Fault analysis method and electronic device

Abstract

The disclosure provides a fault analysis method and an electronic device, and relates to the technical field of communication. The method comprises the following steps: generating a rule library according to historical fault information corresponding to the system type of a target system kernel; in the case that a BMC detects a kernel crash state, reading data from a log source in a streaming manner and storing the data to a circular buffer; obtaining a first log line from the circular buffer according to the reading order of at least one log line and obtaining a preset key information set; in the case that the first log line includes any key information in the preset key information set, obtaining a second rule mode corresponding to the key information of the first log line; according to the key information of the first log line, traversing a first rule group corresponding to the second rule mode in the rule library to obtain a target rule corresponding to the first log line; and according to the target rule, obtaining a fault analysis result corresponding to the fault of the target system kernel. The fault analysis efficiency and accuracy can be improved.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to a fault analysis method and an electronic device. Background Technology

[0002] With the development of science and technology, the efficiency and accuracy of fault analysis have become central concerns. Kernel crashes are system protection actions triggered by the Linux kernel when it detects fatal errors (such as null pointer dereferences, memory check failures, etc.) and cannot handle them safely. Capturing a memory image (vmcore) at the time of a system crash and saving it to disk, followed by manual inspection and analysis using specialized tools, suffers from low efficiency and accuracy due to the large amount of data involved. Summary of the Invention

[0003] This disclosure provides a fault analysis method and electronic device. Its main purpose is to address the problem of improving the efficiency and accuracy of fault analysis when the Linux kernel crashes.

[0004] According to a first aspect of this disclosure, a fault analysis method is provided, comprising:

[0005] Based on the historical fault information corresponding to the system type of the target system kernel, obtain the rule identifier, first rule mode, fault information set and fault handling method corresponding to the historical fault information;

[0006] Based on the rule identifier, the rule pattern, the fault information set, and the fault handling method, generate a rule corresponding to the historical fault information, and add the rule to the rule group corresponding to the first rule pattern in the rule base;

[0007] If the Baseboard Management Controller (BMC) detects a kernel crash, it streams data from a log source and stores the data in a circular buffer. The data includes at least one log line, and the kernel crash status indicates that the target system kernel has failed.

[0008] According to the reading order of the at least one log line, the first log line is obtained from the circular buffer, and a preset set of key information is obtained;

[0009] If the first log line includes any key information from the preset key information set, obtain the second rule pattern corresponding to the key information of the first log line, and obtain the first rule group corresponding to the second rule pattern in the rule base, wherein the rule base includes at least one rule;

[0010] Based on the key information of the first log line, the first rule group is traversed to obtain the target rule corresponding to the first log line;

[0011] Based on the target rules, obtain the fault analysis results corresponding to the kernel fault of the target system.

[0012] According to a second aspect of this disclosure, a fault analysis apparatus is provided, comprising:

[0013] The information acquisition unit is used to acquire, based on the historical fault information corresponding to the system type of the target system kernel, the rule identifier, the first rule mode, the fault information set and the fault handling method corresponding to the historical fault information;

[0014] The rule acquisition unit is used to generate a rule corresponding to the historical fault information based on the rule identifier, the rule pattern, the fault information set and the fault handling method, and add the rule to the rule group corresponding to the first rule pattern in the rule base;

[0015] The data reading unit is used to stream data from a log source and store the data in a circular buffer when the Baseboard Management Controller (BMC) detects a kernel crash state. The data includes at least one log line, and the kernel crash state is used to indicate that the target system kernel has failed.

[0016] The information acquisition unit is further configured to acquire the first log line from the circular buffer according to the reading order of the at least one log line, and acquire a preset set of key information;

[0017] The rule acquisition unit is further configured to acquire a second rule pattern corresponding to the key information of the first log line when the first log line includes any key information in the preset key information set, and acquire a first rule group corresponding to the second rule pattern in the rule base, wherein the rule base includes at least one rule;

[0018] The rule acquisition unit is further configured to traverse the first rule group based on the key information of the first log line to obtain the target rule corresponding to the first log line;

[0019] The fault analysis unit is used to obtain the fault analysis results corresponding to the kernel fault of the target system according to the target rules.

[0020] According to a third aspect of this disclosure, an electronic device is provided, comprising:

[0021] At least one processor; and

[0022] A memory communicatively connected to the at least one processor; wherein,

[0023] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method described in the first aspect above.

[0024] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are configured to cause the computer to perform the method described in the first aspect above.

[0025] According to a fifth aspect of this disclosure, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method described in the first aspect above.

