Analysis method and system based on Java exception and eBPF kernel association

Abstract

The invention provides an analysis method and system based on Java exception and eBPF kernel association, and the method comprises the steps: loading an agent program when a JVM is started, registering an exception throwing event callback function, capturing JVM exception information in real time, monitoring a system call exit stage based on an eBPF technology, capturing the call information of a system call failure event, carrying out the analysis and structuring of a user state script, and carrying out the analysis of the Java exception and eBPF kernel association. The cross-layer abnormal data is transmitted to the data processing module through the message middleware, the data processing module completes cross-layer abnormal data association, the associated cross-layer abnormal data is input into the large language model, and a visual diagnosis report is generated; according to the method, a cross-layer event matching mechanism based on a thread context and a high-precision timestamp is established, so that a monitoring data island between an application layer and a system layer is eliminated; and finally, a visual diagnosis report is generated, so that the automation, intelligence and standardization levels of troubleshooting of the complex system are improved.

Description

Technical Field

[0001] This invention relates to the field of intelligent operation and maintenance technology, specifically to an analysis method and system based on the association between Java exceptions and the eBPF kernel. Background Technology

[0002] In modern distributed software systems, the stability of applications and the efficiency of troubleshooting are directly related to business continuity and user experience. When an application encounters an anomaly, traditional error analysis methods mainly rely on log files, monitoring metrics, and the output of tracing systems. However, these methods are often limited to single-level information collection and are difficult to achieve cross-level root cause localization.

[0003] Currently, exception handling in Java applications is typically based on the logging mechanism provided by the JVM or APM probe technology, which helps in diagnosis by capturing exception-throwing events and recording stack information.

[0004] However, these methods only reflect the execution status of the application layer and cannot reveal the underlying operating system behavior behind the exception. For example, a java.io.FileNotFoundException might be caused by a non-existent file system path, but its essence is due to the kernel-mode openat system call returning the ENOENT error code; similarly, java.net.ConnectException often corresponds to a timeout or rejection of the connect system call. Due to the lack of effective collection and correlation of these underlying system call failure information, when troubleshooting such problems, operations and maintenance personnel usually need to manually cross-reference multiple sources of data, such as application logs, strace tracing, dmesg output, and even network packet captures. This process is cumbersome, highly dependent on personal experience, and severely reduces the speed of fault response.

[0005] Meanwhile, eBPF provides robust support for operating system-level observability by enabling developers to securely and efficiently monitor system calls, function execution, and network behavior without modifying the kernel source code. However, the data collected by eBPF primarily consists of low-level system events with a low degree of semantic abstraction, making it difficult for ordinary developers or operations personnel to quickly understand the causal relationship between these events and upper-layer application exceptions. Furthermore, current technologies have not effectively resolved the spatiotemporal alignment problem between Java Virtual Machine layer exceptions and Linux kernel layer system behavior—that is, how to accurately match a Java exception with its corresponding system call failure in a high-concurrency, multi-threaded environment.

[0006] In recent years, large language models have demonstrated powerful capabilities in natural language understanding and reasoning, and have been widely applied in fields such as code generation and log analysis. However, current error analysis remains at the JVM runtime level, failing to perform joint analysis of errors within Linux. Therefore, there is an urgent need for a technical solution that can automatically collect Java application exception information and Linux kernel-level system call failure data, accurately correlate them based on thread context (TID) and timestamps, and then use large language models for joint analysis to generate visualized diagnostic reports. This would achieve a leap from "passively checking logs" to "actively identifying root causes," improving the intelligence and automation level of complex system fault diagnosis.

[0007] Currently, in troubleshooting Java application systems, there is a significant technical disconnect between application-layer monitoring and operating system-layer monitoring. Existing application performance management tools primarily rely on the exception handling mechanism provided by the Java Virtual Machine (JVM), which can record exception types, stack traces, and occurrence times. However, their monitoring scope is limited to the JVM's internal execution environment, failing to capture the behavioral details of the underlying operating system. Meanwhile, critical error events generated during Linux system operation, such as file access failures, network connection timeouts, and system call error codes, are typically recorded by the kernel through mechanisms like dmesg, auditd, or eBPF. This information is independent of the application log system and lacks direct correlation with upper-layer business logic. Because these two types of data are isolated in terms of collection sources, storage systems, and analysis tools, when a Java application throws exceptions like FileNotFoundException or SocketTimeoutException, it cannot automatically determine whether the error was caused by a failed openat or connect system call. Operations personnel must manually combine thread IDs and timestamps for cross-referencing across multiple log systems. This process is not only time-consuming and labor-intensive but also requires a high level of experience from technical personnel and is prone to misjudgments due to insufficient time accuracy or lost context. Current technology does not yet have the ability to automatically generate structured diagnostic conclusions after cross-layer event matching. Fault review still relies on manual summarization, which restricts the improvement of operation and maintenance efficiency. Summary of the Invention

