Methods, apparatus, program products, and storage media for locating abnormal operation instructions

Abstract

This application discloses a method, apparatus, program product, and storage medium for locating abnormal operation instructions. The method includes: when a data cluster includes multiple abnormal processes, obtaining session information corresponding to each abnormal process based on the identifier of each abnormal process; determining second computing resources corresponding to multiple target operation instruction sets based on the instruction identifiers of multiple first operation instructions included in each session information; and determining abnormal operation instruction sets from the multiple target operation instruction sets based on the second computing resources, and identifying the first operation instructions included in the abnormal operation instruction sets as abnormal operation instructions. The abnormal operation instruction sets are operation instructions for which the second computing resources corresponding to the multiple target operation instruction sets are abnormal. This application solves the problem of being unable to locate abnormal operation instructions in related technologies, thereby achieving the effect of locating abnormal operation instructions.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to a method and apparatus for locating abnormal operation instructions, a program product, and a storage medium. Background Technology

[0002] With the development of big data and cloud computing technologies, cloud data warehouses based on the Massively Parallel Processing (MPP) architecture are key infrastructure for data processing, capable of efficiently processing large-scale data query and analysis tasks in parallel.

[0003] However, with the increasing complexity of business and the growth of data volume, the operation and maintenance of MPP cloud data warehouses has become particularly important. The monitoring of related technologies is mostly node-level and instance-level indicators, which can only locate "abnormally high resource consumption of certain nodes" and lacks automatic correlation with "single operation commands that cause resource imbalance". Moreover, even with tools such as TopSQL, database administrators still need to manually troubleshoot step by step after a failure occurs, and it is impossible to automatically identify abnormal operation commands when a failure occurs.

[0004] In summary, the relevant technologies have the problem of being unable to locate abnormal operation instructions. Summary of the Invention

[0005] This application provides a method, apparatus, program product, and storage medium for locating abnormal operation instructions, so as to at least solve the problem of being unable to locate abnormal operation instructions in related technologies.

[0006] According to one aspect of the embodiments of this application, a method for monitoring a server cluster is provided, comprising: when a data cluster includes multiple abnormal processes, obtaining session information corresponding to each of the abnormal processes based on the identifier of each abnormal process, wherein the abnormal process is a process among the multiple processes where a first process resource is abnormal, the first process resource is used to indicate the hardware resources of an abnormal computing node occupied by the process, the abnormal computing node is a node among the multiple computing nodes where the first computing resource is abnormal within multiple consecutive sampling periods, the first computing resource includes the hardware resources of the computing node; determining a second computing resource corresponding to multiple target operation instruction sets based on the instruction identifier of multiple first operation instructions included in each session information, wherein the second computing resource is used to indicate the hardware resources of the abnormal computing node occupied by each target operation instruction set, each target operation instruction set includes one or more of the first operation instructions with the same instruction identifier; determining an abnormal operation instruction set from the multiple target operation instruction sets based on the second computing resource, and determining the first operation instructions included in the abnormal operation instruction set as abnormal operation instructions, wherein the abnormal operation instruction set is an operation instruction corresponding to the second computing resource in the multiple target operation instruction sets where the second computing resource is abnormal.

[0007] In an exemplary embodiment, when the data cluster includes multiple abnormal processes, obtaining session information corresponding to each abnormal process based on the identifier of each abnormal process includes: obtaining the first computing resources of multiple computing nodes in the data cluster during multiple sampling periods; determining one or more abnormal computing nodes from the multiple computing nodes based on the first computing resources of each computing node; determining that the data cluster includes multiple abnormal processes based on the first process resources of each process included in each abnormal computing node; and obtaining session information corresponding to each abnormal process based on the identifier of each abnormal process.

[0008] In one exemplary embodiment, determining one or more abnormal computing nodes from a plurality of computing nodes based on the first computing resources of each of the aforementioned computing nodes includes: determining a first computing resource average value based on the first computing resources of all the aforementioned computing nodes, wherein the first computing resource average value includes the average utilization rate of the hardware resources in the aforementioned computing nodes; and determining computing nodes whose difference between the first computing resource maximum value and the first computing resource is less than a preset difference as abnormal computing nodes when the first computing resource tilt is greater than a preset tilt threshold in a plurality of the aforementioned sampling periods, wherein the first computing resource tilt is determined based on the first computing resource maximum value and the first computing resource average value, and the first computing resource maximum value is the maximum value of a plurality of the aforementioned first computing resources.

[0009] In an exemplary embodiment, determining that the data cluster includes multiple abnormal processes based on the first process resources of each process included in each of the abnormal computing nodes includes: performing the following operations on each of the abnormal computing nodes to determine the multiple abnormal processes included in the data cluster: obtaining a first list based on the identifier of the abnormal computing node, wherein the first list includes multiple processes executed in the abnormal computing node and the first process resources corresponding to each process; and determining the processes in the first list whose first process resources are greater than a preset resource threshold as the abnormal processes.

[0010] In one exemplary embodiment, obtaining session information corresponding to each of the aforementioned abnormal processes based on the identifier of each of the aforementioned abnormal processes includes: determining a target session view based on the identifier of the aforementioned abnormal process, wherein the identifier of the target session view is the same as the identifier of the aforementioned abnormal process; and determining the session information included in the aforementioned target session view as the session information corresponding to the aforementioned abnormal process.

[0011] In one exemplary embodiment, determining a second computing resource corresponding to a plurality of target operation instruction sets based on the instruction identifiers of the plurality of first operation instructions included in each of the aforementioned session information includes: determining a plurality of target operation instruction sets based on the instruction identifiers of the plurality of first operation instructions included in each of the aforementioned session information; and determining the second computing resource corresponding to each of the aforementioned target operation instruction sets based on the third computing resources of one or more of the aforementioned first operation instructions included in each of the aforementioned target operation instruction sets, wherein the third computing resource is used to indicate the hardware resources of the aforementioned abnormal computing node occupied by each of the aforementioned first operation instructions.