[0026] Through this disclosure, based on historical fault information corresponding to the system type of the target system kernel, a rule identifier, a first rule pattern, a fault information set, and a fault handling method corresponding to the historical fault information are obtained; based on the rule identifier, the rule pattern, the fault information set, and the fault handling method, a rule corresponding to the historical fault information is generated, and the rule is added to the rule group corresponding to the first rule pattern in the rule base; when the baseboard management controller detects a kernel crash state, data is streamed from the log source and stored in a circular buffer, wherein the data includes at least one log line, and the kernel crash state is used to indicate the target... A system kernel failure occurs; following the reading order of the at least one log line, a first log line is retrieved from the circular buffer, and a preset key information set is obtained; if the first log line includes any key information from the preset key information set, a second rule pattern corresponding to the key information of the first log line is obtained, and a first rule group corresponding to the second rule pattern is obtained from the rule base, wherein the rule base includes at least one rule; based on the key information of the first log line, the first rule group is traversed to obtain the target rule corresponding to the first log line; based on the target rule, the fault analysis result corresponding to the target system kernel failure is obtained. Therefore, key information filtering and rule group filtering can be performed on the data corresponding to the kernel crash state. This two-layer filtering reduces the amount of data that needs to be analyzed, eliminating the need to analyze all data and reducing the need for full rule set regular expression matching for every log line. This reduces the amount of data analysis and allows matching through the preset rule base in BMC. Rule groups can be obtained based on rule patterns for rule traversal, eliminating the need to traverse the entire rule base and requiring no manual intervention. This reduces the analysis time and accuracy of manual analysis. The fault analysis process can be completed by BMC with minimal CPU and memory resources, improving both the efficiency and accuracy of fault analysis.

[0027] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0028] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0029] Figure 1 This is a schematic diagram illustrating an example of a fault analysis method provided in an embodiment of this disclosure;

[0030] Figure 2This is a schematic diagram illustrating another fault analysis method provided in an embodiment of this disclosure;

[0031] Figure 3 This is an example schematic diagram illustrating another fault analysis method provided in an embodiment of the present disclosure;

[0032] Figure 4 This is a schematic diagram of the structure of a fault analysis device provided in an embodiment of this disclosure. Detailed Implementation

[0033] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0034] The fault analysis method and electronic device of this disclosure are described below with reference to the accompanying drawings.

[0035] Figure 1 This is a flowchart illustrating a fault analysis method provided in an embodiment of this disclosure. Figure 1 As shown, the method includes the following steps:

[0036] Step 101: Based on the historical fault information corresponding to the system type of the target system kernel, obtain the rule identifier, first rule mode, fault information set and fault handling method corresponding to the historical fault information;

[0037] According to some embodiments, the implementing entity of this disclosure may be, for example, an electronic device. The name of the electronic device is not limited. For example, the electronic device may also be called a computer device, a terminal device, etc. The electronic device does not specifically refer to a particular fixed device. For example, when the structure of the electronic device changes, the electronic device may also change accordingly. For example, when the device identifier of the electronic device changes, the electronic device may also change accordingly. The electronic device may, for example, be a baseboard management controller.

[0038] In some embodiments, the electronic device may be, for example, a smart network card with a BMC board, which can cross-compile the implementation program to form a new image and flash it onto the BMC card. After the flash is complete, log in to the BMC system, manually trigger a kernl panic on the operating system (OS) side, and view the BMC system event log (SEL) and related alarm logs.

[0039] According to some embodiments, the historical fault information corresponding to the system type may be information generated when a fault occurred before the rule base was established or updated. This historical fault information does not specifically refer to any particular fault. For example, when the time point of generation of the historical fault information changes, the historical fault information may also change accordingly.

[0040] According to some embodiments, the rule identifier corresponding to historical fault information can be, for example, an identifier used to uniquely identify the rule corresponding to the historical fault information. This rule identifier does not specifically refer to a fixed identifier. For example, when the composition of the rule identifier changes, the rule identifier can also change accordingly. For example, when a modification instruction corresponding to the rule identifier is received, the rule identifier can also change accordingly.

[0041] According to some embodiments, the first rule pattern may be, for example, a rule pattern corresponding to historical fault information. Specifically, it may be a rule pattern corresponding to key information in the historical fault information. This first rule pattern does not specifically refer to a fixed pattern. For example, when the historical fault information changes, the first rule pattern may also change accordingly.

[0042] According to some embodiments, the fault information set may be, for example, a set used to describe the historical fault information. This fault information set may include, for example, fault cause, fault level, fault type, etc. The fault information set does not specifically refer to a fixed set. For example, when the number or content of information corresponding to the fault information set changes, the fault information set may also change accordingly.