[0008] This invention provides an analysis method and system based on the correlation between Java exceptions and the eBPF kernel. By establishing a cross-layer event matching mechanism based on thread context and high-precision timestamps, it eliminates monitoring data silos between the application layer and the system layer. Simultaneously, based on the correlation, it performs joint analysis on JVM internal error logs and corresponding operating system error logs, and finally generates a diagnostic report with error analysis, repair suggestions, and visualization, thereby improving the automation, intelligence, and standardization of troubleshooting complex system faults and solving the problems in the background technology.

[0009] To achieve the above objectives, the technical solution of the present invention is as follows: An analysis method based on the association between Java exceptions and the eBPF kernel includes the following steps: S1: Java application layer exception collection. By loading the NativeAgent agent program based on the JVMTI interface when the JVM starts, registering the exception throwing event callback function, capturing the type, stack information, traceid, operating system level TID and timestamp of JVM exception in real time, and transmitting the structured exception data to the data processing module through message middleware; S2: Linux kernel layer event acquisition, based on eBPF technology, mounts kernel tracepoint to listen to the system call exit phase, captures the call type, error code, target resource, TID and timestamp of system call failure events, and after being parsed and structured by user-space scripts, it is transmitted to the data processing module through message middleware; S3: Deploy the data processing module to uniformly parse and persistently store the structured data of the Java application layer and the Linux kernel layer into the time series database. Based on the traceid input by the user, query the TID and occurrence time associated with the Java exception, and match the corresponding kernel layer system call failure event within the same TID and time window to complete the cross-layer exception data association. S4: The correlated cross-layer anomaly data is constructed into a structured Prompt input large language model. The model completes the semantic understanding and causal reasoning of the anomaly root cause, generates results including root cause analysis and repair suggestions, and finally outputs a visual diagnostic report that integrates the timeline, call chain and large language model conclusions.

[0010] Preferably, in S1, the NativeAgent agent program loads the startup parameters of the target Java service without modifying the application code; The types of JVM exceptions captured in real time include the fully qualified name of the JVM exception. The structured exception data is in JSON format and includes the fields ts, traceid, TID, exception_class, stack_trace, and thread_name.

[0011] Preferably, in S2, the kernel tracepoints mounted by the eBPF program include syscalls:sys_exit_openat and syscalls:sys_exit_connect; The criteria for determining system call failure are a negative return value and an error code that is the absolute value of the return value; The collected kernel event information is structured into JSON format, containing fields ts, TID, syscall, errno, and file_or_addr.

[0012] Preferably, the message middleware used in S1 and S2 is KAFKA, which is used to transmit structured Java exception data and Linux kernel event data.

[0013] Preferably, the specific logic for cross-layer abnormal data association in S3 is as follows: First, query the associated Java exception record using the traceid entered by the user to obtain the corresponding TID and occurrence time. Then, within the same TID and time window, find the corresponding Linux kernel layer system call failure event.

[0014] Preferably, the time-series database used in S3 is ClickHouse, which is used to persistently store structured exception data from the Java application layer and the Linux kernel layer.

[0015] Preferably, in S4, the structured Prompt is composed of associated Java exception information and corresponding Linux kernel event information; The visual diagnostic report includes a timeline of abnormal events, a call chain from the application to the kernel, and root cause analysis conclusions for the large language model.

[0016] Preferably, in S4, the large language model, based on the knowledge of the interaction mechanism between the Java runtime and the Linux operating system, performs semantic understanding and causal reasoning on the associated cross-layer abnormal data, and generates root cause analysis conclusions and executable repair suggestions.

[0017] An analysis system based on the association between Java exceptions and the eBPF kernel is provided to implement the aforementioned analysis method based on the association between Java exceptions and the eBPF kernel. The system includes a Java exception acquisition module, a Linux kernel event acquisition module, and a data processing module. The Java exception collection module is used to capture exception information thrown by Java applications during runtime in real time, and output it to the message middleware after structuring it; it is deployed in the target Java application process and is implemented through NativeAgent technology. The Linux kernel event acquisition module is used to monitor system call failure events that occur in the Linux operating system kernel and record their context information; it is implemented based on eBPF technology and adopts an architecture that works in both kernel mode and user mode. The data processing module is used to process, store, and query the collected Java application layer and Linux kernel layer log data.

