Method, device and equipment for identifying abnormal root cause of bare metal computing power node and medium

Abstract

This application discloses a method, apparatus, device, and medium for identifying the root cause of bare metal computing node anomalies, relating to the field of bare metal resource management technology. The method includes: receiving a bare metal computing node anomaly event; determining the type of the bare metal computing node anomaly event based on the source event code in the event; if the event does not carry complete context information, querying and supplementing the context information based on the bare metal computing node scheduling record; obtaining multi-source diagnostic evidence based on the type of the event and the supplemented context information, and determining the root cause category of the anomaly based on the multi-source diagnostic evidence; generating a diagnostic result object based on the root cause category, and writing the diagnostic result object into the anomaly record. This method can solve the problems of false positives and false negatives, improving the accuracy of root cause identification.

Description

Technical Field

[0001] This application relates to the field of bare metal resource management technology, and in particular to a method, apparatus, equipment and medium for identifying the root causes of abnormalities in bare metal computing nodes. Background Technology

[0002] With the increasing application of bare-metal computing nodes in scenarios such as cloud desktops, graphics rendering, inference training, batch processing computing, and edge computing, the platform not only needs to handle device allocation, scheduling, and reclamation, but also needs to quickly identify the root cause when devices malfunction. Bare-metal computing nodes directly carry the operating system, drivers, hardware devices, and business processes; a failure at any layer can manifest as a disconnection, blue screen, freeze, boot failure, or hardware alarm. Therefore, there is often no one-to-one correspondence between the abnormal symptoms and the root cause. Current technologies for identifying the root cause of bare-metal computing node anomalies suffer from misjudgments or omissions.

[0003] Therefore, how to solve the above-mentioned technical defects has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] The purpose of this application is to provide a method, apparatus, device, and medium for identifying the root causes of anomalies in bare metal computing nodes, which can solve the problems of misjudgment and missed judgment, and improve the accuracy of root cause identification.

[0005] To address the aforementioned technical problems, this application provides a method for identifying the root causes of anomalies in bare metal computing nodes, comprising: Receive abnormal events from bare metal computing nodes; The type of the bare metal computing node abnormal event is determined based on the source event code in the bare metal computing node abnormal event; If the bare metal computing node abnormal event does not carry complete context information, the context information is queried and supplemented according to the bare metal computing node scheduling record; Based on the type of the bare metal computing node anomaly event and the supplemented context information, obtain multi-source diagnostic evidence, and determine the root cause category of the bare metal computing node anomaly based on the multi-source diagnostic evidence. Based on the root cause category, a diagnostic result object is generated and written into the exception record.

[0006] In some embodiments, obtaining multi-source diagnostic evidence based on the type of the bare metal computing node anomaly event and the supplemented context information, and determining the root cause category of the bare metal computing node anomaly based on the multi-source diagnostic evidence includes: If the abnormal event of the bare metal computing node is a blue screen disconnection, then query the blue screen dump result according to the startup identifier in the context information; If the blue screen dump result matches the preset dump rule, the bare metal computing node anomaly is identified as the corresponding memory failure blue screen. If the blue screen dump result does not match the preset dump rule, then analyze the startup event logs retrieved within the preset time window based on the event occurrence time in the context information; If the startup event log matches a preset startup feature, then the bare metal computing node anomaly is identified as an anomaly related to the preset startup feature.

[0007] In some embodiments, it also includes: If the startup event log does not match the preset startup characteristics, the bare metal computing node anomaly will be identified as a default blue screen disconnection anomaly.

[0008] In some embodiments, obtaining multi-source diagnostic evidence based on the type of the bare metal computing node anomaly event and the supplemented context information, and determining the root cause category of the bare metal computing node anomaly based on the multi-source diagnostic evidence includes: If the abnormal event of the bare metal computing node is a system freeze, then the startup event log is obtained according to the event occurrence time in the context information; If the startup event log matches the preset startup characteristics, then the bare metal computing node anomaly is identified as the corresponding root cause. If the startup event does not match the preset startup characteristics, a supplementary match is performed on the most recent preset number of historical startup events before the anomaly occurred, so as to determine the root cause category of the bare metal computing node anomaly based on the supplementary match results.