[0012] In an exemplary embodiment, based on the second computing resources, determining an abnormal operation instruction set from a plurality of target operation instruction sets, and determining the first operation instruction included in the abnormal operation instruction set as an abnormal operation instruction, includes: determining a first computing resource total value based on the sum of the first computing resources of the abnormal computing nodes, wherein the first computing resource total value includes the sum of the utilization rates of the hardware resources in the abnormal computing nodes; determining a first contribution value based on the second computing resources and the first computing resource total value, wherein the first contribution value is used to indicate the proportion of the hardware resources of the abnormal computing nodes occupied by the target operation instruction set in the sum of the utilization rates of the hardware resources in the abnormal computing nodes; determining the operation instruction set in the plurality of target operation instruction sets whose first contribution value is greater than a preset contribution value threshold as the abnormal operation instruction set, and determining the first operation instruction included in the abnormal operation instruction set as the abnormal operation instruction instruction.

[0013] According to another aspect of the embodiments of this application, an apparatus for locating abnormal operation instructions is also provided, comprising: a first acquisition module, configured to, in the case that a data cluster includes multiple abnormal processes, acquire session information corresponding to each of the abnormal processes based on the identifier of each of the abnormal processes, wherein the abnormal process is a process among the multiple processes in which the first process resource is abnormal, the first process resource is used to indicate the hardware resources of the abnormal computing node occupied by the process, the abnormal computing node is a node among the multiple computing nodes in which the first computing resource is abnormal within multiple consecutive sampling periods, and the first computing resource includes the hardware resources of the computing node; and a first determination module, configured to, based on each of the session information... The system includes multiple first operation instructions, which are used to identify the second computing resources corresponding to multiple target operation instruction sets. The second computing resources are used to indicate the hardware resources of the abnormal computing node occupied by each target operation instruction set. Each target operation instruction set includes one or more first operation instructions with the same instruction identifier. The second determining module is used to determine abnormal operation instruction sets from the multiple target operation instruction sets based on the second computing resources, and to determine the first operation instructions included in the abnormal operation instruction sets as abnormal operation instructions. The abnormal operation instruction sets are operation instructions for which the second computing resources corresponding to the multiple target operation instruction sets are abnormal.

[0014] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed by a processor.

[0015] According to another aspect of the embodiments of this application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the computer device to perform the steps in any of the method embodiments described above.

[0016] According to another aspect of the embodiments of this application, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to perform the steps of any of the above method embodiments through the computer program.

[0017] This application addresses the issue of multiple abnormal processes detected in a data cluster. First, based on the identifiers of the abnormal processes, related session information is obtained, establishing a connection between the abnormal computing nodes and the database sessions. Second, based on the instruction identifiers of multiple first operation instructions included in each session's information, first operation instructions with the same identifier are clustered to form multiple target operation instruction sets. Finally, the second computing resources of each target operation instruction set are analyzed to identify the abnormal operation instruction set, thereby determining the abnormal operation instruction. Therefore, this solves the problem of being unable to locate abnormal operation instructions in related technologies, thus achieving the effect of locating abnormal operation instructions. Attached Figure Description

[0018] Figure 1 This is a schematic diagram illustrating an application scenario of a method for locating abnormal operation instructions according to an embodiment of this application;

[0019] Figure 2 This is a flowchart illustrating an optional method for locating abnormal operation instructions according to an embodiment of this application.

[0020] Figure 3 This is a flowchart of an optional method for locating abnormal operation instructions according to an embodiment of this application;

[0021] Figure 4 This is a structural block diagram of an optional device for locating abnormal operation instructions according to an embodiment of this application. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] According to one aspect of the embodiments of this application, a method for locating abnormal operation instructions is provided. Optionally, in this embodiment, the above-described method for locating abnormal operation instructions may be applied, but is not limited to, to... Figure 1 The hardware environment shown includes terminal device 102 and server 104. Server 104 can be connected to terminal device 102 via a network and can be used to provide services (e.g., application services, etc.) to terminal device 102 or clients installed on terminal device 102. A database can be set up on server 104 or independently of server 104 to provide data storage services for server 104.

[0025] The aforementioned network may include, but is not limited to, at least one of the following: wired network and wireless network. The aforementioned wired network may include, but is not limited to, at least one of the following: wide area network (WAN), metropolitan area network (MAN), and local area network (LAN). The aforementioned wireless network may include, but is not limited to, at least one of the following: Wireless Fidelity (WIFI) and Bluetooth. Terminal device 102 may be, but is not limited to, a personal computer (PC), mobile phone, tablet computer, etc. Server 104 may be, but is not limited to, a cloud server, server cluster, or other server types.

[0026] The method for executing the location anomaly operation instruction according to the embodiments of this application can be executed by server 104, by terminal device 102, or by both server 104 and terminal device 102. The method for terminal device 102 to execute the location anomaly operation instruction according to the embodiments of this application can also be executed by a client installed on it.

[0027] Taking the method of executing the location anomaly operation instruction in this embodiment by the terminal device 102 as an example, Figure 2 This is a flowchart illustrating an optional method for locating abnormal operation instructions according to an embodiment of this application, as shown below. Figure 2 As shown, the process of this method may include the following steps:

[0028] Step S202: In the case that the data cluster includes multiple abnormal processes, based on the identifier of each of the abnormal processes, obtain the session information corresponding to each of the abnormal processes. The abnormal process is the process in which the first process resource is abnormal among the multiple processes. The first process resource is used to indicate the hardware resources of the abnormal computing node occupied by the process. The abnormal computing node is the node in which the first computing resource is abnormal within multiple consecutive sampling periods among the multiple computing nodes. The first computing resource includes the hardware resources of the computing node.

[0029] Optionally, hardware resources include CPU resources, memory resources, disk storage resources, and network bandwidth resources.

[0030] Optionally, a data cluster includes a set of collaborative compute nodes. These compute nodes include, but are not limited to, a coordinator node (CN) and multiple data nodes (DNs), which can be physical servers or virtual machines. For example, in cloud data warehouse products such as GaussDB (DWS), Greenplum, or AnalyticDB, a data cluster composed of multiple compute nodes processes petabyte (PB) level data, supporting complex data analysis and report generation.