[0018] Preferably, the connection relationships between the modules of the system are as follows: The Java exception collection module and the Linux kernel event collection module are independent of each other. They each output the collected and structured information to the message middleware, and the data processing module realizes data connection through the message middleware.

[0019] As can be seen from the above technical solution compared with the prior art, the present invention has the following beneficial effects: 1. This invention collects application layer anomalies through an Agent program and captures kernel layer system call failure events using eBPF. It achieves cross-layer event matching by using the same thread ID and timestamp as identifiers, and inputs the correlation results into a large language model. The model determines whether the root cause of the anomaly is located in the Java application layer or the Linux operating system layer, and generates a report with explanation and repair suggestions.

[0020] 2. This invention achieves anomaly interception by loading an Agent into the Java layer startup parameters, and monitors system calls at the operating system layer through an eBPF program. The collection process can obtain a complete report from the application layer to the operating system level without modifying the application code. Attached Figure Description

[0021] Figure 1 This is a schematic flowchart of the method steps in an embodiment of the present invention; Figure 2 This is a schematic diagram of the implementation process of an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.

[0023] The embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are used to illustrate the present invention, but should not be used to limit the scope of the present invention.

[0024] This invention provides an analysis method based on the association between Java exceptions and the eBPF kernel, such as... Figure 1 As shown, it includes the following steps: S1: Java application layer exception collection. By loading the NativeAgent agent program based on the JVMTI interface when the JVM starts, registering the exception throwing event callback function, capturing the type, stack information, traceid, operating system level TID and timestamp of JVM exception in real time, and transmitting the structured exception data to the data processing module through message middleware; S2: Linux kernel layer event acquisition, based on eBPF technology, mounts kernel tracepoint to listen to the system call exit phase, captures the call type, error code, target resource, TID and timestamp of system call failure events, and after being parsed and structured by user-space scripts, it is transmitted to the data processing module through message middleware; S3: Deploy the data processing module to uniformly parse and persistently store the structured data of the Java application layer and the Linux kernel layer into the time series database. Based on the traceid input by the user, query the TID and occurrence time associated with the Java exception, and match the corresponding kernel layer system call failure event within the same TID and time window to complete the cross-layer exception data association. S4: The correlated cross-layer anomaly data is constructed into a structured Prompt input large language model. The model completes the semantic understanding and causal reasoning of the anomaly root cause, generates results including root cause analysis and repair suggestions, and finally outputs a visual diagnostic report that integrates the timeline, call chain and large language model conclusions.

[0025] Example: In this embodiment, an internet company deployed core Java business services, such as user order processing services, running on a Linux server. This service handles millions of orders per day and requires stable operation 24 / 7.

[0026] Recently, the service has been experiencing frequent intermittent freezes and occasional error exits. Developers have investigated multiple times but have not been able to find the root cause. The application logs only show that FileNotFoundException and ConnectException are thrown at the Java level, but it is impossible to confirm whether the problem is caused by incorrect application code path configuration, abnormal operating system file permissions, or abnormal network calls. Each troubleshooting requires the collaboration of multiple development and operations personnel, which seriously affects business continuity.

[0027] Implementation begins: Deploy the Java exception collection module: When the JVM of the order processing service starts, a NativeAgent agent program based on the JVMTI interface is loaded through startup parameters. This agent program registers event callback functions for exceptions and captures the fully qualified name, traceid, stack information, operating system-level TID, thread name and timestamp of Java exceptions in real time. The data is encapsulated in JSON format, including fields such as ts, traceid, TID, and exception_class, and transmitted to the data processing module through the Kafka message middleware. The entire process does not modify the application business code.

[0028] Deploy the Linux kernel event collection module: Deploy the eBPF probe program in the Linux server kernel, mount it to the tracepoint:syscalls:sys_exit_openat and tracepoint:syscalls:sys_exit_connect nodes, and listen for system call exit phases; when a system call failure is detected, i.e., the return value is negative, collect the system call name, error code, target resource path or network address, TID and timestamp, and store them in the kernel buffer; The user-space data storage script continuously monitors the buffer, parses the data, and serializes it into JSON format, including fields such as ts, TID, syscall, and errno, which are then transmitted to the data processing module via KAFKA.