[0009] In some embodiments, it also includes: If the supplementary matching fails, the root cause category of the bare metal computing power node anomaly will be determined as the default system freeze.

[0010] In some embodiments, generating a diagnostic result object based on the root cause category includes: A diagnostic result object is generated based on the root cause category, including the root cause category, the source of the hit evidence, a summary of the evidence, and a diagnostic description.

[0011] In some embodiments, it also includes: Based on the root cause category, map the handling action and output the corresponding diagnostic classification identifier, alarm classification identifier, or governance strategy identifier.

[0012] To address the aforementioned technical problems, this application also provides a bare metal computing node anomaly root cause identification device, comprising: The receiving unit is used to receive abnormal events of bare metal computing nodes; The first determining unit is used to determine the type of the bare metal computing node abnormal event based on the source event code in the bare metal computing node abnormal event; The supplementation unit is used to query and supplement the context information based on the bare metal computing node scheduling record if the abnormal event of the bare metal computing node does not carry complete context information. The second determining unit is used to obtain multi-source diagnostic evidence based on the type of the bare metal computing power node abnormal event and the supplemented context information, and to determine the root cause category of the bare metal computing power node abnormality based on the multi-source diagnostic evidence. The generation unit is used to generate a diagnostic result object based on the root cause category and write the diagnostic result object into the exception record.

[0013] To address the aforementioned technical problems, this application also provides an electronic device, comprising: Memory, used to store computer programs; A processor is configured to implement the steps of the bare metal computing node anomaly root cause identification method as described above when executing the computer program.

[0014] To address the aforementioned technical problems, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the bare metal computing node anomaly root cause identification method as described above.

[0015] The bare metal computing node anomaly root cause identification method provided in this application includes: receiving a bare metal computing node anomaly event; determining the type of the bare metal computing node anomaly event based on the source event code in the bare metal computing node anomaly event; if the bare metal computing node anomaly event does not carry complete context information, querying and supplementing the context information according to the bare metal computing node scheduling record; obtaining multi-source diagnostic evidence based on the type of the bare metal computing node anomaly event and the supplemented context information, and determining the root cause category of the bare metal computing node anomaly based on the multi-source diagnostic evidence; generating a diagnostic result object based on the root cause category, and writing the diagnostic result object into the anomaly record.

[0016] As can be seen, the bare metal computing node anomaly root cause identification method provided in this application receives bare metal computing node anomaly events and determines the type of bare metal computing node anomaly events; when the bare metal computing node anomaly event does not carry complete context information, the context information is supplemented by querying the bare metal computing node scheduling record, and then multi-source diagnostic evidence is obtained based on the type of bare metal computing node anomaly event and the supplemented context information. The root cause category of the bare metal computing node anomaly is determined based on the multi-source diagnostic evidence. In this way, determining the root cause category based on multi-source diagnostic evidence can reduce the probability of false positives and false negatives and improve the accuracy of root cause identification.

[0017] The bare metal computing node anomaly root cause identification device, equipment, and computer-readable storage medium provided in this application all have the aforementioned technical effects. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the prior art and embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart illustrating a method for identifying the root causes of anomalies in bare metal computing nodes provided in an embodiment of this application; Figure 2 A schematic diagram of a root cause identification architecture based on cross-source evidence fusion provided in an embodiment of this application; Figure 3 A schematic diagram illustrating a context completion process provided for an embodiment of this application; Figure 4 A schematic diagram illustrating a process for hierarchical judgment of memory fault rules and driver loading characteristics provided in an embodiment of this application; Figure 5 This is a schematic diagram of a diagnostic result writing and processing action mapping process provided in an embodiment of this application; Figure 6 A schematic diagram of a bare metal computing node anomaly root cause identification device provided in an embodiment of this application; Figure 7 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0020] The core of this application is to provide a method, apparatus, device, and medium for identifying the root causes of anomalies in bare metal computing nodes, which can solve the problems of misjudgment and missed judgment and improve the accuracy of root cause identification.

[0021] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating a method for identifying the root causes of anomalies in bare metal computing nodes provided in an embodiment of this application. (Refer to...) Figure 1 As shown, the method includes: S101: Receive abnormal events from bare metal computing nodes.

[0023] Abnormal events of bare metal computing nodes may include source event code, event occurrence time, bare metal identifier, bare metal scheduling record identifier, etc.