[0043] According to some embodiments, the fault handling method may be, for example, a method used to handle the fault when historical fault information is obtained. This fault handling method does not specifically refer to a particular fixed method.

[0044] In some embodiments, the rule identifier, first rule mode, fault information set and fault handling method corresponding to the historical fault information can be obtained based on the historical fault information corresponding to the system type of the target system kernel.

[0045] Step 102: Generate rules corresponding to historical fault information based on rule identifier, rule mode, fault information set and fault handling method, and add the rules to the rule group corresponding to the first rule mode in the rule base;

[0046] According to some embodiments, the rule base may be a collection of at least one rule. This rule base may also be referred to as a rule set. The rule base does not specifically refer to a fixed set. For example, when the number of rules in the rule base changes, the rule base may also change accordingly. For example, when a rule in the rule base changes, the rule base may also change accordingly. Each rule in at least one rule is generated based on historical fault information of the target system kernel. This key information may also be referred to as a keyword, key phrase, or key word. This disclosure does not limit this aspect.

[0047] According to some embodiments, this rule base may also be called a signature base, which may be a structured, manageable set of rules. For example, it may be compiled and pre-configured (initialized) during the BMC firmware image generation stage and updated through the BMC firmware upgrade mechanism. A data structure for a signature rule can be defined, as shown in Table 1, for example.

[0048] Table 1

[0049]

[0050] In some embodiments, rules corresponding to historical fault information can be generated based on rule identifiers, rule patterns, fault information sets, and fault handling methods, and the rules can be added to the rule group corresponding to the first rule pattern in the rule base.

[0051] Step 103: When the baseboard management controller detects a kernel crash state, it reads data from the log source in a streaming manner and stores the data in a circular buffer. The data includes at least one log line, and the kernel crash state is used to indicate that the target system kernel has failed.

[0052] According to some embodiments, the Baseboard Management Controller (BMC) can be a controller with management functions built into the server motherboard. This BMC function may include, for example, local and remote diagnostics, console support, configuration management, hardware management, and troubleshooting. During server management, the usage of fans, memory, hard drives, and other critical components can be monitored. Monitoring critical server information is crucial for monitoring and analyzing the overall server operating status; this critical information may include: critical voltage information, critical temperature information, and power consumption information. Monitoring this critical information provides an analytical basis and data support for server maintenance and troubleshooting. Abnormal information can be reported to a remote operation and maintenance platform in the form of alarms. The BMC can record host system startup and operation logs through a Universal Asynchronous Receiver / Transmitter (UART) interface, thereby monitoring the system's operating status.

[0053] In some embodiments, the BMC does not specifically refer to a particular fixed controller. For example, the BMC may change accordingly when the BMC identifier changes.

[0054] In some implementations, a kernel panic is a protection mechanism employed by the Linux operating system when it encounters a critical, unrecoverable error, designed to prevent further system damage or data leakage. Specifically, it's a system protection action triggered by the Linux kernel when it detects a fatal error (such as a null pointer dereference or memory check failure) and cannot safely handle it. At this point, the system halts all operations, outputs an error log via serial port or screen, and may automatically reboot.

[0055] According to some embodiments, a circular buffer can be, for example, a region used for data buffering during data reading. This circular buffer is not specifically defined as a fixed circular buffer. For example, the circular buffer may change accordingly when the size of the region it corresponds to changes. The name of the circular buffer is not limited. For example, it may also be called a serial port buffer.

[0056] In some embodiments, the data includes at least one log line, wherein the number of log lines can be determined, for example, based on the size of the circular buffer.

[0057] In some embodiments, a kernel crash status is used to indicate a fault in the target system kernel or a fatal fault in the target system kernel. The specific type of fault is not limited.

[0058] In some embodiments, when the baseboard management controller detects a kernel crash state, data is streamed from a log source and stored in a circular buffer, wherein the data includes at least one log line, and the kernel crash state is used to indicate that the target system kernel has failed.

[0059] Step 104: Obtain the first log line from the circular buffer according to the reading order of at least one log line, and obtain the preset key information set;

[0060] According to some embodiments, the reading order may be, for example, the reading order of each log line in the circular buffer. For example, it may be read in a first-in, first-out (FIFO) order. The first log line may be, for example, the log line read first. The first log line does not specifically refer to a fixed log line. For example, when the log information corresponding to the first log line changes, the first log line may also change accordingly. For example, when the reading time point corresponding to the first log line changes, the first log line may also change accordingly.

