A fault root cause positioning method, device, equipment, storage medium and product

Abstract

This application provides a method, apparatus, device, storage medium, and product for locating the root cause of a fault. The method includes: obtaining a fault search space; wherein the fault search space includes multiple tuples, each tuple including an attribute and its corresponding attribute value; determining the category of each attribute in the fault search space; wherein the category of each attribute includes a first category and a second category, the first category being used to characterize attributes that have a dependency relationship with one or more other attributes in the fault search space besides themselves, and the second category being used to characterize attributes that do not have a dependency relationship with any other attributes in the fault search space besides themselves; and determining a set of fault root causes by performing a heuristic search on the fault search space based on the categories of each attribute.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, device, storage medium and product for locating the root cause of a fault. Background Technology

[0002] In cloud computing environments, as system scale and complexity continue to increase, the frequency of service interruptions and downtime events rises significantly, impacting fundamental system-level services such as storage and network management. Given the interrelationships of these services, a single failure can trigger a wider range of problems. Therefore, after a failure occurs, it is crucial to promptly identify the root cause of the system malfunction (i.e., the root cause) to implement appropriate isolation or recovery measures. The process of identifying the root cause is called root cause analysis (RCA) or root cause localization. To quickly identify and resolve failures, it is typically necessary to analyze large amounts of log data to find the root cause. However, there are currently no effective solutions to improve the efficiency of root cause localization. Summary of the Invention

[0003] This application provides a method, apparatus, device, storage medium, and product for locating the root cause of a fault, which can improve the efficiency of fault root cause location.

[0004] The technical solution of this application embodiment is implemented as follows: This application provides a method for locating the root cause of a fault, the method comprising: Obtain the fault search space; wherein, the fault search space includes: multiple tuples, each tuple including: an attribute and its corresponding attribute value; The categories of each attribute in the fault search space are determined; wherein, the categories of each attribute include: a first category and a second category, wherein the first category is used to characterize an attribute that has a dependency relationship with one or more other attributes in the fault search space other than itself, and the second category is used to characterize an attribute that does not have a dependency relationship with any other attributes in the fault search space other than itself. Based on the categories of the various attributes, the set of root causes of the fault is determined by performing a heuristic search on the fault search space.

[0005] In some exemplary embodiments, determining the category of each attribute in the fault search space includes: Based on the fault search space, determine the dependency between every two attributes in each attribute; Based on the dependency between each pair of attributes, an attribute category analysis graph is generated, wherein the number of nodes in the attribute category analysis graph is the same as the number of attributes in the fault search space, the nodes in the attribute category analysis graph are used to represent attributes, and the directed edges in the attribute category analysis graph are used to represent the dependency relationship between two attributes. Based on the attribute category analysis graph, one or more hierarchical chains are extracted, wherein the head nodes of the multiple hierarchical chains are different; The category of the attribute located on the hierarchical chain is determined as the first category, and the category of the attribute not located on the hierarchical chain is determined as the second category.

[0006] In some exemplary embodiments, generating an attribute category analysis graph based on the dependency between every two attributes includes: For every pair of attributes, when the dependency of the first attribute relative to the second attribute in every pair of attributes meets a preset condition, a directed edge from the first attribute to the second attribute is generated in the attribute category analysis graph. Alternatively, when the dependency of the second attribute relative to the first attribute in any pair of attributes meets a preset condition, a directed edge from the second attribute to the first attribute is generated in the attribute category analysis graph. Alternatively, when the dependency of the first attribute relative to the second attribute in any pair of attributes does not meet a preset condition, and the dependency of the second attribute relative to the first attribute does not meet a preset condition, then in the attribute category analysis graph, no directed edge from the first attribute to the second attribute is generated.

[0007] In some exemplary embodiments, the step of performing a heuristic search on the fault search space based on the categories of the various attributes to determine the set of fault root causes includes: Obtain the current set; wherein the current set is initialized as an empty set; Based on the category of each attribute, the hierarchical chain, and the fault search space, determine the target modification action corresponding to the current set; Perform the target modification action on the current set to obtain the modified set; When the modified set does not meet the preset exit condition, the modified set is taken as the new current set, the target modification action corresponding to the new current set is re-determined and executed until the obtained modified set meets the preset exit condition, and a heuristic search result is obtained. Based on the heuristic search results, the set of root causes of the failure is determined.

[0008] In some exemplary embodiments, the target modification action includes any one of: an addition action, a deletion action, a first replacement action, a second replacement action, and a third replacement action; wherein, The adding action is used to add a first tuple, which is a tuple in the fault search space that does not belong to the current set; The deletion action is used to delete the second tuple, which is a tuple in the current set; The first replacement action is used to replace the third tuple with the fourth tuple, wherein the third tuple is a tuple in the current set, and the fourth tuple is a tuple in the fault search space that does not belong to the current set; The second replacement action is used to replace the fifth tuple with the sixth tuple, wherein the fifth tuple is a tuple of attributes belonging to the first category in the current set, the category of the attributes in the sixth tuple is the first category, the attributes in the sixth tuple are the parent attributes of the attributes in the fifth tuple, and the sixth tuple is a tuple in the fault search space that does not belong to the current set. The third replacement action is used to replace the fifth tuple with the seventh tuple, wherein the category of the attribute in the seventh tuple is the first category, the attribute in the seventh tuple is the next level attribute of the attribute in the fifth tuple, and the seventh tuple is a tuple in the fault search space that does not belong to the current set.

[0009] In some exemplary embodiments, obtaining the fault search space includes: Obtain the cloud platform's operation logs; wherein, the operation logs include: multiple raw attributes, and each record in the operation logs includes: the attribute values ​​of the multiple raw attributes; The multiple original attributes are filtered to determine each attribute in the fault search space; The fault search space is determined based on the various attributes in the fault search space and the operation log.

[0010] This application provides a fault root cause localization device, the device comprising: An acquisition unit is used to acquire a fault search space; wherein, the fault search space includes: multiple tuples, each tuple including: an attribute and its corresponding attribute value; The first determining unit is used to determine the category of each attribute in the fault search space; wherein the category of each attribute includes: a first category and a second category, the first category is used to characterize an attribute that has a dependency relationship with one or more other attributes in the fault search space other than itself, and the second category is used to characterize an attribute that does not have a dependency relationship with any other attributes in the fault search space other than itself. The second determining unit is used to perform a heuristic search on the fault search space based on the categories of the various attributes to determine the set of fault root causes.

[0011] This application provides an electronic device, the electronic device comprising: Memory is used to store executable instructions or computer programs. When a processor executes computer-executable instructions or computer programs stored in the memory, it implements the fault root cause localization method provided in the embodiments of this application.

[0012] This application provides a computer-readable storage medium storing a computer program or computer-executable instructions. When the computer program or computer-executable instructions are executed by a processor, they implement the fault root cause localization method provided in this application.

[0013] This application provides a computer program product, including a computer program or computer executable instructions. When the computer program or computer executable instructions are executed by a processor, they implement the fault root cause localization method provided in this application.

[0014] The embodiments of this application have the following beneficial effects: This application provides a fault root cause localization method, apparatus, device, storage medium, and product. After obtaining the fault search space, the categories of each attribute in the fault search space can be determined. The categories of each attribute include: a first category and a second category. The first category is used to characterize attributes that have a dependency relationship with one or more other attributes in the fault search space besides themselves. The second category is used to characterize attributes that do not have a dependency relationship with any other attributes in the fault search space besides themselves. In this way, the attributes in the fault search space can be divided into the first category and the second category according to whether there is a dependency relationship between the attributes. Then, by introducing the categories of each attribute to guide the heuristic search process in the fault search space, the randomness in the heuristic search process can be reduced, and the heuristic search can be prevented from being too greedy and getting trapped in a local optimum. Therefore, the efficiency of fault root cause localization can be improved. Attached Figure Description

[0015] Figure 1 A flowchart illustrating a fault root cause localization method provided in an embodiment of this application; Figure 2 This is a schematic diagram illustrating the modification action performed in a fault root cause localization method provided in an embodiment of this application; Figure 3 This is a schematic diagram illustrating the application of a fault root cause localization method provided in an embodiment of this application; Figure 4This is a schematic diagram of the structure of a fault root cause localization device provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0017] In the description of this application, references are made to "some exemplary embodiments," which describe a subset of all possible embodiments. However, it is understood that "some exemplary embodiments" may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0018] In the description of this application, the terms "first," "second," etc., are used merely to distinguish similar objects and do not represent a specific order of objects, nor should they be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. It is understood that "first" and "second" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in a sequence other than that illustrated or described herein.