[0024] S102: Determine the type of the bare metal computing node abnormal event based on the source event code in the bare metal computing node abnormal event.

[0025] The type of bare metal computing node anomaly event is determined based on the source event code in the bare metal computing node anomaly event. For example, the type of bare metal computing node anomaly event is blue screen disconnection, system freeze, etc.

[0026] S103: If the bare metal computing node abnormal event does not carry complete context information, then query and supplement the context information according to the bare metal computing node scheduling record.

[0027] When a bare metal computing node is missing a bare metal identifier, region identifier, or startup identifier in an abnormal event, the missing identifier is queried and filled in according to the bare metal computing node scheduling record, thereby completing the context information.

[0028] S104: Obtain multi-source diagnostic evidence based on the type of the bare metal computing node anomaly event and the supplemented context information, and determine the root cause category of the bare metal computing node anomaly based on the multi-source diagnostic evidence.

[0029] Multi-source diagnostic evidence refers to information from different sources used as root cause category diagnostic evidence. Each type of bare-metal computing node anomaly event corresponds to multi-source diagnostic evidence. For example, multi-source diagnostic evidence for a blue screen disconnection event may include blue screen dump results and startup event logs.

[0030] In some embodiments, obtaining multi-source diagnostic evidence based on the type of the bare metal computing node anomaly event and the supplemented context information, and determining the root cause category of the bare metal computing node anomaly based on the multi-source diagnostic evidence includes: If the abnormal event of the bare metal computing node is a blue screen disconnection, then query the blue screen dump result according to the startup identifier in the context information; If the blue screen dump result matches the preset dump rule, the bare metal computing node anomaly is identified as the corresponding memory failure blue screen. If the blue screen dump result does not match the preset dump rule, then analyze the startup event logs retrieved within the preset time window based on the event occurrence time in the context information; If the startup event log matches a preset startup feature, then the bare metal computing node anomaly is identified as an anomaly related to the preset startup feature.

[0031] When the type of abnormal event of a bare metal computing node is a blue screen disconnection, the system queries the blue screen dump result based on the startup identifier to obtain the dump code and one or more parameter values. Additionally, the startup event log is queried within a preset time window based on the event occurrence time. If the blue screen dump result matches a preset dump rule, the root cause category is directly identified as the corresponding fault blue screen; preset dump rules include preset memory fault rules. If a preset memory fault rule is matched, the root cause category is directly identified as the corresponding memory fault blue screen. If no preset dump rule is matched, the startup event log is analyzed further. When the startup event log matches a preset startup feature, the root cause category is identified as the corresponding startup-related root cause category. Preset startup features include preset driver loading features. When the startup event log matches a preset driver loading feature, the root cause category is identified as the corresponding driver-related root cause category. For example, if a feature related to ace.sys loading is matched, the bare metal computing node abnormality is identified as an abnormality related to the feature related to ace.sys loading, i.e., the root cause category is a driver-related blue screen.

[0032] This embodiment does not rely on a single source of diagnostic evidence to directly output a diagnostic conclusion. Instead, it performs joint analysis of blue screen dump results, startup event logs, and event occurrence times. This allows the system to further differentiate between different root cause categories, such as memory failure blue screens and driver-related blue screens, under the same abnormal manifestation. Furthermore, when determining the root cause, it prioritizes checking whether a preset dump rule is met. If not, it supplements the judgment based on preset startup characteristics, thereby reducing the false positive rate in complex abnormal scenarios.

[0033] In some embodiments, it also includes: If the startup event log does not match the preset startup characteristics, the bare metal computing node anomaly will be identified as a default blue screen disconnection anomaly.

[0034] If the blue screen dump result matches the preset dump rule, and the startup event log does not match the preset startup feature, then the bare metal computing power node anomaly is identified as the default blue screen disconnection anomaly, thus completing the fallback diagnosis.

[0035] In this embodiment, when neither the preset dump rules nor the preset startup features are matched, the error reverts to the default blue screen disconnection error, ensuring that diagnostic results can be obtained.