[0061] According to some embodiments, the preset key information set may be a collection of at least one key information set. This preset key information set does not specifically refer to a fixed set. Each key piece of information in the preset key information set may be determined, for example, based on the rule patterns of rules in a rule base. This preset key information set does not specifically refer to a fixed set. For example, when historical fault information changes, the preset key information set may also change accordingly. For example, when a specific key piece of information in the preset key information set changes, the preset key information set may also change accordingly.

[0062] In some embodiments, the first log line can be retrieved from the circular buffer in the order of reading at least one log line, and a preset set of key information can be obtained.

[0063] Step 105: Obtain the second rule pattern corresponding to the key information of the first log line, and obtain the first rule group corresponding to the second rule pattern in the rule base, wherein the rule base includes at least one rule;

[0064] The second rule pattern refers to the second rule pattern corresponding to the key information. The second rule pattern does not refer to a specific fixed pattern. For example, if the specific pattern corresponding to the second rule pattern changes, the second rule pattern can also change accordingly.

[0065] In some embodiments, the first rule group may be, for example, a rule group in a rule base corresponding to the key information. This first rule group does not specifically refer to a fixed rule group. For example, when the key information changes, the first rule group may also change accordingly. For example, when the method of obtaining the rule group changes, the first rule group may also change accordingly.

[0066] In some embodiments, when the first log line includes any key information from a preset set of key information, a first rule group corresponding to the key information of the first log line is obtained from the rule base. The rule base includes at least one rule, and each rule in the at least one rule is generated based on the historical fault information of the target system kernel.

[0067] Step 106: Based on the key information of the first log line, traverse the first rule group to obtain the target rule corresponding to the first log line;

[0068] In some embodiments, the target rule may be, for example, the rule corresponding to the first log line in the first rule group. This target rule does not specifically refer to a single fixed rule. For example, when the content of the rule corresponding to the target rule changes, the target rule may also change accordingly. For example, when the method of obtaining the target rule changes, the target rule may also change accordingly.

[0069] According to some embodiments, the target rule corresponding to the first log line is obtained by traversing the first rule group based on the key information of the first log line.

[0070] Step 107: Based on the target rules, obtain the fault analysis results corresponding to the kernel fault of the target system.

[0071] According to some embodiments, the fault analysis result may be the result of analyzing a kernel fault in a target system. This fault analysis result may include, for example, the cause of the fault, the faulty component, and subsequent fault handling measures. The fault analysis result is not specific to any particular fixed result. For example, when the method of obtaining the fault analysis result changes, the fault analysis result may also change accordingly.

[0072] In some embodiments, fault analysis results corresponding to kernel faults in the target system are obtained according to target rules.

[0073] This disclosure involves obtaining, based on historical fault information corresponding to the system type of the target system kernel, a rule identifier, a first rule pattern, a fault information set, and a fault handling method corresponding to the historical fault information; generating rules corresponding to the historical fault information based on the rule identifier, rule pattern, fault information set, and fault handling method, and adding the rules to the rule group corresponding to the first rule pattern in the rule base; when the baseboard management controller detects a kernel crash state, reading data from the log source in a streaming manner and storing the data in a circular buffer, wherein the data includes at least one log line, and the kernel crash state is used to indicate that the target system kernel has failed; obtaining a first log line from the circular buffer according to the reading order of at least one log line, and obtaining a preset key information set; if the first log line includes any key information in the preset key information set, obtaining a second rule pattern corresponding to the key information of the first log line, and obtaining a first rule group corresponding to the second rule pattern in the rule base, wherein the rule base includes at least one rule; traversing the first rule group based on the key information of the first log line to obtain the target rule corresponding to the first log line; and obtaining the fault analysis result corresponding to the target system kernel failure based on the target rule. Therefore, key information filtering and rule group filtering can be performed on the data corresponding to the kernel crash state. This two-layer filtering reduces the amount of data that needs to be analyzed, eliminating the need to analyze all data and reducing the need for full rule set regular expression matching for every log line, thus reducing the amount of data analysis. Furthermore, matching can be performed using a pre-set rule base in the BMC, and rule groups can be obtained based on rule patterns for rule traversal, eliminating the need to traverse the entire rule base and requiring no manual intervention. This reduces the analysis time and accuracy associated with manual analysis. The fault analysis process requires only minimal CPU and memory resources from the BMC, improving both efficiency and accuracy. Therefore, the embodiments disclosed herein provide a reliable and stable kernel panic fault analysis and reporting monitoring solution, improving operational efficiency and reducing resource consumption and manpower investment. Additionally, since a rule base is pre-set, no compilation process is required during fault analysis, reducing compilation time and improving efficiency. Then, only the first key lines in the buffer can be scanned, reducing memory usage and CPU cycles.