[0031] Optionally, abnormal processes include database background processes that abnormally consume hardware resources during runtime, where hardware resources include, but are not limited to, CPU and memory. For example, in a cluster, if a process consistently maintains a CPU utilization rate above 95% due to executing complex Structured Query Language (SQL) queries, far exceeding the average level of other processes in the cluster, this process is considered an abnormal process.

[0032] Optionally, the identifier of an abnormal process is used to uniquely identify the process, specifically it can be a process identifier (PID).

[0033] Optionally, the first process resources include, but are not limited to, process resource data and session resource data, specifically the hardware resources occupied by the process during runtime. For example, the CPU utilization percentage of the process, the memory utilization percentage of the process.

[0034] Optionally, an abnormal computing node includes a node in the data cluster whose hardware resource consumption is abnormal over multiple consecutive sampling periods. The hardware resources include, but are not limited to, CPU and memory. For example, in a cluster consisting of 10 computing nodes, if the CPU utilization of computing node 8 exceeds 90% for 5 consecutive sampling periods, while the average CPU utilization of other nodes is only 60%, then computing node 8 is an abnormal computing node.

[0035] Optionally, the first computing resource includes, but is not limited to, CPU utilization, memory usage, and input / output (I / O) read / write speed.

[0036] Optionally, session information includes all relevant details of the database session, including but not limited to session ID, user, database, client information, and the SQL statement being executed. Session information is crucial for locating problematic SQL statements when diagnosing resource skew. For example, in GaussDB(DWS), querying the pg_stat_activity view provides information on all active sessions, including PID, username (user), database name, client_addr (client address), and query (the SQL statement being executed).

[0037] Step S204: Based on the instruction identifiers of the plurality of first operation instructions included in each of the above session information, determine the second computing resources corresponding to the plurality of target operation instruction sets, wherein the second computing resources are used to indicate the hardware resources of the abnormal computing node occupied by each of the above target operation instruction sets, and each of the above target operation instruction sets includes one or more of the above first operation instructions with the same instruction identifier.

[0038] Optionally, the first operation instruction includes SQL statements or other database operation commands executed in the abnormal process. The instruction identifier is a unique identifier that identifies this type of operation instruction, such as the query_id, sql_hash, or sql_text prefix string of the SQL statement. For example, in GaussDB(DWS), each SQL statement executed in a session has a corresponding query_id, which is the instruction identifier and can be used to track the execution of that SQL statement within the cluster.

[0039] Optionally, the target operation instruction set is a collection of multiple first operation instructions with the same instruction identifier. This typically refers to execution instances of the same SQL statement on multiple compute nodes, or different variations of a SQL statement. For example, SQL execution instances with the same sql_id or query_id (i.e., one execution of the same SQL statement) have corresponding execution shards on multiple compute nodes in the MPP cluster, meaning they are scheduled for parallel execution on multiple nodes. Therefore, the first operation instruction in the target operation instruction set is essentially one execution of the same SQL statement, with each execution shard running in parallel on multiple nodes.

[0040] Optionally, the second computing resources include the hardware resources occupied by the target operation instruction set on the abnormal computing node, including but not limited to CPU utilization, memory usage, disk I / O, and network traffic.

[0041] Step S206: Based on the second computing resource, determine the abnormal operation instruction set from the multiple target operation instruction sets, and determine the first operation instruction included in the abnormal operation instruction set as the abnormal operation instruction, wherein the abnormal operation instruction set is the operation instruction corresponding to the second computing resource in the multiple target operation instruction sets that is abnormal.

[0042] Optionally, the abnormal operation instruction set is the set of operation instructions that causes abnormal consumption of second computing resources during the execution process, including but not limited to abnormal CPU utilization, abnormal memory usage, and abnormal disk I / O.

[0043] In this embodiment, when multiple abnormal processes are detected in the data cluster, firstly, based on the identifiers of the abnormal processes, related session information is obtained, establishing a connection between the abnormal computing nodes and the database sessions. Secondly, based on the instruction identifiers of multiple first operation instructions included in each session information, first operation instructions with the same instruction identifier are clustered to form multiple target operation instruction sets. Finally, the second computing resources of each target operation instruction set are analyzed to identify the abnormal operation instruction set, thereby determining the abnormal operation instruction. Therefore, the problem of being unable to locate abnormal operation instructions in related technologies can be solved, thus achieving the effect of locating abnormal operation instructions.

[0044] In an exemplary embodiment, when the data cluster includes multiple abnormal processes, obtaining session information corresponding to each abnormal process based on the identifier of each abnormal process includes: obtaining the first computing resources of multiple computing nodes in the data cluster during multiple sampling periods; determining one or more abnormal computing nodes from the multiple computing nodes based on the first computing resources of each computing node; determining that the data cluster includes multiple abnormal processes based on the first process resources of each process included in each abnormal computing node; and obtaining session information corresponding to each abnormal process based on the identifier of each abnormal process.

[0045] Optionally, when executing SQL statements on a compute node, session information corresponding to a process can be obtained using session views. For example, querying a database session view (such as pg_stat_activity) and matching the process identifier (PID) with the PID field in the view yields the corresponding session information: datname, username, application_name, client_addr, query, query_id, etc. Furthermore, for some databases, the mapping between processes and sessions can be obtained through built-in or extended views, such as the WLM session statistics view in GaussDB (DWS).

[0046] In one exemplary embodiment, determining one or more abnormal computing nodes from a plurality of computing nodes based on the first computing resources of each of the aforementioned computing nodes includes: determining a first computing resource average value based on the first computing resources of all the aforementioned computing nodes, wherein the first computing resource average value includes the average utilization rate of the hardware resources in the aforementioned computing nodes; and determining computing nodes whose difference between the first computing resource maximum value and the first computing resource is less than a preset difference as abnormal computing nodes when the first computing resource tilt is greater than a preset tilt threshold in a plurality of the aforementioned sampling periods, wherein the first computing resource tilt is determined based on the first computing resource maximum value and the first computing resource average value, and the first computing resource maximum value is the maximum value of a plurality of the aforementioned first computing resources.

[0047] Optionally, the first average computing resource utilization rate is the average utilization rate of hardware resources on all computing nodes within a sampling period, or it can be the average utilization rate of hardware resources on all computing nodes within multiple sampling periods. For example, if the CPU utilization rate sampling data of computing nodes A, B, and C in a cluster at time t are 85%, 70%, and 65% respectively, then the first average computing resource utilization rate of CPU for computing nodes A, B, and C is 73.3%.

