship graph can be scaled or dragged in response to the user's scaling or dragging operation.

[0047] Optionally, when a user adds a node to the call relationship graph, the system can retrieve the corresponding node of the same type in the call relationship graph based on the service name of the new node, and use the node characteristic information of the node of the same type as the node characteristic information of the new node. For example, assuming the service name of the new node is "payment-*", then nodes whose service names begin with "payment" can be considered as nodes of the same type as the new node, and the node characteristic information of any node of the same type can be used as the node characteristic information of the new node.

[0048] S220. Based on the node attribute information corresponding to each candidate root cause node, determine the error cause, call time, and historical root cause probability corresponding to each candidate root cause node.

[0049] In this step, specifically, the node identifier, error reason, and call duration corresponding to each candidate root cause node can be obtained from the node attribute information. Then, based on the node identifier corresponding to each candidate root cause node, the historical root cause probability corresponding to each candidate root cause node can be obtained from the root cause probability record table. The historical root cause probability can be used to reflect the root cause probability that a candidate root cause node was previously marked as.

[0050] S230. Count the number of times each error cause appears in all node attribute information to obtain the number of times each error cause appears.

[0051] In this step, specifically, when the error reason is not empty, the occurrence count of each error reason can be determined based on the number of times each error reason appears in all node attribute information. When the error reason is empty, the candidate root cause node corresponding to that error reason is considered normal, and the occurrence count of the error reason corresponding to that error reason is set to 0.

[0052] S240. Generate a node feature vector corresponding to each candidate root cause node based on the number of times the error cause occurs, the time consumed by the call, and the probability of the historical root cause corresponding to each candidate root cause node.

[0053] Taking three candidate root cause nodes corresponding to the target system as an example, assuming the number of occurrences of the error cause, the call duration, and the historical root cause probability corresponding to the first candidate root cause node are 0, 50 milliseconds, and 0.5 respectively, the node feature vector corresponding to the first candidate root cause node can be determined as [0, 50, 0.5]. Assuming the number of occurrences of the error cause, the call duration, and the historical root cause probability corresponding to the second candidate root cause node are 1, 2000 milliseconds, and 0.5 respectively, the following node feature vector can be generated: [1, 2000, 0.5]. Assuming the number of occurrences of the error cause, the call duration, and the historical root cause probability corresponding to the third candidate root cause node are 1, 3000 milliseconds, and 0.5 respectively, the following node feature vector can be generated: [1, 3000, 0.5].

[0054] S250. In the node attribute information corresponding to each called node, obtain the error reason and call time corresponding to each called node.

[0055] S260. Based on the error reason and call time corresponding to each called node, generate the edge feature vector of the calling edge corresponding to each called node.

[0056] In this step, specifically, based on whether the error reason corresponding to each called node is empty and the normalized result of the call duration, an edge feature vector corresponding to each called node is generated. In practical applications, the call duration can be normalized according to a predefined call duration threshold to obtain the normalized result of the call duration. When the error reason is empty, the feature value corresponding to the error reason in the edge feature vector is determined as a first preset value; when the error reason is not empty, the feature value corresponding to the error reason in the edge feature vector is determined as a second preset value. The first and second preset values ​​can be set according to user needs; for example, the first preset value can be set to 0 and the second preset value to 1.

[0057] For example, when the first candidate root cause node and the second candidate root cause node form the first calling edge, and the second candidate root cause node and the third candidate root cause node form the second calling edge, assuming the error cause of the called node in the first calling edge is not empty and the calling time is 2000 milliseconds, the feature value corresponding to the error cause in the edge feature vector can be determined to be 1, and the feature value corresponding to the calling time can be determined to be 0.4. Thus, the following edge feature vector can be generated: [0.4, 1]. Assuming the error cause of the called node in the second calling edge is not empty and the calling time is 3000 milliseconds, the feature value corresponding to the error cause in the edge feature vector can be determined to be 1, and the feature value corresponding to the calling time can be determined to be 0.6. Thus, the following edge feature vector can be generated: [0.6, 1].

[0058] S270. Based on the node identifier of each candidate root cause node in each call edge, generate a call edge vector corresponding to each call edge, and construct a call edge tensor based on each call edge vector.