[0074] Furthermore, in one possible implementation of this embodiment, Figure 2 This is a flowchart illustrating another fault analysis method provided in an embodiment of this disclosure. Figure 2 As shown, the method includes the following steps:

[0075] Step 201: Based on the historical fault information corresponding to the system type of the target system kernel, obtain the rule identifier, first rule mode, fault information set and fault handling method corresponding to the historical fault information;

[0076] The specific process can be as described above, and will not be repeated here.

[0077] Step 202: Generate rules corresponding to historical fault information based on rule identifier, rule mode, fault information set and fault handling method, and add the rules to the rule group corresponding to the first rule mode in the rule base;

[0078] The specific process can be as described above, and will not be repeated here.

[0079] Step 203: When the baseboard management controller detects a kernel crash state, it reads data from the log source in a streaming manner and stores the data in a circular buffer. The data includes at least one log line, and the kernel crash state is used to indicate that the target system kernel has failed.

[0080] The specific process can be as described above, and will not be repeated here.

[0081] According to some embodiments, Figure 3 This is an example schematic diagram illustrating another fault analysis method provided in an embodiment of this disclosure. For example... Figure 3 As shown, the BMC streams Panic output data from the log source. The algorithm in this embodiment does not wait for all log output to finish before processing; instead, it immediately begins streaming data from the serial port buffer to avoid memory overflow. The data is stored in a circular buffer. The buffer size is set to 4 kilobytes (KB), sufficient to hold the initial critical portion of the Panic information, preventing exhaustion of the BMC's limited memory. This buffer is designed for overwrite writing, retaining only the latest data to ensure stable operation in resource-constrained environments. The 4kB buffer size can be adjusted according to actual needs.

[0082] Step 204: Obtain the first log line from the circular buffer according to the reading order of at least one log line, and obtain the preset key information set;

[0083] The specific process can be as described above, and will not be repeated here.

[0084] According to some embodiments, keywords appearing in all rule patterns can be obtained in advance, such as "BUG", "ERROR", "kernel crash", "CPU", "I / O input / output", etc.

[0085] According to some embodiments, if the key information corresponding to the first log line is not obtained, or if the key information of the first log line does not meet the key information requirements of the first log line, a second log line is obtained, and a fault analysis operation for the target system kernel fault is performed based on the second log line.

[0086] Step 205: If the first log line includes any key information from the preset key information set, obtain the second rule pattern corresponding to the key information of the first log line, and obtain the first rule group corresponding to the second rule pattern in the rule base, wherein the rule base includes at least one rule.

[0087] The specific process can be as described above, and will not be repeated here.

[0088] According to some embodiments, detection based on key information can be a first-level filter, filtering log lines to improve fault analysis efficiency. For each line of log data read in, it is first checked whether it contains any of these keywords. If not, the line is skipped and the process moves to the next line. This can quickly filter out more than 90% of irrelevant information lines.

[0089] According to some embodiments, the fault information set includes faulty components, and the method further includes:

[0090] Based on the first rule pattern and components, the rule base is grouped, and at least one rule group corresponding to the rule base is obtained. Therefore, the efficiency of rule retrieval can be improved, the need to compare all rules in the rule base can be reduced, and the accuracy of rule retrieval can be improved.

[0091] According to some embodiments, based on the key information of the first log line, the first rule group is traversed to obtain the target rule corresponding to the first log line, including:

[0092] Based on the key information in the first log line, obtain the rule matching pattern corresponding to the first log line;

[0093] By employing a rule-matching pattern, the system iterates through the first rule group to retrieve the target rule corresponding to the first log line. Therefore, rule matching can be performed using a rule-matching pattern that matches key information, improving both the efficiency and accuracy of rule matching.

[0094] Step 206: If the second rule pattern corresponding to the key information of the first log line is a string matching rule, use a string search function to traverse the first rule group to obtain the target rule corresponding to the first log line.

[0095] The specific process can be as described above, and will not be repeated here.

[0096] According to some embodiments, the rules in this disclosure are not traversed sequentially. The rule base is grouped during initialization based on pattern type (pattern_type) and component (e.g., all plain string rules in one group, and all storage-related regular expressions in another). The rule group most likely to match can be selected for traversal based on the keywords contained in the current line. For example, if a line contains "kernel driver name (SCSI disk, sd)" and "error", the rules in the storage component group are traversed first, followed by the general rule group.