[0019] In the description of this application, "multiple" means two or more. Terms such as "one or more," "one or more items," or "one or more items" indicate any one, any two, or more than two of a plurality. For example, including one or more of A, B, and C can mean including any one, any two, or more elements selected from the set consisting of A, B, and C.

[0020] In the description of this application, the terms "module," "unit," or "component" refer to a computer program or part of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of a larger module or unit that includes the functionality of that module or unit.

[0021] Unless otherwise defined, all technical and scientific terms used in the embodiments of this application have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in the embodiments of this application is for the purpose of describing the embodiments of this application only and is not intended to limit this application.

[0022] In the implementation of this application, the collection and processing of relevant data should strictly comply with the requirements of relevant laws and regulations, obtain the informed consent or separate consent of the personal information subject, and carry out subsequent data use and processing within the scope of laws and regulations and the authorization of the personal information subject.

[0023] The technical solution of this application embodiment is implemented based on a heuristic search algorithm. For ease of understanding, the heuristic search algorithm will be explained below.

[0024] The main idea of ​​a heuristic search algorithm is to start with a set of states and modify the current set with certain probabilities, searching for the answer set that maximizes the objective function value in the process. It typically consists of the following parts: an initial set, an optimal list, a current set, actions for the next transition, and an objective function for evaluation. The initial set is usually empty; that is, heuristic search usually starts with an empty set, adds a certain number of elements, and then randomly adds or removes more.

[0025] In cloud computing environments, as systems grow in scale and complexity, and as cloud platforms expand their capacity to meet increasing user demands, service outages and downtime become more frequent, impacting essential system-level services such as storage and network management. Given the interrelationships of these services, a single failure can trigger a wider range of problems. Therefore, after a failure occurs, it is crucial to promptly identify the root cause of the system malfunction (i.e., the cause of the failure) to implement appropriate isolation or recovery measures. The process of identifying the root cause is called root cause analysis (RCA) or root cause localization. To quickly identify and resolve failures, it is typically necessary to analyze large amounts of log data to determine the root cause.

[0026] A common approach is a full-set pruning search strategy. This involves constructing a hierarchical structure between attribute-value pairs and pruning nodes using specific criteria to narrow the search scope. Typical logs contain a large number of attributes with potentially wide value ranges; the number of attribute combinations alone is a power of 2, and the number of possible combinations after adding the corresponding values ​​is enormous. Therefore, attempting a large number of attribute values ​​during the search is extremely time-consuming. Pruning search covers the entire set of attribute-value pairs, which is computationally too complex for large datasets. Therefore, there is currently no effective solution to improving the efficiency of root cause analysis.

[0027] This application provides a method, apparatus, device, storage medium, and product for locating the root cause of a fault. After obtaining the fault search space, the category of each attribute in the fault search space can be determined. Then, by introducing the category of each attribute to guide the search process during the heuristic search of the fault search space, the randomness in the heuristic search process can be reduced, and the heuristic search can be prevented from being too greedy and getting trapped in a local optimum. Thus, the efficiency of fault root cause location can be improved.

[0028] In some exemplary embodiments, the fault root cause localization methods provided in the various embodiments of this application are applicable to various scenarios that require determining the root cause of a fault and detecting anomalies, such as cloud platforms and large-scale cloud systems. For example, a cloud platform can be a central cloud platform, an edge cloud platform, or a cloud platform that includes both a central cloud and an edge cloud.

[0029] In some exemplary embodiments, the executing entity of the fault root cause localization method provided in this application may be, but is not limited to, at least one of the cloud platform nodes such as management nodes, service nodes, and fault analysis nodes in the cloud platform. For example, a cloud platform node may be a server. In other exemplary embodiments, the executing entity of the fault root cause localization method provided in this application may also be the cloud platform system itself or an application (APP) running on these nodes.

[0030] Figure 1 This is a flowchart illustrating a fault root cause localization method provided in an embodiment of this application. The following will be combined with... Figure 1 This will be explained. For example, the entity executing this root cause localization method could be a cloud platform system. Figure 1 As shown, the root cause localization method may include: S101, Obtain the fault search space; wherein, the fault search space includes: multiple tuples, each tuple including: an attribute and its corresponding attribute value. Tuples in the fault search space can also be called attribute value pairs (AVPs).

[0031] For example, at least some of the attributes in the fault search space can have multiple attribute values.

[0032] In this context, each attribute in the fault search space is an attribute that may be related to the fault, and the fault search space is a set of multiple tuples corresponding to the attributes that may be related to the fault.

[0033] S102, determine the category of each attribute in the fault search space; wherein, the category of each attribute includes: a first category and a second category, the first category is used to characterize the attribute that has a dependency relationship with one or more other attributes in the fault search space other than itself, and the second category is used to characterize the attribute that does not have a dependency relationship with any other attributes in the fault search space other than itself. As an example, the number of attributes belonging to the first category can be multiple.

[0034] As an example, the number of attributes belonging to the second category in each attribute can be one or more.

[0035] As an example, the category of each attribute can be either the first category or the second category.

[0036] For example, consider the five attributes in the fault search space: Data Center (DC), Cluster, Node, Operating System Version (OSversion), and Application Programming Interface Version (APIversion). The values ​​of Data Center (DC), Cluster, and Node are dependent on each other. The parent attribute of Node can be Cluster, and the parent attribute of Cluster can be Data Center. Therefore, the categories of Data Center, Cluster, and Node can be the first category. The values ​​of Operating System Version and Application Programming Interface Version do not have a decisive relationship with the other three attributes. Therefore, the categories of Operating System Version and Application Programming Interface Version can be the second category.

[0037] S103. Based on the categories of each attribute, perform a heuristic search of the fault search space to determine the set of fault root causes.

[0038] The root cause set includes one or more tuples that indicate the root cause of the failure. Thus, the root cause set is a collection of specific combinations of elements that indicate the most likely cause of the failure.

[0039] For example, let's take the root cause set as {APIversion="V1", OSversion="V2"}. Here, APIversion represents an attribute "Application Programming Interface Version", and "V1" is a possible value of the attribute "Application Programming Interface Version". OSversion represents another attribute "Operating System Version", and "V2" is a possible value of the attribute "Operating System Version". By analyzing the root cause set, it is easy to determine in a timely manner whether a certain failure is caused by the incompatibility between the API version "V1" used by the user and the OS version "V2" of the cluster.

[0040] Thus, in this embodiment, after obtaining the fault search space, the categories of each attribute in the fault search space can be determined. The categories of each attribute include: a first category and a second category. The first category is used to characterize attributes that have a dependency relationship with one or more other attributes in the fault search space besides themselves. The second category is used to characterize attributes that do not have a dependency relationship with any other attributes in the fault search space besides themselves. In this way, the attributes in the fault search space can be divided into the first category and the second category according to whether there is a dependency relationship between the attributes. Then, by introducing the categories of each attribute to guide the search process during the heuristic search of the fault search space, the randomness in the heuristic search process can be reduced, and the heuristic search can be prevented from being too greedy and getting trapped in a local optimum. Therefore, the efficiency of fault root cause localization can be improved.

[0041] In some exemplary embodiments, S101, obtaining the fault search space includes: S1011, Obtain a multidimensional dataset, wherein the multidimensional dataset includes: multiple original attributes, and each record in the multidimensional dataset includes: the attribute value corresponding to each of the original attributes; S1012, by filtering attributes of the multidimensional dataset, the fault search space is determined.

[0042] Among them, attribute filtering refers to filtering attributes that may be related to the fault.

[0043] As an example, a cube could be a cloud platform's runtime logs, monitoring logs, issue logs, or server console logs.

[0044] As an example, in a cloud computing environment, cloud systems can use monitors to track their operational status and generate multi-dimensional operational logs to record information about the failure status and attributes of monitored objects, or their success status and attributes. Each operational log can contain multiple log entries (i.e., records) related to the monitored object. Each log entry is a line that records detailed information about the computing component, such as its operational status (e.g., timestamp, software version), environmental context (e.g., location, cluster, node), and component attributes (e.g., component version, component type). This information is called different "attributes." Each attribute can have multiple values ​​(also called attribute values), therefore, the same attribute may have different values ​​in different records.

[0045] In some exemplary embodiments, taking the cloud platform's operation logs as an example, S101, the fault search space is obtained, including: S1013, obtain the cloud platform's operation log; the operation log includes: multiple raw attributes, and each log entry in the operation log includes: the attribute values ​​of multiple raw attributes; S1014, Filter multiple raw attributes to determine each attribute in the fault search space; S1015. Determine the fault search space based on the various attributes in the fault search space and the running log.