[0048] Optionally, the first computing resource tilt is used to measure the balance of hardware resource usage among different computing nodes in the data cluster.

[0049] Optionally, determining the first computing resource tilt based on the first maximum computing resource value and the first average computing resource value includes: calculating the difference between the first maximum computing resource value and the first average computing resource value to obtain a first difference; calculating the ratio of the first difference to a first parameter to obtain the first computing resource tilt, wherein the first parameter is the maximum value between the first average computing resource value and a first preset parameter. The first preset parameter is used to avoid the first parameter being an outlier. Specifically, the first preset parameter can be ε: a very small positive constant (e.g., 10^-6) used in the tilt calculation formula. When the average resource utilization of the cluster is close to 0, ε is used to replace the average value in the denominator to avoid division by zero or extreme amplification and to ensure the numerical stability of the tilt calculation.

[0050] Optionally, a preset skewness threshold is used to determine whether the skewness of the first computing resource has reached an abnormal level. When the skewness of the first computing resource exceeds the threshold, computing nodes that are close to or equal to the maximum value of the first computing resource are identified as abnormal computing nodes.

[0051] This embodiment utilizes the relationship between the average and maximum values ​​of the first computing resource (i.e., the first computing resource tilt) to quantitatively assess the balance of resource usage within the cluster. When the first computing resource tilt continuously exceeds a preset tilt threshold, abnormal computing nodes are identified, ensuring that only computing nodes that truly cause resource tilt are marked, reducing false alarms and false negatives, and effectively and accurately detecting and locating abnormal computing nodes with resource tilt.

[0052] In an exemplary embodiment, determining that the data cluster includes multiple abnormal processes based on the first process resources of each process included in each of the abnormal computing nodes includes: performing the following operations on each of the abnormal computing nodes to determine the multiple abnormal processes included in the data cluster: obtaining a first list based on the identifier of the abnormal computing node, wherein the first list includes multiple processes executed in the abnormal computing node and the first process resources corresponding to each process; and determining the processes in the first list whose first process resources are greater than a preset resource threshold as the abnormal processes.

[0053] Optionally, the first list is a list of processes related to the database instance on the abnormal compute node. The information for a process in the first list includes, but is not limited to: PID: a unique identifier assigned by the operating system to each database backend process; db_instance_id: a database instance identifier used to distinguish multiple database instances on the same compute node; cpu_pct: the CPU utilization percentage of the process, such as the current utilization relative to single-core or multi-core calculations; mem_pct: the memory utilization percentage of the process, such as the physical memory used by the process / the total physical memory of the node; os_user: the operating system user running the process; and cmdline: the process startup command line used to determine whether the process is a database background process, a WAL process, etc.

[0054] Optionally, an abnormal process is a database process or session that consumes resources significantly exceeding the normal range or a preset resource threshold. For example, for each abnormal computing node, the top K processes with the highest cpu_pct or mem_pct in the first list of the most recent occurrences of that abnormal computing node are identified as abnormal processes, and the abnormal process information {(node_id, PID, db_instance_id, cpu_pct, mem_pct)} is recorded.

[0055] Traditional resource monitoring often focuses on the computing node level, such as the CPU utilization and memory usage of a node. However, this embodiment introduces process-level monitoring and analyzes the resources of the first process, which can more accurately locate the cause of resource imbalance, rather than just knowing which computing node is using resources abnormally. This achieves refined and automated location of resource problems.

[0056] In one exemplary embodiment, obtaining session information corresponding to each of the aforementioned abnormal processes based on the identifier of each of the aforementioned abnormal processes includes: determining a target session view based on the identifier of the aforementioned abnormal process, wherein the identifier of the target session view is the same as the identifier of the aforementioned abnormal process; and determining the session information included in the aforementioned target session view as the session information corresponding to the aforementioned abnormal process.

[0057] Optionally, when executing SQL statements on a compute node, session information corresponding to a process can be obtained using session views. For example, querying a database session view (such as pg_stat_activity) and matching the process identifier (PID) with the PID field in the view yields the corresponding session information: datname, username, application_name, client_addr, query, query_id, etc. Furthermore, for some databases, the mapping between processes and sessions can be obtained through built-in or extended views, such as the WLM session statistics view in GaussDB (DWS).

[0058] In one exemplary embodiment, determining a second computing resource corresponding to a plurality of target operation instruction sets based on the instruction identifiers of the plurality of first operation instructions included in each of the aforementioned session information includes: determining a plurality of target operation instruction sets based on the instruction identifiers of the plurality of first operation instructions included in each of the aforementioned session information; and determining the second computing resource corresponding to each of the aforementioned target operation instruction sets based on the third computing resources of one or more of the aforementioned first operation instructions included in each of the aforementioned target operation instruction sets, wherein the third computing resource is used to indicate the hardware resources of the aforementioned abnormal computing node occupied by each of the aforementioned first operation instructions.

[0059] Optionally, based on the third computing resources of one or more of the first operation instructions included in each of the aforementioned target operation instruction sets, the second computing resources corresponding to each of the aforementioned target operation instruction sets are determined to include one of the following: performing the following operations on each target operation instruction set to obtain the second computing resources corresponding to each target operation instruction set: calculating the sum of the third computing resources of the first operation instructions to obtain the second computing resources; calculating the weighted sum of the third computing resources of the first operation instructions to obtain the second computing resources.

[0060] Optionally, the third computing resources include, but are not limited to, the CPU time, peak memory usage, and I / O operations consumed by the first operation instruction on the abnormal computing node. For example, on the abnormal computing node N1, a certain SQL statement consumes 40% of the CPU time, consumes 5GB of peak memory, and performs 1000 disk read / write operations; these are all third computing resources for that SQL statement. If the target operation instruction set includes three SQL statements with the same sql_id, then the second computing resources for the target operation instruction set include the CPU time, peak memory usage, and I / O operations consumed by these three SQL statements on the abnormal computing node N1.