[0097] In some embodiments, string matching may be performed, for example, using an efficient string lookup function (such as the string lookup function strstr) for rules marked as pattern_type=0.

[0098] Step 207: If the second rule pattern corresponding to the key information of the first log line is a regular expression matching rule, a preset regular expression object is used to traverse the first rule group to obtain the target rule corresponding to the first log line.

[0099] The specific process can be as described above, and will not be repeated here.

[0100] According to some embodiments, the method further includes:

[0101] If the target rule corresponding to the first log line is not found in the first rule group, the process iterates through the second rule group, which is a rule group in the rule base other than the first rule group; or,

[0102] If the target rule corresponding to the first log line is not obtained in the first rule group, the second log line is obtained in the order of reading at least one log line, and the fault analysis operation of the target system kernel fault is performed based on the second log line, wherein the second log line is the next line after the first log line.

[0103] According to some embodiments, the method further includes:

[0104] If the key information corresponding to the first log line is not obtained, or if the key information of the first log line does not meet the requirements of the first log line, the second log line is obtained, and the fault analysis operation of the target system kernel fault is performed based on the second log line.

[0105] According to some embodiments, regular expression matching can be performed, for example, on rules marked as pattern_type=1, using a pre-compiled regular expression object (regexec), avoiding the overhead of runtime compilation.

[0106] Once a rule is matched, the current loop is immediately terminated and a result is generated. If the current rule group does not match, the loop continues or returns to read the next line. Continuing to iterate could, for example, involve retrieving a second rule group from the rule base and then continuing the fault analysis process.

[0107] Step 207: Based on the target rules, obtain the fault analysis results corresponding to the kernel fault of the target system.

[0108] The specific process can be as described above, and will not be repeated here.

[0109] According to some embodiments, based on target rules, the fault analysis results corresponding to the kernel fault of the target system are obtained, including:

[0110] Based on the target rule, obtain the rule identifier, fault cause, fault component, and fault handling measures corresponding to the target rule;

[0111] Based on the rule identifier, fault cause, fault component, and fault handling measures, generate structured diagnostic events corresponding to the kernel fault of the target system.

[0112] According to some embodiments, the method further includes:

[0113] Structured diagnostic events are written to the system event log of the baseboard management controller with high priority, and prompts corresponding to the structured diagnostic events are issued. The prompts include at least one of alarm push information and display information on the baseboard management controller display interface.

[0114] According to some embodiments, the method further includes:

[0115] Based on the target rules, obtain at least one of the fault diagnosis operation and fault recovery operation corresponding to the fault analysis results.

[0116] In some implementations, for example, after a rule match is successful, instead of outputting the original logs, a highly refined structured diagnostic event can be generated. This event directly includes the rule identifier ID, possible cause, responsible component, and fault handling measures.

[0117] In some implementations, this event can also be written to the BMC's System Event Log (SEL) with high priority, and can be remotely pushed as an alarm via the Intelligent Platform Management Interface (IPMI), Redfish, or SNMP trap (SnmpTrap), or presented directly to the administrator through the BMC Web interface.

[0118] In some implementations, subsequent diagnostic actions can be automatically triggered based on the matched rule type. Specifically, if it is a memory error, the memory controller register state is automatically dumped.

[0119] For example, if a kernel panic event is detected in an "urgent" state, the generated structured diagnostic event may include:

[0120] Time: 2025-09-01 08:00:01;

[0121] Abstract; Dereferencing a null pointer (NULL);

[0122] Suspected component: Kernel module (possibly the I2C driver `slave_queue`);

[0123] Possible cause: The driver attempted to access an invalid memory address;

[0124] Recommended measures: 1. Try upgrading the I2C driver version. 2. Collect complete call stack information for further analysis;

[0125] Matching rule ID: 105.

[0126] According to some implementations, the fault analysis process can be terminated when the log stream stops outputting, the host restarts, or the host times out.

[0127] In one or related embodiments, when the second rule pattern corresponding to the key information of the first log line is a string matching rule, a string search function is used to traverse the first rule group to obtain the target rule corresponding to the first log line; when the second rule pattern corresponding to the key information of the first log line is a regular expression matching rule, a preset regular expression object is used to traverse the first rule group to obtain the target rule corresponding to the first log line. Therefore, the rule base can be grouped, which can reduce the number of rules that need to be traversed, improve rule matching efficiency, and output machine-readable diagnostic conclusions, greatly improving operation and maintenance efficiency and saving manpower costs.