[0046] As an example, the fault search space is a set of tuples related to key attributes among multiple primitive attributes. Here, key attributes are primitive attributes in the runtime logs that may be related to the fault. In practical applications, key attributes can be defined by those skilled in the art (such as engineers or researchers responsible for the corresponding scenario) based on the actual application scenario.

[0047] Thus, in this embodiment, by filtering the attributes of the runtime logs to determine the fault search space, some attributes that are not necessarily related to the system's failure can be excluded. This reduces the amount of data in the search space and improves the efficiency of root cause analysis. For ease of description, key attributes are not distinguished from attributes in this embodiment.

[0048] In some exemplary embodiments, S102, determining the category of each attribute in the fault search space includes: S1021, Based on the fault search space, determine the dependency between every two attributes in each attribute; S1022, Generate an attribute category analysis graph based on the dependency between every two attributes. The number of nodes in the attribute category analysis graph is the same as the number of attributes in the fault search space. The nodes in the attribute category analysis graph are used to represent attributes, and the directed edges in the attribute category analysis graph are used to represent the dependency between two attributes. S1023, Based on the attribute category analysis graph, extract one or more hierarchical chains, wherein the head nodes of the multiple hierarchical chains are different; S1024, determine the category of the attribute located on the hierarchical chain as the first category, and determine the category of the attribute not located on the hierarchical chain as the second category.

[0049] In the attribute category analysis graph, the connection from one node to another is unidirectional, and the line between two nodes is called a directed edge.

[0050] In some exemplary embodiments, S1021, based on the fault search space, determining the dependency between every two attributes, including: A1, based on the fault search space, determines the information entropy (also known as Shannon entropy) of each attribute in each attribute.

[0051] A2, based on the fault search space, determines the conditional entropy of every two attributes in each attribute.

[0052] The conditional entropy of each pair of attributes can include: the first conditional entropy of one attribute relative to the other attribute and the second conditional entropy of the other attribute relative to the first attribute.

[0053] A3. Based on the information entropy of each attribute and the conditional entropy of every two attributes, determine the dependency between every two attributes.

[0054] The dependency between any two attributes can include: the first dependency of one attribute relative to the other in each pair of attributes, and the second dependency of the other attribute relative to the first attribute in each pair of attributes.

[0055] As an example, the mathematical description of the fault search space is as follows: The set of all attributes in the fault search space (referred to as the attribute set) is defined as... .definition , Represents any two attributes in the attribute set, where, It is the xth attribute. It is the y-th attribute. , , Let n represent the number of attributes in the fault search space, where n is a positive integer greater than 1. For attributes... In other words, defining attributes The set of all possible values ​​is ,in, It is an attribute The i-th possible value, It is an attribute The number of all possible values, For attributes In other words, defining attributes The set of all possible values ​​is ,in, It is an attribute The j-th possible value, It is an attribute The number of all possible values, A tuple consists of an attribute and one of its possible values, where the attribute and its possible values ​​are tandem. A related arbitrary tuple is denoted as , and attributes A related arbitrary tuple is denoted as .

[0056] As an example, A1, based on the fault search space, determines the information entropy of each attribute, which may include: based on the fault search space, determining the information entropy of each attribute using equation (1). Here, the information entropy of an attribute is used to measure the degree of uncertainty of the attribute.

[0057] (1); in, Represents any attribute in the fault search space Information entropy, used to measure attributes The degree of uncertainty can be used to standardize the conditional entropy. Represents attributes The value is the j-th possible value. The probability of the attribute. The set of all possible values ​​of it is denoted as . ,in, It is an attribute The j-th possible value, It is an attribute The number of all possible values, When the attribute The value is the j-th possible value. When, recorded as .

[0058] For example, Attributes in the fault search space Satisfaction value The proportion of the number of tuples in the total number of tuples.

[0059] For example, taking the fault search space obtained from the runtime log as an example, You can add attributes to the runtime log. Satisfaction value The percentage of the number of items in a given category out of the total number of items.

[0060] As an example, A2, based on the fault search space, determines the conditional entropy of every two attributes in each attribute, which may include: using equation (2), based on the fault search space, determining the conditional entropy of every two attributes in each attribute.

[0061] (2); in, Represents attributes Relative to attributes Conditional entropy (i.e., used to measure the conditional entropy of an attribute) under the condition of attribute (degree of change) , Represents any two attributes in the attribute set. Represents attributes The i-th possible value, Represents attributes The j-th possible value, Represents attribute pairs The value is The probability is given by log, where log represents the logarithmic function.

[0062] As an example, the choice of the log function base can be arbitrary; for example, the log function base can be 2.

[0063] For example, Attribute pairs in the fault search space The satisfaction value The proportion of the number of tuples in the total number of tuples.

[0064] For example, taking the fault search space obtained from the runtime log as an example, Can be attribute pairs Satisfaction value The percentage of entries that are included out of all entries.

[0065] As an example, A3, based on the information entropy of each attribute in each attribute and the conditional entropy of each pair of attributes in each attribute, determines the dependency between each pair of attributes in each attribute, which may include: using Equation (3), based on the information entropy of each attribute in each attribute and the conditional entropy of each pair of attributes in each attribute, determines the dependency between each pair of attributes in each attribute.

[0066] (3); in, Represents attributes Relative to attributes Dependence, Represents attributes Relative to attributes conditional entropy, Represents attributes The entropy.

[0067] The value range of the `dep` function is [0, 1]. When the attribute... It is an attribute When using advanced attributes, attributes Relative to attributes The conditional entropy will be very low at this time. When the attribute With attributes When there is no necessary connection, then .

[0068] Thus, the dependency between the two attributes can be determined according to equations (1) to (3).

[0069] In practical applications, because the dependency relationship is unidirectional, for a single attribute pair, it needs to be calculated twice in the opposite direction. Through calculation and To determine an attribute pair The dependencies between them.

[0070] In some exemplary embodiments, S1022, an attribute category analysis graph is generated based on the dependency between every two attributes, including: For every pair of attributes, when the dependency of the first attribute relative to the second attribute in each pair of attributes meets a preset condition, a directed edge from the first attribute to the second attribute is generated in the attribute category analysis graph. Alternatively, when the dependency of the second attribute relative to the first attribute in any pair of attributes meets a preset condition, a directed edge from the second attribute to the first attribute is generated in the attribute category analysis graph. Alternatively, when the dependency of the first attribute relative to the second attribute in any pair of attributes does not meet the preset condition, and the dependency of the second attribute relative to the first attribute does not meet the preset condition, a directed edge from the first attribute to the second attribute is not generated in the attribute category analysis graph.

[0071] As an example, if the dependency of the first attribute relative to the second attribute in any pair of attributes meets a preset condition, it can mean that the dependency of the first attribute relative to the second attribute is greater than a preset threshold. Conversely, if the dependency of the first attribute relative to the second attribute in any pair of attributes does not meet the preset condition, it can mean that the dependency of the first attribute relative to the second attribute is not greater than a preset threshold.

[0072] As an example, if we consider all attributes in the fault search space as nodes on an attribute category analysis graph, for any attribute pair... For example, as shown in equation (4), when the attribute Relative to attributes Dependence When the value exceeds a preset threshold, determine the attribute. It is an attribute Advanced properties, and create a sub-property To attribute A one-way edge.

[0073] (4); in, Represents attributes Relative to attributes Dependence, This indicates a preset threshold.

[0074] As an example, the preset threshold can be set by someone skilled in the art based on experience. For example, a preset threshold... It can be set to 0.9.

[0075] In some exemplary embodiments, S1023, extracting one or more hierarchical chains based on the attribute category analysis graph, may include: B1, based on the attribute category analysis graph, determine one or more head nodes; B2 uses a recursive algorithm to extract the hierarchical chain of each head node based on the attribute category analysis graph, resulting in one or more hierarchical chains.

[0076] In the attribute category analysis graph, if the node containing an attribute is the starting point of an edge, this attribute is defined as having a low-level attribute. The in-degree of an attribute is defined as the number of edges that reach the node containing it. The head node is the node containing an attribute in the graph that has a low-level attribute and an in-degree of 0. An attribute has a low-level attribute if the node containing the attribute is the starting point of any edge in the attribute category analysis graph, and an attribute has an in-degree of 0 if the number of directed edges that reach the node containing the attribute in the attribute category analysis graph is 0. That is, the head node is the node in the attribute category analysis graph that is the starting point of any directed edge but not the destination of all directed edges.