[0061] This embodiment, based on the instruction identifiers of multiple first operation instructions included in each session's information, can pinpoint specific operation instructions that significantly impact resource allocation, rather than simply indicating sessions or processes with high resource utilization. This makes resource management more precise, enabling the direct identification of SQL statements that consume large amounts of CPU, memory, and other resources.

[0062] In an exemplary embodiment, based on the second computing resources, determining an abnormal operation instruction set from a plurality of target operation instruction sets, and determining the first operation instruction included in the abnormal operation instruction set as an abnormal operation instruction, includes: determining a first computing resource total value based on the sum of the first computing resources of the abnormal computing nodes, wherein the first computing resource total value includes the sum of the utilization rates of the hardware resources in the abnormal computing nodes; determining a first contribution value based on the second computing resources and the first computing resource total value, wherein the first contribution value is used to indicate the proportion of the hardware resources of the abnormal computing nodes occupied by the target operation instruction set in the sum of the utilization rates of the hardware resources in the abnormal computing nodes; determining the operation instruction set in the plurality of target operation instruction sets whose first contribution value is greater than a preset contribution value threshold as the abnormal operation instruction set, and determining the first operation instruction included in the abnormal operation instruction set as the abnormal operation instruction instruction.

[0063] Optionally, the first total computing resource value is the sum or weighted sum of the hardware resource utilization rates of all abnormal computing nodes, or it can be the sum or weighted sum of the hardware resource usage values ​​of all abnormal computing nodes. For example, if the CPU usage times on abnormal computing nodes N1, N2, and N3 are 90 seconds, 80 seconds, and 90 seconds respectively, then the first total computing resource value is 260 seconds; if the memory utilization rates of abnormal computing nodes N1, N2, and N3 are 30%, 40%, and 10% respectively, then the first total computing resource value is 80%.

[0064] Optionally, determining the first contribution value based on the total value of the second computing resources and the first computing resources includes: calculating the ratio of the second computing resources to the second parameter to obtain the first contribution value, wherein the second parameter is the maximum value between the total value of the first computing resources and the second preset parameter. The second preset parameter is used to avoid the second parameter being an outlier. Specifically, the second preset parameter may be ε: a very small positive constant (e.g., 10^-6) used in the tilt calculation formula to avoid division by zero or extreme amplification and to ensure the numerical stability of the tilt calculation.

[0065] This embodiment quantifies the resource consumption (i.e., the second computing resource) of each target operation instruction set and correlates it with the overall resource usage of the abnormal computing node (the total value of the first computing resource). This allows for the precise determination of which operation instruction sets contribute most significantly to the resource skew phenomenon, automatically identifying the abnormal operation instruction sets that are most likely to cause resource skew, reducing the need for operation and maintenance personnel to intervene, and improving operation and maintenance efficiency.

[0066] The method for locating abnormal operation instructions in the embodiments of this application will be explained below with reference to optional examples.

[0067] Figure 3 This is a flowchart of an optional method for locating abnormal operation instructions according to an embodiment of this application, such as... Figure 3 As shown, the process of this method may include the following steps:

[0068] Step S301, Begin.

[0069] Step S302: Deploy a lightweight resource collection agent on each MPP node. At preset time intervals (e.g., every 1 second, 5 seconds, etc.), read the current compute node's CPU and memory usage rates and distribute them to the `cpu_usage_percent` and `mem_usage_percent` fields of the `NodeResourceSample` structure. Simultaneously, scan related database processes and populate the `{PID, db_instance_id, cpu_pct, mem_pct, os_user, cmdline}` fields of the `db_process_list` field in the `NodeResourceSample` structure, generating a `NodeResourceSample` structure. The `NodeResourceSample` indicates the resource usage of a compute node and its database process resource usage at a specific sampling time point. The specific structure is shown below:

[0070] NodeResourceSample {

[0071] cluster_id,

[0072] node_id,

[0073] timestamp,

[0074] cpu_usage_percent,

[0075] mem_usage_percent,

[0076] db_process_list:[

[0077] {pid,db_instance_id,cpu_pct,mem_pct,os_user,cmdline} ]

[0079] }

[0080] Here, `cluster_id` is the cluster identifier, used to distinguish different MPP clusters; `node_id` is the compute node identifier, uniquely identifying a physical / virtual compute node, such as an IP address, hostname, or internal number; `timestamp` is the sampling timestamp, indicating the time point of this resource sampling; `cpu_usage_percent` is the overall CPU utilization percentage of the compute node (0–100), including system and user space; `mem_usage_percent` is the overall memory utilization percentage of the node (0–100), which can be calculated as used physical memory / total physical memory; `db_process_list` is a list of processes related to the database instance on the compute node, used to map operating system-level processes to database sessions.

[0081] The information for a process in db_process_list includes, but is not limited to, PID: a unique identifier assigned by the operating system to each database backend process; db_instance_id: a database instance identifier used to distinguish multiple database instances on the same compute node; cpu_pct: the CPU utilization percentage of the process, such as the current utilization calculated relative to a single core or multiple cores; mem_pct: the memory utilization percentage of the process, such as the physical memory used by the process / the total physical memory of the node; os_user: the operating system user running the process; and cmdline: the process startup command line used to determine whether the process is a database background process, a WAL process, etc.

[0082] The Agent sends the NodeResourceSample to the monitoring center through a secure interface. The monitoring center stores and performs subsequent statistics based on the cluster_id, node_id, and timestamp.

[0083] Step S303: Calculate CPU skew based on a set of samples {NodeResourceSample_i} of a cluster_id at time t:

[0084] The cpu_usage_percent of the compute node is denoted as CPU_i;

[0085] Calculate CPU_avg: CPU_avg = , calculate CPU_max: CPU_max=max(CPU_i)

[0086] Calculate CPU skew: CPU_skew = ε is a very small positive constant (e.g., 10^-6) used in the tilt calculation formula. When the average resource utilization of the cluster is close to 0, ε is used to replace the average value in the denominator to avoid division by zero or extreme amplification and to ensure the numerical stability of the tilt calculation.

[0087] Step S304: Determine whether the tilt threshold is exceeded. If yes, proceed to step S306; otherwise, proceed to step S305.

[0088] Step S305: End this round of data collection.