[0128] According to embodiments of this disclosure, this disclosure also provides a fault analysis apparatus.

[0129] For example, Figure 4 This is a schematic diagram of the structure of a fault analysis device provided in an embodiment of the present disclosure. The fault analysis device 400 includes: an information acquisition unit 401, a rule acquisition unit 402, a data reading unit 403, and a fault analysis unit 404; wherein,

[0130] The information acquisition unit 401 is used to acquire the rule identifier, first rule mode, fault information set and fault handling method corresponding to the historical fault information based on the historical fault information corresponding to the system type of the target system kernel.

[0131] The rule acquisition unit 402 is used to generate rules corresponding to historical fault information based on rule identifier, rule mode, fault information set and fault handling method, and add the rules to the rule group corresponding to the first rule mode in the rule base;

[0132] The data reading unit 403 is used to stream data from the log source and store the data in a circular buffer when the Baseboard Management Controller (BMC) detects a kernel crash state. The data includes at least one log line, and the kernel crash state is used to indicate that the target system kernel has failed.

[0133] The information acquisition unit 401 is also used to acquire the first log line from the circular buffer according to the reading order of at least one log line, and acquire a preset set of key information;

[0134] The rule acquisition unit 402 is further configured to, when the first log line includes any key information in the preset key information set, acquire the second rule pattern corresponding to the key information of the first log line, and acquire the first rule group corresponding to the second rule pattern in the rule base, wherein the rule base includes at least one rule;

[0135] The rule acquisition unit 402 is also used to traverse the first rule group based on the key information of the first log line to obtain the target rule corresponding to the first log line.

[0136] The fault analysis unit 404 is used to obtain the fault analysis results corresponding to the kernel fault of the target system according to the target rules.

[0137] Furthermore, the information acquisition unit 401 is also used for:

[0138] If the target rule corresponding to the first log line is not found in the first rule group, the process iterates through the second rule group, which is a rule group in the rule base other than the first rule group; or,

[0139] If the target rule corresponding to the first log line is not obtained in the first rule group, the second log line is obtained in the order of reading at least one log line, and the fault analysis operation of the target system kernel fault is performed based on the second log line, wherein the second log line is the next line after the first log line.

[0140] Furthermore, the information acquisition unit 401 is also used for:

[0141] If the key information corresponding to the first log line is not obtained, or if the key information of the first log line does not meet the requirements of the first log line, the second log line is obtained, and the fault analysis operation of the target system kernel fault is performed based on the second log line.

[0142] The fault information set includes faulty components, and the method also includes:

[0143] Based on the first rule pattern and components, the rule base is grouped to obtain at least one rule group corresponding to the rule base.

[0144] Furthermore, the rule acquisition unit 402, when traversing the first rule group based on the key information of the first log line to obtain the target rule corresponding to the first log line, specifically performs the following:

[0145] Based on the key information in the first log line, obtain the rule matching pattern corresponding to the first log line;

[0146] Using a rule matching mode, the system iterates through the first rule group to obtain the target rule corresponding to the first log line.

[0147] Furthermore, the rule acquisition unit 402, when using the rule matching mode to traverse the first rule group and acquire the target rule corresponding to the first log line, is specifically used for:

[0148] If the second rule pattern corresponding to the key information in the first log line is a string matching rule, then a string search function is used to traverse the first rule group to obtain the target rule corresponding to the first log line; or...

[0149] If the second rule pattern corresponding to the key information of the first log line is a regular expression matching rule, a preset regular expression object is used to traverse the first rule group to obtain the target rule corresponding to the first log line.

[0150] Furthermore, the fault analysis unit 404, when obtaining the fault analysis results corresponding to the kernel fault of the target system according to the target rules, is specifically used for:

[0151] Based on the target rule, obtain the rule identifier, fault cause, fault component, and fault handling measures corresponding to the target rule;

[0152] Based on the rule identifier, fault cause, fault component, and fault handling measures, generate structured diagnostic events corresponding to the kernel fault of the target system.

[0153] Furthermore, the fault analysis unit 404 is also used for:

[0154] Structured diagnostic events are written to the system event log of the baseboard management controller with high priority, and prompts corresponding to the structured diagnostic events are issued. The prompts include at least one of alarm push information and display information on the baseboard management controller display interface.

[0155] Furthermore, the fault analysis unit 404 is also used for:

[0156] Based on the target rules, obtain at least one of the fault diagnosis operation and fault recovery operation corresponding to the fault analysis results.

[0157] It should be noted that the description of the features in the embodiment corresponding to the fault analysis device can be found in the relevant description of the embodiment corresponding to the fault analysis method, and will not be repeated here.