[0036] In some embodiments, obtaining multi-source diagnostic evidence based on the type of the bare metal computing node anomaly event and the supplemented context information, and determining the root cause category of the bare metal computing node anomaly based on the multi-source diagnostic evidence includes: If the abnormal event of the bare metal computing node is a system freeze, then the startup event log is obtained according to the event occurrence time in the context information; If the startup event log matches the preset startup characteristics, then the bare metal computing node anomaly is identified as the corresponding root cause. If the startup event does not match the preset startup characteristics, a supplementary match is performed on the most recent preset number of historical startup events before the anomaly occurred, so as to determine the root cause category of the bare metal computing node anomaly based on the supplementary match results.

[0037] In some embodiments, it also includes: If the supplementary matching fails, the root cause category of the bare metal computing power node anomaly will be determined as the default system freeze.

[0038] When a bare-metal computing node experiences a system freeze, the system retrieves the startup event log associated with the current anomaly. Within a first preset time window prior to the anomaly, a preset startup characteristic can be searched first. If no preset startup characteristic is found, a supplementary match is performed on the most recent preset number of historical startup events prior to the anomaly. If a preset startup characteristic is found, the corresponding root cause is output; if not, the system freeze root cause category is retained, and the reason for the miss can be recorded in the diagnostic description.

[0039] S105: Generate a diagnostic result object based on the root cause category, and write the diagnostic result object into the exception record.

[0040] In some embodiments, generating a diagnostic result object based on the root cause category includes: A diagnostic result object is generated based on the root cause category, including the root cause category, the source of the hit evidence, a summary of the evidence, and a diagnostic description.

[0041] After determining the root cause category, a diagnostic result object is generated, containing the root cause category, the source of the hitting evidence, an evidence summary, and a diagnostic description, and then written to the anomaly log. The source of the hitting evidence refers to the source of evidence that matches a preset dump rule or feature. For example, if the startup event log matches a preset startup feature, then the source of the hitting evidence is the source of the revelation event log.

[0042] In some embodiments, it also includes: Based on the root cause category, map the handling action and output the corresponding diagnostic classification identifier, alarm classification identifier, or governance strategy identifier.

[0043] Different handling types can be mapped based on the root cause category, such as alarm classification, manual review type, or automatic governance strategy, so that the diagnostic results can be directly reused in the subsequent governance process.

[0044] After completing the root cause identification, this embodiment further associates the root cause category, evidence source, and diagnostic description into the anomaly record, and can output the corresponding diagnostic classification identifier, alarm classification identifier, or governance strategy identifier, so that the root cause identification results can be directly reused in subsequent auditing, statistics, and governance processes.

[0045] The overall architecture for root cause identification through cross-source evidence fusion can be referenced. Figure 2 As shown, the main components include the entry point for abnormal events on bare metal computing nodes, supplementing contextual information, performing diagnosis based on multi-source evidence (which may include detailed root cause categories, evidence sources, and diagnostic descriptions), and writing the diagnostic results back. The multi-source evidence includes source event evidence, such as source event code, event occurrence time, and anomaly details; dump evidence, such as dump code and parameter combinations; startup log evidence; and bare metal computing node scheduling records.

[0046] The process for context completion can be found in the following reference. Figure 3 As shown, the main steps include receiving abnormal events from bare metal computing nodes and determining whether these events carry complete contextual information. If the abnormal event carries complete contextual information, evidence is directly associated based on the existing contextual information. If the abnormal event does not carry complete contextual information, the context is first supplemented, and then evidence is associated based on the supplemented context. Evidence may include dump evidence, startup log evidence, source event evidence, etc.

[0047] When the abnormal event of a bare-metal computing node is a blue screen disconnection event, the process for judging memory fault rules and driver loading characteristics can be found by referring to... Figure 4As shown, the main steps include: constructing a multi-source evidence set; determining whether the blue screen dump result matches a preset memory fault rule; if it matches, outputting the corresponding root cause category; if it doesn't, determining whether the startup event log matches a preset driver loading feature; if it matches, outputting the corresponding root cause category; if it doesn't match, outputting the underlying root cause.

[0048] The process for mapping diagnostic results to treatment actions can be found in the following reference. Figure 5 As shown, the main steps include: generating root cause identification results; associating and writing them into anomaly records; and mapping subsequent actions based on the root cause category. These subsequent actions can be alarm classification outputs for monitoring and review reuse; manual review suggestions for work orders and maintenance; or governance strategy calls for selection in subsequent governance processes.