[0089] Step S306: If CPU_skew > T_cpu_skew (i.e., the preset skew threshold) is satisfied for M consecutive sampling periods, a skew event data structure SkewEvent is generated. SkewEvent is used to record a CPU / memory skew anomaly event. The specific structure is as follows:

[0090] SkewEvent {

[0091] event_id,

[0092] event_type,

[0093] cluster_id,

[0094] start_time,

[0095] end_time,

[0096] skew_value,

[0097] hot_nodes:[node_id1,node_id2,...]

[0098] }

[0099] Wherein, event_id is the unique identifier of the skew event; event_type is the type of skew event, used to distinguish different resource types, such as CPU_SKEW for CPU skew events, MEM_SKEW for memory skew events, and IO_SKEW for I / O skew events; cluster_id is the identifier of the MPP cluster where this skew event occurs; start_time is the start time of the skew event, that is, the time when the skew degree is first detected to exceed the preset skew degree threshold; end_time is the end time of the skew event, recorded when the skew degree recovers to below the preset skew degree threshold; skew_value is the skew degree value, such as CPU skew; hot_nodes is a list of compute nodes whose CPU utilization is close to CPU_max or whose memory utilization is close to mem_max in this skew event, represented by node_id.

[0100] Similarly, Mem_skew is calculated based on mem_usage_percent, and if it exceeds T_mem_skew, a SkewEvent with event_type=MEM_SKEW is triggered.

[0101] When the tilt returns to below the threshold and persists for a period of time, SkewEvent.end_time can be updated to mark the end of the event; multiple consecutive events within the same time window can be merged into a single long event to avoid alarm storms.

[0102] Step S307: For each node_id∈hot_nodes, identify the top K processes with the highest cpu_pct or mem_pct in the first list of the most recent node_id as abnormal processes, and record the abnormal process information {(node_id,PID,db_instance_id,cpu_pct,mem_pct)}.

[0103] In step S308, when executing SQL statements on a compute node, session information corresponding to a process can be obtained using session views. For example, querying a database session view (such as pg_stat_activity) and matching the process identifier (PID) with the PID field in the view yields the corresponding session information: datname, username, application_name, client_addr, query, query_id, etc. Furthermore, for some databases, the correspondence between processes and sessions can be obtained through built-in or extended views, such as the WLM session statistics view in GaussDB (DWS).

[0104] Step S309: Query the resource statistics of each SQL in the TopSQL or WLM view using query_id, sql_id, or unique_sql_id to obtain the CPU time, peak memory, CPU tilt percentage, etc. of each abnormal computing node; aggregate the same SQL (i.e., one or more SQLs with the same instruction identifier) ​​across nodes into a global SQL resource aggregation data structure GlobalSqlResource.

[0105] The calculation of SQL's contribution to resource skew is illustrated using CPU contribution as an example:

[0106] Calculate the total CPU consumption of hot_nodes in this tilt event: hot_nodes_cpu_total = Σ(CPU usage or time of each node_id∈hot_nodes);

[0107] For each GlobalSqlResource, calculate the total CPU time of the SQL statement on hot_nodes: sql_hot_cpu = Σ{cpu_time of node_id ∈ hot_nodes in node_contributions}.

[0108] Calculate CPU contribution: CPU_contribution= .

[0109] Similarly, calculate the memory contribution value.

[0110] The specific structure of GlobalSqlResource is as follows:

[0111] GlobalSqlResource{

[0112] sql_id,

[0113] query_id,

[0114] sql_text,

[0115] db_name,

[0116] user_name,

[0117] application_name,

[0118] client_addr,

[0119] total_cpu_time,

[0120] total_mem_peak,

[0121] cpu_skew_percent,

[0122] node_contributions: [

[0123] {node_id,cpu_time,mem_peak} ]

[0125] }

[0126] Among them, sql_id is the internal identifier of the SQL statement, which can correspond to the database's unique_sql_id, hashed SQL text, etc., and is used to aggregate a single SQL statement across nodes; query_id is the query ID of a single SQL execution (provided by the database execution layer, such as query_id), distinguishing different execution instances of the same SQL statement; sql_text is the content of the SQL statement, which can be truncated or saved completely according to configuration; db_name is the name of the database where the SQL statement resides; user_name is the database username (session user) that submitted the SQL statement; application_name is the name of the client application, such as the JDBC program name, BI tool name, etc., which can be obtained from the session view; client_addr is the IP address of the client that initiated the SQL statement, used to locate the specific application server or user source; total `l_cpu_time` is the total CPU time of the SQL statement across all compute nodes, which can be aggregated from the TopSQL or WLM views of each node; `total_mem_peak` is the peak memory usage observed for the SQL statement across all nodes; `cpu_skew_percent` is the CPU skew percentage statistically recorded within the database, or a skew index calculated based on `node_contributions`, used to assess the degree of CPU imbalance between nodes caused by the SQL statement; `node_contribution` is a list of resource contributions of the SQL statement on each node, where `node_contribution` includes, but is not limited to, the following fields: `node_id`: node identifier; `cpu_time`: CPU time of the SQL statement on that node; `mem_peak`: peak memory usage of the SQL statement on that node.

[0127] Step S310: Sort by contribution and determine the target SQL and its PID, user, and other information: Sort all GlobalSqlResources from highest to lowest contribution; select the top N as the target SQL set (i.e., the abnormal operation instruction set), and record the corresponding sql_id / query_id / sql_text; user_name, db_name, client_addr, application_name; total_cpu_time, total_mem_peak, cpu_skew_percent, etc.; and the CPU / memory status of each node in node_contributions.

[0128] Step S311: After completing the target SQL filtering, generate structured alarm information according to the pre-defined alarm template. This structured alarm information includes, but is not limited to: cluster ID (cluster_id); alarm type: CPU skew / memory skew; skew value; event time range: start_time–end_time; hot node list (hot_nodes); and target SQL information (for each GlobalSqlResource). The target SQL information includes, but is not limited to: SQL identifier (sql_id / query_id); SQL summary: the first few characters of the sql_text; database (db_name); user (user_name); client (client_addr); application (application_name); total CPU time and total memory peak; cpu_skew_percent; and resource distribution on each node (node_contributions serialized into a table or JSON).