[0077] As an example, there may be multiple hierarchical dependencies among various properties of the fault search space; therefore, there may be multiple head nodes, and correspondingly, multiple hierarchical chains. The head nodes of these multiple hierarchical chains are different.

[0078] In this context, the hierarchical chain of each head node refers to the longest chain extending from that head node. This ensures that the hierarchical dependencies between attributes are as tight as possible, thereby improving the efficiency of heuristic search.

[0079] In a hierarchical chain, when a first attribute points to a second attribute, the next-level attribute of the first attribute is called the second attribute, and the parent attribute of the second attribute is called the first attribute. For example, with any attribute... For example, when the attribute Relative to attributes Dependence When the value exceeds a preset threshold, a subordinate attribute is created in the attribute category analysis graph. Pointing property In a hierarchical chain, an edge is called an attribute. The next level of attribute is the property. .

[0080] In a hierarchical chain, the head node has the highest level and the tail node has the lowest level. A hierarchical chain represents a chain-like hierarchical dependency relationship between attributes, used to characterize the dependencies between attributes. From the head node to the tail node, the scope of the attribute coverage decreases and the level decreases.

[0081] Thus, after extracting the hierarchical chains based on the attribute category analysis diagram, attributes located on the hierarchical chains can be called "hierarchical attributes," meaning the category of attributes located on the hierarchical chains is determined as the first category. Furthermore, attributes not belonging to any hierarchical chain are called "independent attributes," meaning the category of attributes not located on any hierarchical chain is determined as the second category. This achieves the determination of the categories of each attribute in the fault search space. The categories of each attribute include: the first category and the second category. The first category represents attributes that have a dependency relationship with one or more other attributes in the fault search space besides themselves, and the second category represents attributes that do not have a dependency relationship with any other attributes in the fault search space besides themselves.

[0082] In some exemplary embodiments, S103, based on the categories of various attributes, a heuristic search is performed on the fault search space to determine the set of fault root causes, including: S1031, Get the current set; The initial set is an empty set.

[0083] S1032, Based on the category, hierarchical chain, and fault search space of each attribute, determine the target modification action corresponding to the current set; Among them, the target modification action is used to add tuples to the current set, delete tuples in the current set, or replace tuples in the current set.

[0084] S1033, Perform the target modification action on the current set to obtain the modified set; S1034, when the modified set does not meet the preset exit condition, the modified set is taken as the new current set, the target modification action corresponding to the new current set is re-determined and executed until the obtained modified set meets the preset exit condition, and the heuristic search results are obtained. For example, the redefined target modification action differs from the previous modification action. In each iteration of the loop, a modification action is performed on the current set until the modified set meets the preset conditions, at which point the loop exits.

[0085] S1035, Based on heuristic search results, determine the set of root causes of the failure.

[0086] Thus, in this embodiment of the application, the efficiency and accuracy of fault diagnosis can be improved, and efficient and high-quality root cause search can be achieved while ensuring a balance between time and accuracy.

[0087] In some exemplary embodiments, the target modification action includes any one of: an addition action, a deletion action, a first replacement action, a second replacement action, and a third replacement action; wherein, The add action is used to add the first tuple, which is a tuple in the fault search space that does not belong to the current set; The delete action is used to delete the second tuple, which is a tuple in the current set. The first replacement action is used to replace the third tuple with the fourth tuple, where the third tuple is a tuple in the current set and the fourth tuple is a tuple in the fault search space that does not belong to the current set. The second replacement action is used to replace the fifth tuple with the sixth tuple. The fifth tuple is a tuple of attributes belonging to the first category in the current set. The attributes in the sixth tuple belong to the first category. The attributes in the sixth tuple are the parent attributes of the attributes in the fifth tuple. The sixth tuple is a tuple in the fault search space that does not belong to the current set. The third replacement action is used to replace the fifth tuple with the seventh tuple. The attributes in the seventh tuple belong to the first category, the attributes in the seventh tuple are the next level attributes of the attributes in the fifth tuple, and the seventh tuple is a tuple in the fault search space that does not belong to the current set.

[0088] Here, the second and third substitution actions are used to change the level of the set in the hierarchy chain.

[0089] For example, the attribute corresponding to the first tuple is different from the attribute corresponding to any tuple in the current set.

[0090] Thus, in this embodiment, since the attributes of the second category (i.e., independent attributes) are not on any hierarchical chain and have no high-level or low-level attributes, the possible modification actions for the attributes of the second category (i.e., independent attributes) include: adding, deleting, and first replacing actions. Since the attributes of the first category (i.e., hierarchical attributes) can undergo not only regular adding, deleting, and modifying actions, but can also be transformed into adjacent attributes on their own hierarchical chain, the possible modification actions for the attributes of the first category (also called hierarchical attributes) include: adding, deleting, first replacing, second replacing, and third replacing actions. This improves the accuracy of selecting the search path corresponding to the true root cause set.

[0091] For example, the add action (denoted as ADD): is used to add an attribute to the current collection. The corresponding tuple , where tuple It does not belong to the current collection before it was added. For example, the attribute. It does not belong to the current collection before it was added.

[0092] For example, the delete action (denoted as DEL): is used to delete the attribute in the current collection. The corresponding tuple .

[0093] For example, the first replacement action (denoted as REPLACE): is used to select the attribute in the current collection. The corresponding tuple Replace it with attribute The corresponding other tuple ,in, tuple It is a tuple within the fault search space that does not belong to the current set before the replacement.

[0094] For example, the second replacement action (denoted as UP) is used to select a first-type attribute (i.e., a hierarchical attribute) in the current collection. The corresponding tuple Replace it with another first-type property (i.e., a hierarchical property). The corresponding tuple In the hierarchy, attributes It is an attribute The parent attribute of a tuple; It is a tuple within the fault search space that does not belong to the current set before the replacement.

[0095] For example, the third replacement action (denoted as DOWN) is used to select a first-type attribute (i.e., a hierarchical attribute) in the current collection. The corresponding tuple Replace it with another first-type property (i.e., a hierarchical property). The corresponding tuple In the hierarchy, attributes It is an attribute The next level attribute, tuple It is a tuple within the fault search space that does not belong to the current set before the replacement.

[0096] For example, for attributes with hierarchical dependencies, if a set already contains an attribute of the first category (i.e., a hierarchical attribute), then other attributes on the same hierarchical chain do not need to be added to the set. For instance, ("Data Center", DC1) contains a lower-level attribute value ("Cluster", "PrdC01"). If ("Cluster", "PrdC01") already exists in the set, then ("Data Center", DC1) is no longer needed, because only one attribute on the same chain is required for location. Therefore, when using the ADD action, it can be ensured that at most one attribute on each hierarchical chain is in the current set.

[0097] For example, Figure 2This is a schematic diagram illustrating the modification action performed in a fault root cause localization method provided in an embodiment of this application. Figure 2 This example demonstrates a simplified version of some steps in a search process. For instance... Figure 2 As shown, Figure 2 The example uses five attributes: Data Center (DC), Cluster, Node, Operating System Version (OSversion), and Application Version (API). The example demonstrates a hierarchical dependency between the three attributes: DC, Cluster, and Node. These belong to the first category of attributes (hierarchical attributes) and are represented as a top-down, high-level chain. The next level attribute for DC is Cluster, and the next level attribute for Cluster is Node. The other two attributes, OSversion and API, belong to the second category (independent attributes) and have no determining relationship with the other attributes. They are represented as two independent nodes. Figure 2 As shown, Figure 2 In the current search set, attributes are indicated by non-white fill, and different values ​​of the same attribute are indicated by different fill patterns. Figure 2 The example demonstrates the sequence of modification actions performed in the following order: Add action (e.g., ADD), Add action (e.g., ADD), Third replacement action (e.g., DOWN), First replacement action (e.g., REPLACE), and Second replacement action (e.g., UP). Figure 2 As shown, the two types of attributes change differently. Attributes in the second category (i.e., independent attributes) can be added individually (e.g., illustrated as ADD) or deleted (not shown). However, for attributes in the first category (i.e., hierarchical attributes), all attributes on each hierarchical chain are treated as a single entity. During the entire search process, at most one attribute on a hierarchical chain can be selected. Other attributes cannot be added to the hierarchical chain until that attribute is deleted. Other available change methods are the second replacement action (UP) and the third replacement action (DOWN), which require positioning the set at the appropriate level. The scope of entries covered by higher-level attributes and lower-level attributes differs. These two actions are equivalent to continuously "sliding" along the hierarchical chain, trying to find a suitable coverage range, and combining it with other independent attributes to form the currently searched set.