[0059] In this step, specifically, the reference value of each candidate root cause node can be determined based on the node identifier of each candidate root cause node, and a call edge vector corresponding to each call edge can be generated based on the reference value of each candidate root cause node in each call edge.

[0060] For example, assuming that the reference values ​​of the first candidate root cause node, the second candidate root cause node, and the third candidate root cause node are 0, 1, and 2 respectively, the call edge vector with the first call edge can be determined as [0, 1], and the call edge vector with the second call edge can be determined as [1, 2]. Then, the call edge tensor can be constructed based on the call edge vectors corresponding to the first and second call edges respectively.

[0061] S280. Construct node feature tensors based on the feature vectors of each node, and construct edge feature tensors based on the feature vectors of each edge.

[0062] S290. Using a pre-built root cause localization model, the target root cause node corresponding to the target system is determined from among the candidate root cause nodes based on the calling edge tensor, node feature tensor, and edge feature tensor.

[0063] In this embodiment, the root cause localization model is a graph neural network model that includes two attention heads.

[0064] In this step, specifically, the current root cause probability of each candidate root cause node can be determined by using a pre-built root cause localization model based on the call edge tensor, node feature tensor, and edge feature tensor. Based on the current root cause probability of each candidate root cause node, the target root cause node corresponding to the target system can be determined.

[0065] Furthermore, by using a pre-built root cause localization model, the current root cause probability of each candidate root cause node is determined based on the call edge tensor, node feature tensor, and edge feature tensor. This can include: performing feature dimensionality upscaling on the call edge tensor, node feature tensor, and edge feature tensor using the code "self.conv1=GATConv(3,16,heads=2)" to obtain the feature dimensionality upscaling result; and determining the current root cause probability of each candidate root cause node based on the feature dimensionality upscaling result using the code "self.conv2=GATConv(16*2,1)".

[0066] Furthermore, determining the target root cause node corresponding to the target system based on the current root cause probability of each candidate root cause node can include: determining the candidate root cause node with the highest current root cause probability as the target root cause node, thus determining it as the target root cause node corresponding to the target system. Alternatively, determining the candidate root cause node whose current root cause probability is greater than a first probability threshold as the target root cause node corresponding to the target system. The first probability threshold can be set and adjusted according to user needs.

[0067] The advantage of this setup is that, compared to graph neural network models with only one attention head or those with more than two attention heads, the technical solution in this embodiment uses a graph neural network model with only two attention heads to perform root cause localization of the target system. This saves computational resources while learning association rules from different perspectives in parallel, thereby reducing the cost of root cause localization and improving its accuracy. Secondly, compared to existing technologies that analyze the entire call chain log, the technical solution in this embodiment determines the target root cause node corresponding to the target system based solely on the call relationships between candidate root cause nodes, as well as the error cause, the number of times the error cause occurred, the call duration, and the historical root cause probability for each candidate root cause node. This improves the efficiency of determining the target root cause node and reduces storage resource consumption during the root cause localization process.

[0068] Optionally, before determining the target root cause node corresponding to the target system from among the candidate root cause nodes using a pre-built root cause localization model based on the call edge tensor, node feature tensor, and edge feature tensor, the method further includes: obtaining multiple historical failure times corresponding to the target system, and multiple historical candidate failure nodes of the target system at each historical failure time. Then, each historical failure time can be sequentially taken as the target failure time, and the root cause label vector corresponding to each historical candidate failure node at the target failure time can be obtained by manually labeling whether each historical candidate failure node at the target failure time is a historical target root cause node. For example, assuming that the target failure time includes a first historical candidate node, a second historical candidate node, and a third historical candidate node, and the first and second historical candidate nodes are not historical target root cause nodes, while the third historical candidate node is a historical target root cause node, then the root cause label vector corresponding to each historical candidate failure node at the target failure time can be determined to be [0, 0, 1]. Here, 0 in the root cause label vector indicates that the historical candidate node is not a historical target root cause node, and 1 indicates that the historical candidate node is a historical target root cause node.

[0069] After obtaining the root cause label vectors corresponding to each historical candidate fault node at the target fault time, it can be determined whether the processing of the historical candidate fault nodes at each historical fault time is complete. If not, the process returns to execute the operation of treating each historical fault time as the target fault time in turn, until the processing of the historical candidate fault nodes at each historical fault time is complete. Based on the historical candidate fault nodes corresponding to each historical fault time, the calling relationships between the historical candidate fault nodes, and the root cause label vectors, the root cause localization model is trained.