[0129] Alerts can be pushed via various methods such as email, SMS, telephone, and the operation and maintenance platform API.

[0130] Step S312: Write the event and SQL information into the historical database for subsequent analysis.

[0131] Step S313, End.

[0132] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0133] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory (ROM) / random access memory (RAM), magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0134] According to another aspect of the embodiments of this application, an apparatus for locating abnormal operation instructions is also provided. This apparatus can be used to implement the method for locating abnormal operation instructions provided in the above embodiments, and will not be repeated hereafter. As used below, the term "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0135] Figure 4 This is a structural block diagram of an optional device for locating abnormal operation instructions according to an embodiment of this application, such as... Figure 4 As shown, the apparatus for the monitoring server cluster includes:

[0136] The first acquisition module 402 is used to acquire session information corresponding to each of the abnormal processes based on the identifier of each abnormal process when the data cluster includes multiple abnormal processes. The abnormal process is a process in which the first process resource is abnormal among the multiple processes. The first process resource is used to indicate the hardware resources of the abnormal computing node occupied by the process. The abnormal computing node is a node in which the first computing resource is abnormal within multiple consecutive sampling periods among the multiple computing nodes. The first computing resource includes the hardware resources of the computing node.

[0137] The first determining module 404 is used to determine the second computing resources corresponding to multiple target operation instruction sets based on the instruction identifiers of multiple first operation instructions included in each of the above-mentioned session information. The second computing resources are used to indicate the hardware resources of the abnormal computing node occupied by each of the above-mentioned target operation instruction sets. Each of the above-mentioned target operation instruction sets includes one or more of the above-mentioned first operation instructions with the same instruction identifier.

[0138] The second determining module 406 is used to determine an abnormal operation instruction set from multiple target operation instruction sets based on the second computing resource, and to determine the first operation instruction included in the abnormal operation instruction set as an abnormal operation instruction, wherein the abnormal operation instruction set is an operation instruction corresponding to the second computing resource in the multiple target operation instruction sets that is abnormal.

[0139] It should be noted that the first acquisition module 402 in this embodiment can be used to execute the above step S202, the first determination module 404 in this embodiment can be used to execute the above step S204, and the second determination module 406 in this embodiment can be used to execute the above step S206.

[0140] In an exemplary embodiment, the first acquisition module 402 includes: a first acquisition submodule, configured to acquire the first computing resources of multiple computing nodes in the data cluster during multiple sampling periods; a first determination submodule, configured to determine one or more abnormal computing nodes from the multiple computing nodes based on the first computing resources of each computing node; a second determination submodule, configured to determine that the data cluster includes multiple abnormal processes based on the first process resources of each process included in each abnormal computing node; and a second acquisition submodule, configured to acquire session information corresponding to each abnormal process based on the identifier of each abnormal process.

[0141] In an exemplary embodiment, the first determining submodule includes: a first determining unit, configured to determine a first computing resource average value based on the first computing resources of all the computing nodes, wherein the first computing resource average value includes the average utilization rate of the hardware resources in the computing nodes; and a second determining unit, configured to determine computing nodes whose difference between the maximum value of the first computing resource and the first computing resource is less than a preset difference as abnormal computing nodes when the first computing resource tilt is greater than a preset tilt threshold in multiple sampling periods, wherein the first computing resource tilt is determined based on the maximum value of the first computing resource and the first computing resource average value, and the maximum value of the first computing resource is the maximum value of multiple first computing resources.

[0142] In an exemplary embodiment, the second determining submodule includes: performing the following operations on each of the abnormal computing nodes to determine the plurality of abnormal processes included in the data cluster: a first obtaining unit, configured to obtain a first list based on the identifier of the abnormal computing node, wherein the first list includes the plurality of processes executed in the abnormal computing node and the first process resources corresponding to each process; and a third determining unit, configured to determine the processes in the first list whose first process resources are greater than a preset resource threshold as the abnormal processes.

[0143] In an exemplary embodiment, the second acquisition submodule includes: a fourth determining unit, configured to determine a target session view based on the identifier of the abnormal process, wherein the identifier of the target session view is the same as the identifier of the abnormal process; and a fifth determining unit, configured to determine the session information included in the target session view as session information corresponding to the abnormal process.

[0144] In an exemplary embodiment, the first determining module 404 includes: a third determining submodule, configured to determine a plurality of target operation instruction sets based on the instruction identifiers of the plurality of first operation instructions included in each of the session information; and a fourth determining submodule, configured to determine the second computing resource corresponding to each of the target operation instruction sets based on the third computing resources of one or more of the first operation instructions included in each of the target operation instruction sets, wherein the third computing resource is used to indicate the hardware resources of the abnormal computing node occupied by each of the first operation instructions.

[0145] In an exemplary embodiment, the second determining module 406 includes: a fifth determining submodule, configured to determine a total first computing resource value based on the sum of the first computing resources of the abnormal computing node, wherein the total first computing resource value includes the sum of the utilization rates of the hardware resources in the abnormal computing node; a sixth determining submodule, configured to determine a first contribution value based on the second computing resources and the total first computing resource value, wherein the first contribution value indicates the proportion of the hardware resources of the abnormal computing node occupied by the target operation instruction set in the total utilization rate of the hardware resources in the abnormal computing node; and a seventh determining submodule, configured to determine the operation instruction sets in the plurality of target operation instruction sets whose first contribution value is greater than a preset contribution value threshold as the abnormal operation instruction sets, and to determine the first operation instruction included in the abnormal operation instruction sets as the abnormal operation instruction.

[0146] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0147] According to another aspect of the embodiments of this application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein the program executes the steps in any of the above method embodiments when it is run.

[0148] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, ROMs, RAMs, portable hard drives, magnetic disks, or optical disks.