[0029] After deployment, the specific implementation process is as follows: Figure 2 As shown, the JVM internally captures application exceptions non-intrusively through a native agent and encapsulates them into exception log messages before sending them to KAFKA. The Linux kernel writes exception call logs of failed system calls into a buffer, which is then read by a log reading script and encapsulated into exception log messages before being sent to KAFKA. KAFKA acts as a message bus, transmitting both types of messages to the data processing module. This module performs structured parsing of the data and persists it to a time-series database. Based on the thread ID (TID) and timestamp, it performs cross-layer association between application layer and kernel layer exceptions. The associated exception log data is then input into a large model for root cause reasoning and repair suggestion generation.

[0030] Finally, the anomaly report output by the large model is pushed to an external page for development and operations personnel to view, realizing full-link automated fault analysis from dual-source data collection, asynchronous transmission, persistent storage, cross-layer correlation to intelligent diagnosis and visualization output.

[0031] This application leverages a large language model and log association collection to achieve penetrating exception analysis from the Java application layer to the Linux operating system layer. At the JVM level, the system uses NativeAgent technology to intercept exception events, collect the exception type, call stack, traceid, and the operating system-level thread ID (TID) corresponding to the thread executing the exception, and sends this information to a message broker.

[0032] At the Linux kernel level, eBPF monitors the results of critical system calls, recording the system call type, error code, target resource path, and the TID of the triggering thread, enabling non-intrusive capture of abnormal kernel behavior. Both source data carry the operating system thread ID and timestamp, providing a unified identifier for subsequent cross-layer associations.

[0033] Deploy the data processing module: Deploy the ClickHouse time-series database. The data processing module receives two types of structured data transmitted by Kafka, parses them uniformly, and persists them to ClickHouse. When the service encounters an error again, the user enters the traceid corresponding to the error. The module uses this traceid to query the associated Java exception record, obtains the corresponding TID and the exception occurrence time, and matches the Linux kernel layer system call failure event within the same TID and ±5-second time window to complete the cross-layer exception association and integrate application and kernel layer exception data.

[0034] Integrate the large model analysis module and generate a visual diagnostic report: construct a structured Prompt from the correlated cross-layer anomaly data in the format of anomaly scenario + system behavior evidence, and call the large language model through the interface; The model is based on knowledge of the interaction mechanism between the Java runtime and the Linux operating system to perform semantic understanding and causal reasoning, and generate root cause analysis and remediation suggestions. Finally, the report generation module outputs a visual diagnostic report, which includes an abnormal event timeline, the kernel call chain involved, the root cause conclusions of the large language model, and remediation suggestions.

[0035] This invention utilizes a large language model to perform semantic understanding and causal reasoning on associated cross-layer anomaly data. The system combines Java exceptions and their corresponding kernel events into a structured context, which is then used as a Prompt input to the large language model. Based on its knowledge of the interaction mechanism between the Java runtime and the operating system, the model automatically determines whether the root cause of the exception lies in the application layer or the system layer.

[0036] For example, when Java throws a FileNotFoundException, the model combines the evidence from the kernel-level openat system call returning ENOENT to infer that "the file does not exist" is the root cause, and generates an executable suggestion to "check the deployment process or file path configuration".

[0037] This application uses TID and timestamps to establish cross-layer correlation between Java application exceptions and Linux kernel system call failure events, thereby clarifying the root cause of the failure. For example, in this embodiment, the possible cause of the exception is the FileNotFoundException in the Java log. After correlation, it was found that the Linux kernel layer openat system call returned the ENOENT error code. The root cause is the operating system file permission configuration error, rather than an application code problem. This application automatically completes data collection, cross-layer correlation, and intelligent reasoning through the system, eliminating the need for manual collaborative investigation and significantly reducing labor costs. At the same time, it can automatically generate standardized visual diagnostic reports, accurately identify root causes, and provide actionable repair suggestions, avoiding redundant analysis and effectively improving fault repair efficiency. Moreover, the entire process adopts a non-intrusive deployment, and the Agent program and eBPF probe do not require modification of application and kernel source code. The deployment process does not affect the normal operation of business and eliminates secondary impacts.

[0038] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the analysis methods based on the association between Java exceptions and the eBPF kernel in the above embodiments.

[0039] It is understood that the systems, devices, and storage media provided in the embodiments of the present invention correspond to the methods provided in the embodiments of the present invention, and the explanations, examples, and beneficial effects of the relevant content can be referred to the corresponding parts of the above methods.

[0040] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.

[0041] For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media.

[0042] The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid state disks (SSDs)).