[0070] The advantage of this setup is that by manually labeling whether each historical candidate fault node at the time of the target fault is a historical root cause node, the root cause label vector can be manually modified, thereby improving the model training efficiency.

[0071] Optionally, after determining the target root cause node corresponding to the target system among each candidate root cause node using a pre-built root cause localization model based on the call edge tensor, node feature tensor, and edge feature tensor, the method further includes: labeling the target root cause node only in the call relationship graph to show the user the target root cause node corresponding to the target system, as well as the upstream and downstream relationships of the target root cause node in the call relationship graph.

[0072] Alternatively, candidate root cause nodes with a current root cause probability greater than a first probability threshold can be marked with a first preset color; candidate root cause nodes with a current root cause probability less than or equal to the first probability threshold but greater than or equal to a second probability threshold can be marked with a second preset color; and candidate root cause nodes with a current root cause probability less than the second probability threshold can be marked with a third preset color. The first probability threshold, second probability threshold, first preset color, second preset color, and third preset color can be set according to user needs. For example, the first probability threshold and second probability threshold can be set to 0.7 and 0.3 respectively, and the first preset color, second preset color, and third preset color can be set to red, yellow, and green respectively.

[0073] Optionally, after only labeling the target root cause node, or marking candidate root cause nodes that meet different probability thresholds with three different colors, the method further includes: responding to a user's click operation on any node in the call relationship graph, obtaining the performance metric data corresponding to the clicked node; and displaying the clicked node and its corresponding performance metric data in association. The performance metric data may include Central Processing Unit (CPU) utilization, memory utilization, and request volume, etc.

[0074] Specifically, upon receiving a user's click action on any node in the call relationship graph, the system can retrieve the performance metrics data and error logs corresponding to the clicked node. Then, the clicked node, along with its corresponding performance metrics data and error logs, can be displayed in a linked manner, and the upstream and downstream paths corresponding to the clicked node can be highlighted.

[0075] Optionally, after only labeling the target root cause node, or marking candidate root cause nodes that meet different probability thresholds with three different colors, the target root cause node can be displayed in the center, showing the propagation path animation corresponding to the target root cause node, and displaying the basis for its identification as a target root cause node in a floating display, so that operations and maintenance personnel can quickly verify it. The basis for determining the target root cause node can include the response efficiency and current root cause probability of the target root cause node. Furthermore, in response to user-triggered analysis tasks based on the call relationship graph, the number of call chains involved in the analysis task can be obtained. If the number of call chains exceeds a preset threshold, such as 100, a prompt message indicating that the number of query call chains is too high can be returned to the user to avoid slowing down rendering efficiency due to an excessive number of call chains in a single query. When the number of call chains is less than or equal to the preset threshold, the user-triggered analysis task is divided into complex analysis tasks and lightweight tasks, and different error handling methods are used for them. That is, complex analysis tasks are placed in a background task queue for asynchronous processing, while the results of lightweight tasks are processed in real time.

[0076] The technical solution of this embodiment improves the efficiency of determining the target root cause node and reduces the storage resource consumption in the root cause localization process by determining the target root cause node corresponding to the target system based solely on the calling relationship between each candidate root cause node, as well as the error cause, the number of times the error cause occurs, the calling time, and the historical root cause probability of each candidate root cause node. Secondly, by parsing the logs of multiple call chains when the target system fails, we obtain the candidate root cause nodes corresponding to the target system, their node attribute information, and the call edges corresponding to each candidate root cause node. Based on the node attribute information, we generate node feature vectors corresponding to each candidate root cause node and edge feature vectors corresponding to each call edge. We construct call edge tensors corresponding to each call edge, node feature tensors corresponding to each node feature vector, and edge feature tensors corresponding to each edge feature vector. Through a pre-constructed root cause localization model, based on the call edge tensors, node feature tensors, and edge feature tensors, we determine the target root cause node corresponding to the target system among the candidate root cause nodes. This avoids the situation where it is impossible to determine which call chain to prioritize when there are multiple call chains. It can accurately locate the target root cause node corresponding to the target system, providing a foundation for timely troubleshooting of the target system.