[0149] According to another aspect of the embodiments of this application, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor is configured to perform the steps of any of the method embodiments described above via the computer program. In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0150] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0151] According to another aspect of the embodiments of this application, a computer program product is also provided, which includes a computer program / instructions containing program code for performing the methods shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication component, and / or installed from a removable medium. When the computer program is executed by a central processing unit, it performs various functions provided in the embodiments of this application. The sequence numbers of the embodiments of this application above are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0152] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0153] The collection, storage, use, processing, transmission, provision, and disclosure of financial data or user data involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0154] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0155] The above are merely preferred embodiments of this application and are not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. A method for locating abnormal operation instructions, characterized in that, include: In the case of multiple abnormal processes in the data cluster, based on the identifier of each abnormal process, session information corresponding to each abnormal process is obtained. The abnormal process is the process with abnormal first process resources among the multiple processes. The first process resources are used to indicate the hardware resources of the abnormal computing node occupied by the process. The abnormal computing node is the node with abnormal first computing resources among the multiple computing nodes within multiple consecutive sampling periods. The first computing resources include the hardware resources of the computing node. Based on the instruction identifiers of multiple first operation instructions included in each session information, a second computing resource corresponding to multiple target operation instruction sets is determined, wherein the second computing resource is used to indicate the hardware resources of the abnormal computing node occupied by each target operation instruction set, and each target operation instruction set includes one or more first operation instructions with the same instruction identifier. Based on the second computing resource, an abnormal operation instruction set is determined from multiple target operation instruction sets, and the first operation instruction included in the abnormal operation instruction set is determined as an abnormal operation instruction, wherein the abnormal operation instruction set is an operation instruction corresponding to the second computing resource in multiple target operation instruction sets that is abnormal.

2. The method according to claim 1, characterized in that, In the case of multiple abnormal processes in the data cluster, based on the identifier of each abnormal process, session information corresponding to each abnormal process is obtained, including: Obtain the first computing resources of multiple computing nodes in the data cluster during multiple sampling periods; Based on the first computing resources of each computing node, one or more abnormal computing nodes are determined from the plurality of computing nodes; Based on the first process resources of each process included in each of the abnormal computing nodes, it is determined that the data cluster includes multiple abnormal processes; Based on the identifier of each abnormal process, obtain the session information corresponding to each abnormal process.

3. The method according to claim 2, characterized in that, Based on the first computing resources of each of the computing nodes, determining one or more of the abnormal computing nodes from the plurality of computing nodes includes: Based on the first computing resources of all the computing nodes, a first computing resource average value is determined, wherein the first computing resource average value includes the average utilization rate of the hardware resources in the computing nodes; When the first computing resource tilt is greater than a preset tilt threshold in multiple sampling periods, computing nodes whose difference between the maximum value of the first computing resource and the first computing resource is less than a preset difference are identified as abnormal computing nodes. The first computing resource tilt is determined based on the maximum value of the first computing resource and the average value of the first computing resource. The maximum value of the first computing resource is the maximum value of multiple first computing resources.

4. The method according to claim 2, characterized in that, Based on the first process resources of each process included in each of the abnormal computing nodes, it is determined that the data cluster includes multiple abnormal processes, including: For each of the aberrant computing nodes, the following operations are performed to identify the plurality of aberrant processes included in the data cluster: Based on the identifier of the abnormal computing node, a first list is obtained, wherein the first list includes multiple processes executed in the abnormal computing node and the first process resources corresponding to each process; Processes in the first list whose first process resources exceed a preset resource threshold are identified as abnormal processes.

5. The method according to claim 1 or 2, characterized in that, Based on the identifier of each abnormal process, obtain the session information corresponding to each abnormal process, including: Based on the identifier of the abnormal process, a target session view is determined, wherein the identifier of the target session view is the same as the identifier of the abnormal process; The session information included in the target session view is determined to be the session information corresponding to the abnormal process.

6. The method according to claim 1, characterized in that, Based on the instruction identifiers of multiple first operation instructions included in each session information, the second computing resources corresponding to multiple target operation instruction sets are determined, including: Based on the instruction identifiers of the multiple first operation instructions included in each session information, a plurality of target operation instruction sets are determined; Based on the third computing resources of one or more first operation instructions included in each target operation instruction set, the second computing resource corresponding to each target operation instruction set is determined, wherein the third computing resource is used to indicate the hardware resources of the abnormal computing node occupied by each first operation instruction.

7. The method according to claim 1, characterized in that, Based on the second computing resource, an abnormal operation instruction set is determined from multiple target operation instruction sets, and a first operation instruction included in the abnormal operation instruction set is determined as an abnormal operation instruction, including: Based on the sum of the first computing resources of the abnormal computing nodes, the total value of the first computing resources is determined, wherein the total value of the first computing resources includes the sum of the utilization rates of the hardware resources in the abnormal computing nodes; Based on the total value of the second computing resources and the first computing resources, a first contribution value is determined, wherein the first contribution value is used to indicate the proportion of the hardware resources of the abnormal computing node occupied by the target operation instruction set in the total utilization rate of the hardware resources in the abnormal computing node; The set of operation instructions in the multiple target operation instruction sets whose first contribution is greater than a preset contribution threshold is determined as the abnormal operation instruction set, and the first operation instruction included in the abnormal operation instruction set is determined as the abnormal operation instruction.

8. A device for locating abnormal operation commands, characterized in that, include: The first acquisition module is used to acquire session information corresponding to each abnormal process based on the identifier of each abnormal process when the data cluster includes multiple abnormal processes. The abnormal process is a process with abnormal first process resources among multiple processes. The first process resources are used to indicate the hardware resources of the abnormal computing node occupied by the process. The abnormal computing node is a node with abnormal first computing resources among multiple computing nodes within multiple consecutive sampling periods. The first computing resources include the hardware resources of the computing node. The first determining module is used to determine the second computing resources corresponding to multiple target operation instruction sets based on the instruction identifiers of multiple first operation instructions included in each session information, wherein the second computing resources are used to indicate the hardware resources of the abnormal computing node occupied by each target operation instruction set, and each target operation instruction set includes one or more first operation instructions with the same instruction identifier. The second determining module is configured to determine an abnormal operation instruction set from a plurality of target operation instruction sets based on the second computing resource, and determine the first operation instruction included in the abnormal operation instruction set as an abnormal operation instruction, wherein the abnormal operation instruction set is an operation instruction corresponding to the second computing resource in the plurality of target operation instruction sets that is abnormal.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 7.

Images