[0158] Embodiments of this disclosure also provide an electronic device including a memory and a processor, the memory storing a computer program, the processor being configured to run the computer program to perform the steps in any of the above-described fault analysis method embodiments.

[0159] Embodiments of this disclosure also provide a computer-readable storage medium storing a computer program configured to execute the steps in any of the above-described fault analysis method embodiments at runtime.

[0160] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0161] Embodiments of this disclosure also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described fault analysis method embodiments.

[0162] Embodiments of this disclosure also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in any of the above-described fault analysis method embodiments.

[0163] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0164] The foregoing has provided a detailed description of a fault analysis method provided by this disclosure. Specific examples have been used to illustrate the principles and implementation methods of this disclosure. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this disclosure without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this disclosure.

Claims

1. A fault analysis method, characterized in that, include: Based on the historical fault information corresponding to the system type of the target system kernel, obtain the rule identifier, first rule mode, fault information set and fault handling method corresponding to the historical fault information; Based on the rule identifier, the rule pattern, the fault information set, and the fault handling method, generate a rule corresponding to the historical fault information, and add the rule to the rule group corresponding to the first rule pattern in the rule base; When the baseboard management controller detects a kernel crash, it streams data from the log source and stores the data in a circular buffer. The data includes at least one log line, and the kernel crash status is used to indicate that the target system kernel has failed. According to the reading order of the at least one log line, the first log line is obtained from the circular buffer, and a preset set of key information is obtained; If the first log line includes any key information from the preset key information set, obtain the second rule pattern corresponding to the key information of the first log line, and obtain the first rule group corresponding to the second rule pattern in the rule base, wherein the rule base includes at least one rule; Based on the key information of the first log line, the first rule group is traversed to obtain the target rule corresponding to the first log line; Based on the target rules, obtain the fault analysis results corresponding to the kernel fault of the target system.

2. The method according to claim 1, characterized in that, The method further includes: If the target rule corresponding to the first log line is not found in the first rule group, the process iterates through the second rule group, which is a rule group in the rule base other than the first rule group; or... If the target rule corresponding to the first log line is not obtained in the first rule group, the second log line is obtained according to the reading order of the at least one log line, and the fault analysis operation of the target system kernel fault is performed based on the second log line, wherein the second log line is the next line after the first log line.

3. The method according to claim 1, characterized in that, The method further includes: If the key information corresponding to the first log line is not obtained, or if the key information of the first log line does not meet the key information requirements of the first log line, the second log line is obtained, and the fault analysis operation of the target system kernel fault is performed based on the second log line.

4. The method according to claim 1, characterized in that, in, The fault information set includes faulty components, and the method further includes: Based on the first rule pattern and the component, the rule base is grouped to obtain at least one rule group corresponding to the rule base.

5. The method according to claim 1, characterized in that, The step of traversing the first rule group based on the key information of the first log line to obtain the target rule corresponding to the first log line includes: Based on the key information of the first log line, obtain the rule matching pattern corresponding to the first log line; Using the rule matching mode, the first rule group is traversed to obtain the target rule corresponding to the first log line.

6. The method according to claim 5, characterized in that, The step of using the rule matching mode to traverse the first rule group and obtain the target rule corresponding to the first log line includes: If the second rule pattern corresponding to the key information of the first log line is a string matching rule, a string search function is used to traverse the first rule group to obtain the target rule corresponding to the first log line; or... If the second rule pattern corresponding to the key information of the first log line is a regular expression matching rule, a preset regular expression object is used to traverse the first rule group to obtain the target rule corresponding to the first log line.

7. The method according to claim 1, characterized in that, The step of obtaining the fault analysis results corresponding to the kernel fault of the target system according to the target rule includes: Based on the target rule, obtain the rule identifier, fault cause, fault component, and fault handling measures corresponding to the target rule; Based on the rule identifier, the fault cause, the fault component, and the fault handling measures, a structured diagnostic event corresponding to the kernel fault of the target system is generated.

8. The method according to claim 7, characterized in that, The method further includes: The structured diagnostic events are written to the system event log of the baseboard management controller with high priority, and prompt information corresponding to the structured diagnostic events is issued. The prompt information includes at least one of alarm push information and display information of the baseboard management controller display interface.

9. The method according to claim 1, characterized in that, The method further includes: Based on the target rule, obtain at least one of the fault diagnosis operation and fault recovery operation corresponding to the fault analysis result.

10. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the fault analysis method as described in any one of claims 1 to 9.

Images