[0077] Example 3

[0078] Figure 3 This is a schematic diagram of a root cause localization device according to Embodiment 3 of the present invention. This embodiment is applicable to the localization of the root cause node that causes the failure of the target system. The root cause localization device can be implemented in hardware and / or software and can be configured in electronic devices such as computers.

[0079] like Figure 3 As shown, the root cause localization device disclosed in this embodiment includes:

[0080] The log parsing module 31 is used to obtain multiple call chain logs when the target system fails, and parse each call chain log to obtain each candidate root cause node corresponding to the target system, the node attribute information of each candidate root cause node, and the call edge corresponding to each candidate root cause node.

[0081] The feature extraction module 32 is used to generate node feature vectors corresponding to each candidate root cause node based on the attribute information of each node, and to extract features from the node attribute information of the called node in each calling edge to obtain the edge feature vectors corresponding to each calling edge.

[0082] The root cause localization module 33 is used to determine the target root cause node corresponding to the target system from among the candidate root cause nodes by using a pre-built root cause localization model based on each calling edge, each node feature vector and each edge feature vector.

[0083] The technical solution in this embodiment, through the cooperation of the log parsing module 31, the feature extraction module 32, and the root cause localization module 33, solves the problem that the efficiency of fault handling of the target system is low due to the method of verifying whether each calling node corresponding to the target system is abnormal one by one. This improves the efficiency of fault handling of the target system.

[0084] Optionally, the feature extraction module 32 includes:

[0085] The first log information extraction unit is used to determine the error cause, call time and historical root cause probability corresponding to each candidate root cause node based on the node attribute information corresponding to each candidate root cause node.

[0086] The occurrence count unit is used to count the number of times each error reason appears in all node attribute information, and obtain the occurrence count of each error reason respectively.

[0087] The node feature vector generation unit is used to generate a node feature vector corresponding to each candidate root cause node based on the number of times the error cause occurs, the time consumed by the call, and the probability of historical root causes corresponding to each candidate root cause node.

[0088] The second log information extraction unit is used to obtain the error reason and call time corresponding to each called node from the node attribute information corresponding to each called node.

[0089] The edge feature vector generation unit is used to generate edge feature vectors corresponding to each called node based on the error reason and call time corresponding to each called node.

[0090] Optionally, the root cause localization module 33 is specifically used to: generate a call edge vector corresponding to each call edge based on the node identifier of each candidate root cause node in each call edge, and construct a call edge tensor based on each call edge vector; construct a node feature tensor based on each node feature vector, and construct an edge feature tensor based on each edge feature vector; and determine the target root cause node corresponding to the target system among each candidate root cause node through the pre-constructed root cause localization model, based on the call edge tensor, node feature tensor, and edge feature tensor.

[0091] Optionally, the root cause localization model is a graph neural network model that includes two attention heads.

[0092] Optionally, the device further includes a relationship graph generation module, which is used to generate a call relationship graph corresponding to the target system based on each candidate root cause node corresponding to the target system, the node attribute information of each candidate root cause node, and the call edges corresponding to each candidate root cause node.

[0093] Optionally, the device also includes a root cause node labeling module, which is used to label the target root cause node in the call relationship graph to show the user the target root cause node corresponding to the target system, as well as the upstream and downstream relationships of the target root cause node in the call relationship graph.

[0094] Optionally, the device also includes a performance indicator display module, which is used to: in response to a user's click operation on any node in the call relationship graph, obtain the performance indicator data corresponding to the clicked node; and display the clicked node and the performance indicator data corresponding to the clicked node in association.

[0095] The root cause localization device provided in this embodiment of the invention can execute the root cause localization method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method execution. Content not described in detail in this embodiment can be referred to the description in any method embodiment of this application.

[0096] Example 4

[0097] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement embodiments of the present invention is shown. For example... Figure 4As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0098] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0099] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as root cause localization methods.

[0100] In some embodiments, the root cause localization method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or mounted on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the root cause localization method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the root cause localization method by any other suitable means (e.g., by means of firmware).