[0098] In some exemplary embodiments, when the target modification action is an addition action, a first replacement action, a second replacement action, or a third replacement action, a target tuple needs to be selected for addition or replacement. To improve search efficiency, in step S1032, based on the category, hierarchical chain, and fault search space of each attribute, the target modification action corresponding to the current set is determined, including: Based on the current set, determine the target modification action; Based on the target modification action, a candidate set corresponding to the target modification action is determined from the fault search space; wherein, the candidate set includes: multiple candidate tuples; Based on the pre-constructed tuple weight list corresponding to the fault search space, a candidate tuple weight list corresponding to the candidate set is determined; wherein, the pre-constructed tuple weight list includes: the weight values ​​of all tuples in the fault search space, and the candidate tuple weight list corresponding to the candidate set includes: the weight values ​​of multiple candidate tuples in the candidate set. Based on the weight values ​​of multiple candidate tuples, the target tuple corresponding to the target modification action is determined from the candidate set.

[0099] Specifically, determining the target tuple corresponding to the target modification action includes: when the target modification action is an add action, the candidate set can be a set of tuples in the fault search space that do not belong to the current set, and the target tuple is the first tuple. Alternatively, when the action type is a first replacement action, the candidate set can be a set of tuples in the fault search space that do not belong to the current set, and the target tuple is the fourth tuple. Alternatively, when the action type is a second replacement action, the candidate set can be a set of tuples in the fault search space that do not belong to the current set and whose attribute is the next-level attribute of the attribute in the fifth tuple, and the target tuple is the sixth tuple. Alternatively, when the action type is a third replacement action, the candidate set can be a set of tuples in the fault search space that do not belong to the current set and whose attribute is the next-level attribute of the attribute in the fifth tuple.

[0100] Therefore, compared to random selection with equal probability, selecting tuples to be added or replaced using a weighted list can significantly improve search efficiency.

[0101] As an example, an attribute and one possible value form a tuple. An attribute can correspond to multiple possible values, thus an attribute can correspond to multiple tuples. For the same attribute, different values ​​have differences; that is, some tuples associated with an attribute may have lower relevance to failures (i.e., some tuples have lower failure rates), while other tuples may have higher relevance (i.e., other tuples have higher failure rates). If a set of tuples (attribute-value pairs, AVPs) records a higher proportion of failures in the logs, then that set of tuples (attribute-value pairs, AVPs) is more likely to be the root cause set indicating the failure. Therefore, tuples can be used. The degree of failure of association of all associated entries is used to measure the tuple. The selection value of tuples The degree of failure of all associated entries, as a tuple. The weight values. Thus, based on the tuples The weight value is used to select the tuple to be added or replaced.

[0102] In some exemplary embodiments, tuples are determined by equation (5). The weight value of the tuple. The weight value is used to measure the tuple The selection value, characterizing tuples The degree of failure of all associated entries. Indicates the form of A tuple.

[0103] (5); in, Represents tuples The weight values ​​(i.e., tuples) (the degree of failure of all associated entries). Represents tuples The number of failures for all associated entries. Represents tuples The number of successes for all associated entries.

[0104] Thus, when a target modification action, such as an add action (ADD) or a first replacement action (REPLACE), requires selecting a new tuple, a candidate tuple weight list of equal length to the candidate range of the candidate set can be constructed. Each item in the candidate tuple weight list has a weight value equal to the corresponding tuple's failure correlation score, and the probability of selecting a tuple is proportional to the relative magnitude of all weight values ​​in the candidate tuple weight list. If a tuple is an element of a valid root cause set, then its corresponding entries should have more failures, so the failure correlation scores of all its associated entries will be relatively higher, and therefore its weight values ​​will also be relatively higher, making it more likely to be selected in the weight list. Furthermore, if all entries corresponding to a tuple have no failure records, i.e., the failure correlation score is 0, then the weight value of that tuple is also 0, indicating that the tuple will not be selected to be added to the current search set.

[0105] In some exemplary embodiments, determining the target modification action based on the current set may include: generating an action weight list based on the current set and the categories of attributes in the current set; and using the action weight list as a probability to select an action from the candidate actions as the target modification action. Specifically, when constructing the action weight list, for attributes of the second category (i.e., independent attributes), the corresponding action weight list only contains three candidate actions: add action, delete action, and first replacement action. For attributes of the first category (i.e., hierarchical attributes), the corresponding action weight list includes five candidate actions: add action, delete action, first replacement action, second replacement action, and third replacement action.

[0106] For example, when constructing an action weight list, if a set is a root cause set, then the objective function values ​​corresponding to all its relevant entries should be relatively similar, because the faults should be relatively evenly distributed under the tuples corresponding to that set. The JS divergence of the objective function values ​​corresponding to the entries in this set can be calculated; this metric measures the dissimilarity of the fault distribution. If the dissimilarity is less than a threshold, it is considered that a suitable level has been found, and it is unnecessary to continue further. At this point, the probability of DOWN actions in the action weight list is set to 0. The Jensen-Shannon divergence, often abbreviated as JS divergence, is symmetric, and its value is between 0 and 1; the smaller the value, the more similar the distribution.

[0107] In some exemplary embodiments, after performing a target modification action on the current set to generate a modified set, a validity check is performed on the modified set. If the validity check passes, the modified set is used as the new current set, and the loop continues. Otherwise, the modified set reverts to the set before this target modification action, a new target action is selected, and a new modified set is generated. Thus, by setting a validity check, the system can be guided to discover more new unknown sets, preventing the heuristic search process from frequently getting stuck in loops with certain sets, avoiding repetitive search processes, and saving considerable time, thereby increasing the effectiveness of the search.

[0108] As an example, if the modified set has not been accessed recently, it can be determined that the modified set is valid and passes the validity check. For instance, if the modified set is different from a set in the taboo list, it is determined that the modified set has not been accessed recently. Thus, in this embodiment, a taboo list can be maintained to record recently accessed sets. Each time a new set (i.e., the modified set) is generated, it can only continue the loop if it has not been accessed recently; otherwise, the set is rolled back to the set before this action, a new action is selected for updating, and the taboo list is refreshed. In this way, by setting a taboo list, the system can be guided to discover more new unknown sets, preventing the heuristic search process from frequently getting stuck in loops of certain sets. This avoids the possibility that some sets may be accessed more than once during repeated modification actions, avoids repetition of the search process, avoids wasting a lot of time, and thus increases the effectiveness of the search.

[0109] As an example, if the modified set has not been accessed recently and its objective function value is sufficiently high, the modified set can be determined to pass the validity check. For instance, if the objective function value of the modified set is not less than a preset validity threshold, the objective function value of the modified set is determined to be sufficiently high.

[0110] In some exemplary embodiments, in S1034, the modified set not satisfying the preset exit condition may mean that the objective function value of the modified set has increased compared to the objective function value of the current set, i.e., the objective function value of the modified set is greater than the objective function value of the current set before modification. Correspondingly, the modified set satisfying the preset exit condition may mean that the objective function value of the modified set has not increased compared to the objective function value of the current set, i.e., the objective function value of the modified set is not greater than the objective function value of the current set before modification. Therefore, the heuristic search result may include: the modified set and its corresponding objective function value. For example, the heuristic search result may include multiple modified sets and their respective corresponding objective function values.

[0111] In some exemplary embodiments, the objective function value can be calculated using a preset objective function. The preset objective function is used to evaluate the value of a set; the larger the objective function value, the more likely the set is to be the root cause set. The objective function can be selected according to the actual application scenario.

[0112] As an example, the preset objective function can be the evaluation function F-score(F) created based on Precision(P) and Recall(R), as shown in Equation (6). Then, the heuristic search result with the largest evaluation value (i.e., the heuristic search result with the highest objective function value) is the set of root causes of the fault. Then, using the modified set as the set to be evaluated, the objective function value of the modified set can be calculated using Equation (6). When the objective function value of the modified set is equal to the objective function value of the current set before modification, the current round of heuristic search process can be exited, and the modified set and its corresponding objective function value can be used as the heuristic search result of a round.

[0113] (6); in, This represents the evaluation value of the set of tuples to be evaluated, where r represents the set of tuples to be evaluated. This represents all entries in the runtime log whose tuples are the same as those in the set of tuples to be evaluated, r. In other words, it represents all entries in the runtime log whose attribute values ​​are the same as those in the set r to be evaluated (in particular, if an attribute is not in r, it can take any value). express Total number of failures and The ratio of the total number of times (i.e.) (failure rate) express The ratio of the total number of failures to the total number of failures for all entries in the runtime log. The total number of times is Total number of failures and The sum of the total number of successful attempts.