[0043] It should be noted that in this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0044] Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0045] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0046] The embodiments of the present invention are given for the purposes of illustration and description. Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. An analysis method based on the association between Java exceptions and the eBPF kernel, characterized in that, Includes the following steps: S1: Java application layer exception collection. By loading the NativeAgent agent program based on the JVMTI interface when the JVM starts, registering the exception throwing event callback function, capturing the type, stack information, traceid, operating system level TID and timestamp of JVM exception in real time, and transmitting the structured exception data to the data processing module through message middleware; S2: Linux kernel layer event acquisition, based on eBPF technology, mounts kernel tracepoint to listen to the system call exit phase, captures the call type, error code, target resource, TID and timestamp of system call failure events, and after being parsed and structured by user-space scripts, it is transmitted to the data processing module through message middleware; S3: Deploy the data processing module to uniformly parse and persistently store the structured data of the Java application layer and the Linux kernel layer into the time series database. Based on the traceid input by the user, query the TID and occurrence time associated with the Java exception, and match the corresponding kernel layer system call failure event within the same TID and time window to complete the cross-layer exception data association. S4: The correlated cross-layer anomaly data is constructed into a structured Prompt input large language model. The model completes the semantic understanding and causal reasoning of the anomaly root cause, generates results including root cause analysis and repair suggestions, and finally outputs a visual diagnostic report that integrates the timeline, call chain and large language model conclusions.

2. The analysis method based on the association between Java exceptions and the eBPF kernel as described in claim 1, characterized in that: In S1, the NativeAgent agent program loads the startup parameters of the target Java service without modifying the application code. The types of JVM exceptions captured in real time include the fully qualified name of the JVM exception. The structured exception data is in JSON format and includes the fields ts, traceid, TID, exception_class, stack_trace, and thread_name.

3. The analysis method based on the association between Java exceptions and the eBPF kernel as described in claim 1, characterized in that: In S2, the kernel tracepoints mounted by the eBPF program include syscalls:sys_exit_openat and syscalls:sys_exit_connect; The system call failure event is determined based on a negative return value and an error code that is the absolute value of the return value. After being parsed and structured by the user-space script, the error code is in JSON format and contains the fields ts, TID, syscall, errno, and file_or_addr.

4. The analysis method based on the association between Java exceptions and the eBPF kernel as described in claim 1, characterized in that: The message middleware used in S1 and S2 is KAFKA, which is used to transmit structured Java exception data and Linux kernel event data.

5. The analysis method based on the association between Java exceptions and the eBPF kernel as described in claim 1, characterized in that: The specific logic for cross-layer anomaly data association in S3 is as follows: First, query the associated Java exception record using the traceid entered by the user to obtain the corresponding TID and occurrence time. Then, within the same TID and occurrence time window, find the corresponding Linux kernel layer system call failure event.

6. The analysis method based on the association between Java exceptions and the eBPF kernel as described in claim 1, characterized in that: The time-series database used in S3 is ClickHouse, which is used to persistently store structured exception data from the Java application layer and the Linux kernel layer.

7. The analysis method based on the association between Java exceptions and the eBPF kernel as described in claim 1, characterized in that: In S4, the structured Prompt is composed of associated Java exception information and corresponding Linux kernel event information; The visual diagnostic report includes an anomaly event timeline, the application-to-kernel call chain, and root cause analysis conclusions for the large language model.

8. The analysis method based on the association between Java exceptions and the eBPF kernel as described in claim 1, characterized in that: In S4, the large language model, based on its knowledge of the interaction mechanism between the Java runtime and the Linux operating system, performs semantic understanding and causal reasoning on the associated cross-layer abnormal data, generating root cause analysis conclusions and executable repair suggestions.

9. An analysis system based on the association between Java exceptions and the eBPF kernel, used to implement the analysis method based on the association between Java exceptions and the eBPF kernel as described in any one of claims 1-8, characterized in that: include: Java exception collection module, Linux kernel event collection module, and data processing module; The Java exception collection module is used to capture exception information thrown by the Java application during runtime in real time, and output it to the message middleware after structuring; it is deployed in the target Java application process and implemented through NativeAgent technology; The Linux kernel event acquisition module is used to monitor system call failure events occurring in the Linux operating system kernel and record their context information; it is implemented based on eBPF technology and adopts an architecture that works in collaboration between kernel mode and user mode. The data processing module is used to process, store, and query the collected Java application layer and Linux kernel layer log data.

10. The analysis system based on the association between Java exceptions and the eBPF kernel as described in claim 9, characterized in that: The connection relationships between the modules of the system are as follows: The Java exception collection module and the Linux kernel event collection module are independent of each other. They each output the collected and structured information to the message middleware, and the data processing module realizes data connection through the message middleware.

Images