[0101] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0102] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0103] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0104] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0105] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0106] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0107] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0108] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A root cause localization method, characterized in that, The method comprises: obtaining a plurality of call chain logs when a target system fails, and parsing each of the call chain logs to obtain each candidate root cause node corresponding to the target system, node attribute information of each candidate root cause node, and a call edge corresponding to each candidate root cause node; generating a node feature vector corresponding to each candidate root cause node according to the node attribute information of each candidate root cause node, and performing feature extraction on the node attribute information of a called node in each call edge to obtain an edge feature vector corresponding to each call edge; determining a target root cause node corresponding to the target system from the candidate root cause nodes by using a pre-constructed root cause positioning model according to the call edges, the node feature vectors, and the edge feature vectors.

2. The method of claim 1, wherein, According to the node attribute information of each candidate root cause node, a node feature vector corresponding to each candidate root cause node is generated, comprising: determining an error cause, a called time consumption, and a historical root cause probability corresponding to each candidate root cause node according to the node attribute information corresponding to each candidate root cause node; counting the number of occurrences of each error cause in all node attribute information to obtain an error cause occurrence number corresponding to each error cause; generating a node feature vector corresponding to each candidate root cause node according to the error cause occurrence number, the called time consumption, and the historical root cause probability corresponding to each candidate root cause node.

3. The method of claim 1, wherein, The node attribute information of the called node in each call edge is subjected to feature extraction to obtain an edge feature vector corresponding to each call edge, comprising: obtaining an error cause and a called time consumption corresponding to each called node in the node attribute information corresponding to each called node; generating an edge feature vector of a call edge corresponding to each called node according to the error cause and the called time consumption corresponding to each called node.

4. The method of claim 1, wherein, According to the call edges, the node feature vectors, and the edge feature vectors, a target root cause node corresponding to the target system is determined from the candidate root cause nodes by using a pre-constructed root cause positioning model, comprising: generating a call edge vector corresponding to each call edge according to the node identifier of each candidate root cause node in each call edge, and constructing a call edge tensor based on the call edge vectors; constructing a node feature tensor based on the node feature vectors, and constructing an edge feature tensor based on the edge feature vectors; determining a target root cause node corresponding to the target system from the candidate root cause nodes by using the pre-constructed root cause positioning model according to the call edge tensor, the node feature tensor, and the edge feature tensor.

5. The method of claim 4, wherein, The root cause positioning model is a graph neural network model comprising two attention heads.

6. The method of claim 4, wherein, After parsing each of the call chain logs to obtain each candidate root cause node corresponding to the target system, node attribute information of each candidate root cause node, and a call edge corresponding to each candidate root cause node, the method further comprises: generate a call relationship graph corresponding to the target system according to each candidate root cause node corresponding to the target system, node attribute information of each candidate root cause node, and a call edge corresponding to each candidate root cause node; determine a target root cause node corresponding to the target system from the candidate root cause nodes according to the call edge tensor, the node feature tensor, and the edge feature tensor through a pre-constructed root cause positioning model; and label the target root cause node in the call relationship graph to show the target root cause node corresponding to the target system and an upstream-downstream relationship of the target root cause node in the call relationship graph to a user.

7. The method of claim 6, wherein, After labeling the target root cause node in the call relationship graph, the method further includes: in response to a click operation of a user on any node in the call relationship graph, obtaining performance index data corresponding to the clicked node; correlating and displaying the clicked node and the performance index data corresponding to the clicked node.

8. A root cause localization apparatus, characterized by, The apparatus includes: a log analysis module configured to obtain a plurality of call chain logs when a target system fails, and analyze each call chain log to obtain each candidate root cause node corresponding to the target system, node attribute information of each candidate root cause node, and a call edge corresponding to each candidate root cause node; a feature extraction module configured to generate a node feature vector corresponding to each candidate root cause node according to each node attribute information, and extract features of node attribute information of a called node in each call edge to obtain an edge feature vector corresponding to each call edge; a root cause positioning module configured to determine a target root cause node corresponding to the target system from the candidate root cause nodes according to each call edge, each node feature vector, and each edge feature vector through a pre-constructed root cause positioning model.

9. An electronic device, comprising: The electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the root cause positioning method in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for enabling a processor to implement the root cause positioning method in any one of claims 1-7 when executed by the processor.

Images