[0114] Here, P measures the failure rate of the entries contained in a set of tuples, and R measures the range of failure instances that the set of tuples covers as many as possible. The objective function takes both aspects into account and effectively measures the relevance of the AVP set to failures. The higher the objective function value of the heuristic search results, the greater the likelihood that it is a root cause set, and the higher its value.

[0115] As an example, in each entry of the runtime log, one indicator used to distinguish between failures and non-failures is the "success / failure value." Each log entry includes a success value and a failure value, representing the number of times the system succeeded or failed under that attribute value. This means that an entry actually represents a series of instances with the same attribute value. If each log entry records a single instance, instances with the same attribute value can be merged, resulting in several entries represented by the success / failure value. This helps in quickly determining the objective function value.

[0116] In some exemplary embodiments, the heuristic search results include: multiple modified sets and their respective corresponding objective function values. Then, in step S1035, determining the set of root causes of the fault based on the heuristic search results may include: C1 uses multiple modified sets as multiple candidate sets, and uses the objective function values ​​of multiple modified sets as the objective function values ​​of multiple candidate sets, comparing the magnitudes of the objective function values ​​of multiple candidate sets; C2, based on the comparison results, determines the set of root causes of the failure from multiple candidate sets.

[0117] In some exemplary embodiments, C2 determines a set of root causes of the fault from a plurality of candidate sets based on the comparison results, including: When the number of maximum objective function values ​​in the comparison results is one, the candidate set with the maximum objective function value among multiple candidate sets is determined as the root cause set of the fault.

[0118] In some other exemplary embodiments, C2 determines a set of root causes of the failure from a plurality of candidate sets based on the comparison results, including: When there are multiple maximum objective function values ​​in the comparison results, determine the number of tuples covered in the fault search space for each tuple in the candidate set of multiple maximum objective function values, and obtain the coverage number corresponding to the candidate set of multiple maximum objective function values; determine the candidate set with the smallest coverage number among the candidate sets of multiple maximum objective function values ​​as the root cause set of the fault.

[0119] Alternatively, when there are multiple maximum objective function values ​​in the comparison results, determine the number of records covered by all tuples in the candidate sets of multiple maximum objective function values ​​in the corresponding multidimensional dataset of the fault search space, and obtain the coverage number corresponding to the candidate sets of multiple maximum objective function values; determine the candidate set with the smallest coverage number among the candidate sets of multiple maximum objective function values ​​as the root cause set of the fault.

[0120] Alternatively, when there are multiple maximum objective function values ​​in the comparison results, determine the number of log entries covered by all tuples in the candidate sets of multiple maximum objective function values ​​in the cloud platform's operation log corresponding to the fault search space, and obtain the coverage number corresponding to the candidate sets of multiple maximum objective function values; determine the candidate set with the smallest coverage number among the candidate sets of multiple maximum objective function values ​​as the root cause set of the fault.

[0121] In this way, when multiple candidate sets have the same maximum objective function value, the set with the more specific location range, i.e. the set with the fewest coverage, can be selected as the final root cause set, which can help users quickly determine the root cause of the fault.

[0122] For ease of understanding, the fault root cause localization method in the embodiments of this application will be described below with reference to exemplary application examples.

[0123] Figure 3 This is a schematic diagram illustrating the application of a fault root cause localization method provided in an embodiment of this application, such as... Figure 3 As shown, an application embodiment of this fault root cause localization method may include three parts: the first part, problem coding, Figure 3 The diagram illustrates the search space derived from the logs, and shows that the search space includes multiple tuples (AVP). The second part, hierarchical analysis, Figure 3 The diagram illustrates the attribute sets formed by the various attributes in the search space, and shows the attributes of the first category on the hierarchical chain obtained based on the attribute sets, as well as the attributes of the second category not on the hierarchical chain. Part Three: Heuristic Search. Figure 3 The diagram illustrates the process of obtaining the root cause set through heuristic search based on categories of various attributes, and shows that the modification actions used in the heuristic search can include: add action (denoted as ADD), delete action (denoted as DEL), first replacement action (denoted as REPLACE), second replacement action (denoted as UP), and third replacement action (denoted as DOWN).

[0124] As an example, the first part, problem coding, may include the following steps: D1, obtain the cloud platform's operation logs; the operation logs include multiple attributes, and each log entry in the operation logs includes the attribute values ​​of multiple attributes.

[0125] D2 filters multiple attributes in the operation log to determine each attribute in the fault search space; where each attribute in the fault search space is a key attribute in the operation log that may be related to the fault.

[0126] D3. Based on the various attributes in the fault search space and the runtime log, the fault search space is determined. The fault search space is a set of tuples (AVPs) related to the key attributes among multiple original attributes.

[0127] In practical applications, key attributes can be set by those skilled in the art (such as engineers or researchers responsible for the relevant scenario) based on the actual application scenario. In this way, some attributes that are not necessarily related to the system's operating state can be excluded.

[0128] As an example, the second part, hierarchical analysis, may include the following steps: E1, based on the fault search space, determines the information entropy of each attribute in each attribute using Equation (1). The information entropy of an attribute is used to measure the degree of uncertainty of that attribute.

[0129] E2, through equation (2), determines the conditional entropy of every two attributes in each attribute based on the fault search space.

[0130] The conditional entropy of each pair of attributes can include: the first conditional entropy of one attribute relative to the other attribute and the second conditional entropy of the other attribute relative to the first attribute.

[0131] E3, using Equation (3), determines the dependency between each pair of attributes based on the information entropy of each attribute and the conditional entropy of each pair of attributes.

[0132] Since dependency is a unidirectional relationship, the degree of dependency between any two attributes can include: the first dependency of one attribute relative to the other and the second dependency of the other attribute relative to the first attribute.

[0133] E4. Based on the dependency between every two attributes, an attribute category analysis graph is generated. The number of nodes in the attribute category analysis graph is the same as the number of attributes in the fault search space. The nodes in the attribute category analysis graph are used to represent attributes, and the directed edges in the attribute category analysis graph are used to represent the dependency between two attributes. Here, all attributes in the fault search space are considered as nodes on an attribute category analysis graph. For every pair of attributes, if the dependency of the first attribute relative to the second attribute is greater than a preset threshold, a directed edge from the first attribute to the second attribute is generated in the attribute category analysis graph; or, if the dependency of the second attribute relative to the first attribute is greater than a preset threshold, a directed edge from the second attribute to the first attribute is generated in the attribute category analysis graph. After analyzing the dependencies between all pairs of attributes, a simplified relationship graph can be established, in which all attributes with hierarchical dependencies are connected by corresponding unidirectional edges.

[0134] For example, for any attribute pair In other words, when the attribute Relative to attributes Dependence When the value exceeds a preset threshold, determine the attribute. It is an attribute Advanced properties, and create a sub-property To attribute The unidirectional edge. The preset threshold can be set by those skilled in the art based on experience; for example, a preset threshold... It can be set to 0.9.

[0135] E5. Based on the attribute category analysis graph, determine one or more head nodes. A head node is a node in the graph containing an attribute with a low-level attribute and an in-degree of 0. An attribute having a low-level attribute means that the node containing the attribute is the starting point of any edge in the attribute category analysis graph. An attribute with an in-degree of 0 means that there are 0 directed edges in the attribute category analysis graph that reach the node containing the attribute. In other words, a head node is a node in the attribute category analysis graph that is the starting point of any directed edge but not the destination of all directed edges.

[0136] E6 uses a recursive algorithm based on the attribute category analysis graph to extract the hierarchical chain of each head node, resulting in one or more hierarchical chains. The hierarchical chain of each head node refers to the longest chain among all chains derived from that head node.

[0137] E7 defines the category of attributes located on the hierarchical chain as the first category and the category of attributes not located on the hierarchical chain as the second category.

[0138] In this heuristic search, the search starts with an empty set and uses a loop to continuously modify the current set until an exit condition is met. Each iteration of the loop represents applying a modification action to the current set.

[0139] As an example, the third part, heuristic search, may include the following steps: F1, the search starts from an empty set and returns the current set; F2 generates an action weight list based on the current set and the categories of each attribute, and uses the action weight list as a probability to select an action from the candidate actions as the target modification action.

[0140] For example, when constructing the action weight list, for attributes of the second category (i.e., independent attributes), the corresponding action weight list only has three candidate actions: add action, delete action, and first replacement action. However, for attributes of the first category (i.e., hierarchical attributes), the corresponding action weight list includes five candidate actions: add action, delete action, first replacement action, second replacement action, and third replacement action.

[0141] For example, when the target modification action is an add action (ADD) or a first replacement action (REPLACE), a new tuple needs to be selected. Therefore, based on the target modification action, a candidate set corresponding to the target modification action can be determined from the fault search space. This candidate set includes multiple candidate tuples. A weight list of candidate tuples corresponding to the candidate set is constructed, including the weight values ​​of multiple candidate tuples in the candidate set. Each candidate tuple is determined using equation (5). The weight values ​​are used to determine the target tuple corresponding to the target modification action from the candidate set.

[0142] F3 performs the target modification action on the current set and obtains the modified set; F4 performs a validity check on the modified set. If the validity check passes, the modified set is used as the new current set, and the loop continues. Otherwise, the modified set is reverted to the set before the target modification action, a new target is selected, the action is executed, and a new modified set is generated.

[0143] For example, if the modified set has not been recently visited and its objective function value is sufficiently high, the modified set can be determined to be valid and pass the validity check. Similarly, if the modified set differs from sets in the tabu list, it can be determined that the modified set has not been recently visited. The tabu list records recently visited sets. Thus, by setting validity checks, the system can be guided to discover more new unknown sets, preventing the heuristic search process from frequently getting stuck in loops with certain sets, avoiding repetitive search processes, and minimizing wasted time, thereby increasing the effectiveness of the search.

[0144] F5: When the modified set does not meet the preset exit conditions, the modified set is taken as the new current set. The target modification action corresponding to the new current set is redefined and executed until the modified set meets the preset exit conditions, and the heuristic search results are obtained.

[0145] The modified set not meeting the preset exit condition can mean that the objective function value of the modified set has increased compared to the objective function value of the current set, i.e., the objective function value of the modified set is greater than the objective function value of the current set before modification. Correspondingly, the modified set meeting the preset exit condition can mean that the objective function value of the modified set has not increased compared to the objective function value of the current set, i.e., the objective function value of the modified set is not greater than the objective function value of the current set before modification. Therefore, the heuristic search results can include: the modified set and its corresponding objective function value. The objective function value can be calculated using a preset objective function. The preset objective function can be the evaluation function F-score(F) created based on Precision(P) and Recall(R), as shown in equation (6).

[0146] For example, heuristic search results may include multiple modified sets and their respective objective function values.

[0147] F6, the heuristic search results include: multiple modified sets and their corresponding objective function values, multiple modified sets as multiple candidate sets, objective function values ​​of multiple modified sets as objective function values ​​of multiple candidate sets, and comparison of the objective function values ​​of multiple candidate sets; F7. When there are multiple maximum objective function values ​​in the comparison results, determine the number of log entries covered by all tuples in the candidate sets of multiple maximum objective function values ​​in the cloud platform's operation log corresponding to the fault search space, and obtain the coverage number corresponding to the candidate sets of multiple maximum objective function values; determine the candidate set with the smallest coverage number among the candidate sets of multiple maximum objective function values ​​as the root cause set of the fault. F8: When the number of the largest objective function values ​​in the comparison results is one, the candidate set with the largest objective function value among multiple candidate sets is determined as the root cause set of the fault.

[0148] Thus, in this embodiment, by dividing the attribute categories into a first category with hierarchical dependencies and a second category without dependencies, the introduction of attribute categories into the heuristic search process optimizes the process, reduces randomness, and prevents the heuristic search from becoming too greedy and getting trapped in local optima, thereby improving the efficiency of root cause localization. Furthermore, in the process of introducing attribute categories into the heuristic search, since the attributes of the second category (i.e., independent attributes) are not on any hierarchical chain and have no high-level or low-level attributes, the possible modification actions for the attributes of the second category (i.e., independent attributes) include: adding, deleting, and first replacement. Since the attributes of the first category (i.e., hierarchical attributes) can undergo not only regular addition, deletion, and modification actions but also change to adjacent attributes on their own hierarchical chain, the possible modification actions for the attributes of the first category (also called hierarchical attributes) include: adding, deleting, first replacement, second replacement, and third replacement. This allows the attributes of the first category to change according to the spatial structure of the chain, improving search efficiency and significantly reducing redundancy within the set. Furthermore, by filtering the attributes of the runtime logs, the attribute combinations in the fault search space can be restricted, greatly reducing the search range and improving algorithm efficiency. Therefore, the fault root cause localization method in this embodiment can improve the efficiency and accuracy of fault diagnosis, achieving high-quality fault root cause search while ensuring a balance between time and accuracy.

[0149] Embodiments of this application provide a fault root cause location device. Figure 4 This is a schematic diagram of the structure of a fault root cause localization device provided in an embodiment of this application, as shown below. Figure 4 As shown, the fault root cause location device may include: The acquisition unit 401 is used to acquire the fault search space; wherein, the fault search space includes: multiple tuples, each tuple including: an attribute and its corresponding attribute value; The first determining unit 402 is used to determine the category of each attribute in the fault search space; wherein, the category of each attribute includes: a first category and a second category, the first category is used to characterize an attribute that has a dependency relationship with one or more other attributes in the fault search space other than itself, and the second category is used to characterize an attribute that does not have a dependency relationship with any other attributes in the fault search space other than itself. The second determining unit 403 is used to perform a heuristic search of the fault search space based on the categories of each attribute to determine the set of fault root causes.

[0150] In some exemplary embodiments, the first determining unit 402 is configured to: determine the dependency between every two attributes in each attribute based on the fault search space; generate an attribute category analysis graph based on the dependency between every two attributes, wherein the number of nodes in the attribute category analysis graph is the same as the number of attributes in the fault search space, the nodes in the attribute category analysis graph are used to represent attributes, and the directed edges in the attribute category analysis graph are used to represent the dependency relationship between two attributes; extract one or more hierarchical chains based on the attribute category analysis graph, wherein the head nodes of the multiple hierarchical chains are different; determine the category of the attribute located on the hierarchical chain in each attribute as a first category, and determine the category of the attribute not located on the hierarchical chain in each attribute as a second category.

[0151] In some exemplary embodiments, the first determining unit 402 is configured to, for every two attributes, when the dependency of the first attribute relative to the second attribute in every two attributes meets a preset condition, generate a directed edge from the first attribute to the second attribute in the attribute category analysis graph. Alternatively, when the dependency of the second attribute relative to the first attribute in any pair of attributes meets a preset condition, a directed edge from the second attribute to the first attribute is generated in the attribute category analysis graph. Alternatively, when the dependency of the first attribute relative to the second attribute in any pair of attributes does not meet the preset condition, and the dependency of the second attribute relative to the first attribute does not meet the preset condition, a directed edge from the first attribute to the second attribute is not generated in the attribute category analysis graph.

[0152] In some exemplary embodiments, the second determining unit 403 is used to obtain the current set; wherein the current set is initialized as an empty set; Based on the category, hierarchical chain, and fault search space of each attribute, determine the target modification action corresponding to the current set; Perform the target modification action on the current set to obtain the modified set; When the modified set does not meet the preset exit condition, the modified set is taken as the new current set, the target modification action corresponding to the new current set is redefined and executed until the modified set meets the preset exit condition, and the heuristic search results are obtained. Based on heuristic search results, determine the set of root causes of the failure.

[0153] In some exemplary embodiments, the target modification action includes any one of: an addition action, a deletion action, a first replacement action, a second replacement action, and a third replacement action; wherein, The add action is used to add the first tuple, which is a tuple in the fault search space that does not belong to the current set; The delete action is used to delete the second tuple, which is a tuple in the current set. The first replacement action is used to replace the third tuple with the fourth tuple, where the third tuple is a tuple in the current set and the fourth tuple is a tuple in the fault search space that does not belong to the current set. The second replacement action is used to replace the fifth tuple with the sixth tuple. The fifth tuple is a tuple of attributes belonging to the first category in the current set. The attributes in the sixth tuple belong to the first category. The attributes in the sixth tuple are the parent attributes of the attributes in the fifth tuple. The sixth tuple is a tuple in the fault search space that does not belong to the current set. The third replacement action is used to replace the fifth tuple with the seventh tuple. The attributes in the seventh tuple belong to the first category, the attributes in the seventh tuple are the next level attributes of the attributes in the fifth tuple, and the seventh tuple is a tuple in the fault search space that does not belong to the current set.

[0154] In some exemplary embodiments, the obtaining unit 401 is used to obtain the operation log of the cloud platform; wherein the operation log includes: multiple raw attributes, and each record in the operation log includes: attribute values ​​of multiple raw attributes; the multiple raw attributes are filtered to determine each attribute in the fault search space; and the fault search space is determined based on each attribute in the fault search space and the operation log.

[0155] Embodiments of this application provide an electronic device that may include: Memory is used to store executable instructions or computer programs. When a processor executes computer-executable instructions or computer programs stored in memory, it implements one or more of the fault root cause localization methods provided in the embodiments of this application.

[0156] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. This electronic device can be applied to... Figure 1 In a corresponding embodiment, a method for locating the root cause of a fault is provided. For example... Figure 5 As shown, the electronic device 500 may include a processor 501, a memory 502, and a bus 503. The various components in the electronic device 500 are coupled together via the bus 503. Wherein: Bus 503 is used to realize the communication connection between processor 501 and memory 502; Memory 502 is used to store computer-executable instructions or computer programs; When the processor 501 executes computer-executable instructions or computer programs stored in the memory 502, it implements the fault root cause localization method in one or more exemplary embodiments described above.

[0157] In some exemplary embodiments, bus 503 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. For example, bus 503 may be divided into a data bus, a power bus, an address bus, a control bus, a status signal bus, etc. For ease of illustration, in... Figure 5 The bus 503 is represented by only one line, but this does not mean that there is only one bus or one type of bus.

[0158] In some exemplary embodiments, the electronic device can be implemented as various types of terminals such as laptops, tablets, desktop computers, set-top boxes, smartphones, smart speakers, smartwatches, smart TVs, and in-vehicle terminals, or it can be implemented as a server. For example, the server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0159] In some exemplary embodiments, the processor may be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., wherein the general-purpose processor may be a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or any conventional processor, etc.

[0160] This application provides a computer-readable storage medium storing computer-executable instructions or a computer program. When the computer-executable instructions or the computer program are executed by a processor, the fault root cause localization method provided in this application can be implemented. For example, ... Figure 1 The method for locating the root cause of a fault is shown.

[0161] This application provides a computer program product, which includes a computer program or computer-executable instructions. When the computer-executable instructions or the computer program are executed by a processor, the fault root cause localization method provided in this application can be implemented. For example, ... Figure 1The illustrated fault root cause localization method. For example, the computer program or computer executable instructions are stored in a computer-readable storage medium, the processor of the electronic device reads the computer program or computer executable instructions from the computer-readable storage medium, and the processor executes the computer program or computer executable instructions, causing the electronic device to perform the fault root cause localization method provided in the embodiments of this application.

[0162] In some exemplary embodiments, the aforementioned computer-readable storage medium / memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM), etc.; or it may be various terminals including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0163] In some embodiments, a computer program or computer-executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0164] As an example, a computer program or computer-executable instructions may, but not necessarily, correspond to a file in a file system. It may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple collaborating files (e.g., a file that stores one or more modules, subroutines, or code sections).

[0165] As an example, a computer program or computer-executable instructions may be deployed to execute on one electronic device, or on multiple electronic devices located at one location, or on multiple electronic devices distributed across multiple locations and interconnected by a communication network.

[0166] It should be noted that the descriptions of the above embodiments of the apparatus, devices, storage media, or products are similar to the descriptions of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device, storage medium, or product embodiments of this application, those skilled in the art should refer to the descriptions of the method embodiments of this disclosure for understanding. Further details will not be repeated here.

[0167] The features disclosed in the several methods, apparatuses, devices, storage media or product embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments, apparatuses, devices, storage media or product embodiments.

[0168] The above are merely embodiments of this application and are not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

Claims

1. A method for locating the root cause of a fault, characterized in that, The method includes: Obtain the fault search space; wherein, the fault search space includes: multiple tuples, each tuple including: an attribute and its corresponding attribute value; The categories of each attribute in the fault search space are determined; wherein, the categories of each attribute include: a first category and a second category, wherein the first category is used to characterize an attribute that has a dependency relationship with one or more other attributes in the fault search space other than itself, and the second category is used to characterize an attribute that does not have a dependency relationship with any other attributes in the fault search space other than itself. Based on the categories of the various attributes, the set of root causes of the fault is determined by performing a heuristic search on the fault search space.

2. The method of claim 1, wherein, Determining the category of each attribute in the fault search space includes: Based on the fault search space, determine the dependency between every two attributes in each attribute; Based on the dependency between each pair of attributes, an attribute category analysis graph is generated, wherein the number of nodes in the attribute category analysis graph is the same as the number of attributes in the fault search space, the nodes in the attribute category analysis graph are used to represent attributes, and the directed edges in the attribute category analysis graph are used to represent the dependency relationship between two attributes. Based on the attribute category analysis graph, one or more hierarchical chains are extracted, wherein the head nodes of the multiple hierarchical chains are different; The category of the attribute located on the hierarchical chain is determined as the first category, and the category of the attribute not located on the hierarchical chain is determined as the second category.

3. The method of claim 2, wherein, The generation of an attribute category analysis graph based on the dependency between every two attributes includes: For every pair of attributes, when the dependency of the first attribute relative to the second attribute in every pair of attributes meets a preset condition, a directed edge from the first attribute to the second attribute is generated in the attribute category analysis graph. Alternatively, when the dependency of the second attribute relative to the first attribute in any pair of attributes meets a preset condition, a directed edge from the second attribute to the first attribute is generated in the attribute category analysis graph. Alternatively, when the dependency of the first attribute relative to the second attribute in any pair of attributes does not meet a preset condition, and the dependency of the second attribute relative to the first attribute does not meet a preset condition, then in the attribute category analysis graph, no directed edge from the first attribute to the second attribute is generated.

4. The method of claim 2, wherein, Based on the categories of the various attributes, the set of root causes of the fault is determined through heuristic search of the fault search space, including: Obtain the current set; wherein the current set is initialized as an empty set; Based on the category of each attribute, the hierarchical chain, and the fault search space, determine the target modification action corresponding to the current set; Perform the target modification action on the current set to obtain the modified set; When the modified set does not meet the preset exit condition, the modified set is taken as the new current set, the target modification action corresponding to the new current set is re-determined and executed until the obtained modified set meets the preset exit condition, and a heuristic search result is obtained. Based on the heuristic search results, the set of root causes of the failure is determined.

5. The method according to claim 4, characterized in that, The target modification action includes any one of the following: an add action, a delete action, a first replacement action, a second replacement action, and a third replacement action; wherein... The adding action is used to add a first tuple, which is a tuple in the fault search space that does not belong to the current set; The deletion action is used to delete the second tuple, which is a tuple in the current set; The first replacement action is used to replace the third tuple with the fourth tuple, wherein the third tuple is a tuple in the current set, and the fourth tuple is a tuple in the fault search space that does not belong to the current set; The second replacement action is used to replace the fifth tuple with the sixth tuple, wherein the fifth tuple is a tuple of attributes belonging to the first category in the current set, the category of the attributes in the sixth tuple is the first category, the attributes in the sixth tuple are the parent attributes of the attributes in the fifth tuple, and the sixth tuple is a tuple in the fault search space that does not belong to the current set. The third replacement action is used to replace the fifth tuple with the seventh tuple, wherein the category of the attribute in the seventh tuple is the first category, the attribute in the seventh tuple is the next level attribute of the attribute in the fifth tuple, and the seventh tuple is a tuple in the fault search space that does not belong to the current set.

6. The method according to any one of claims 1 to 5, characterized in that, The process of obtaining the fault search space includes: Obtain the cloud platform's operation logs; wherein, the operation logs include: multiple raw attributes, and each record in the operation logs includes: the attribute values ​​of the multiple raw attributes; The multiple original attributes are filtered to determine each attribute in the fault search space; Based on the aforementioned attributes and the operational logs, the fault search space is determined.

7. A fault root cause location device, characterized in that, The device includes: An acquisition unit is used to acquire a fault search space; wherein, the fault search space includes: multiple tuples, each tuple including: an attribute and its corresponding attribute value; The first determining unit is used to determine the category of each attribute in the fault search space; wherein the category of each attribute includes: a first category and a second category, the first category is used to characterize an attribute that has a dependency relationship with one or more other attributes in the fault search space other than itself, and the second category is used to characterize an attribute that does not have a dependency relationship with any other attributes in the fault search space other than itself. The second determining unit is used to perform a heuristic search on the fault search space based on the categories of the various attributes to determine the set of fault root causes.

8. An electronic device, characterized in that, The electronic device includes: Memory is used to store executable instructions or computer programs. A processor, when executing computer-executable instructions or computer programs stored in the memory, implements the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program or computer-executable instructions, characterized in that, When the computer program or computer-executable instructions are executed by a processor, the method as described in any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program or computer-executable instructions, characterized in that, When the computer program or computer-executable instructions are executed by a processor, the method as described in any one of claims 1 to 6 is implemented.

Images