[0049] In summary, the bare metal computing node anomaly root cause identification method provided in this application receives bare metal computing node anomaly events and determines the type of the bare metal computing node anomaly event. When the bare metal computing node anomaly event does not carry complete context information, the context information is supplemented by querying the bare metal computing node scheduling record. Then, multi-source diagnostic evidence is obtained based on the type of bare metal computing node anomaly event and the supplemented context information. The root cause category of the bare metal computing node anomaly is determined based on the multi-source diagnostic evidence. In this way, determining the root cause category based on multi-source diagnostic evidence can reduce the probability of false positives and false negatives and improve the accuracy of root cause identification.

[0050] This application also provides a device for identifying the root cause of anomalies in bare metal computing nodes. The device described below can be referred to in conjunction with the method described above. Please refer to... Figure 6 , Figure 6 This is a schematic diagram of a bare metal computing node anomaly root cause identification device provided in an embodiment of this application, combined with... Figure 6 As shown, the device includes: Receiver unit 10 is used to receive abnormal events of bare metal computing power nodes; The first determining unit 20 is used to determine the type of the bare metal computing node abnormal event based on the source event code in the bare metal computing node abnormal event; The supplementation unit 30 is used to query and supplement the context information according to the bare metal computing node scheduling record if the abnormal event of the bare metal computing node does not carry complete context information. The second determining unit 40 is used to obtain multi-source diagnostic evidence based on the type of the bare metal computing power node abnormal event and the supplemented context information, and to determine the root cause category of the bare metal computing power node abnormality based on the multi-source diagnostic evidence. The generation unit 50 is used to generate a diagnostic result object according to the root cause category and write the diagnostic result object into the exception record.

[0051] In some embodiments, the second determining unit 40 is used to: If the abnormal event of the bare metal computing node is a blue screen disconnection, then query the blue screen dump result according to the startup identifier in the context information; If the blue screen dump result matches the preset dump rule, the bare metal computing node anomaly is identified as the corresponding memory failure blue screen. If the blue screen dump result does not match the preset dump rule, then analyze the startup event logs retrieved within the preset time window based on the event occurrence time in the context information; If the startup event log matches a preset startup feature, then the bare metal computing node anomaly is identified as an anomaly related to the preset startup feature.

[0052] In some embodiments, the second determining unit 40 is further configured to: If the startup event log does not match the preset startup characteristics, the bare metal computing node anomaly will be identified as a default blue screen disconnection anomaly.

[0053] In some embodiments, the second determining unit 40 is used to: If the abnormal event of the bare metal computing node is a system freeze, then the startup event log is obtained according to the event occurrence time in the context information; If the startup event log matches the preset startup characteristics, then the bare metal computing node anomaly is identified as the corresponding root cause. If the startup event does not match the preset startup characteristics, a supplementary match is performed on the most recent preset number of historical startup events before the anomaly occurred, so as to determine the root cause category of the bare metal computing node anomaly based on the supplementary match results.

[0054] In some embodiments, the second determining unit 40 is further configured to: If the supplementary matching fails, the root cause category of the bare metal computing power node anomaly will be determined as the default system freeze.

[0055] In some embodiments, the generating unit 50 is used for: A diagnostic result object is generated based on the root cause category, including the root cause category, the source of the hit evidence, a summary of the evidence, and a diagnostic description.

[0056] In some embodiments, it also includes: The mapping unit is used to map the handling action according to the root cause category and output the corresponding diagnostic classification identifier, alarm classification identifier, or management strategy identifier.

[0057] The bare metal computing node anomaly root cause identification device provided in this application receives bare metal computing node anomaly events and determines the type of the bare metal computing node anomaly event. When the bare metal computing node anomaly event does not carry complete context information, the context information is supplemented by querying the bare metal computing node scheduling record. Then, multi-source diagnostic evidence is obtained based on the type of bare metal computing node anomaly event and the supplemented context information. The root cause category of the bare metal computing node anomaly is determined based on the multi-source diagnostic evidence. In this way, determining the root cause category based on multi-source diagnostic evidence can reduce the probability of false positives and false negatives and improve the accuracy of root cause identification.

[0058] This application also provides an electronic device, referenced... Figure 7 As shown, the device includes a memory 1 and a processor 2.

[0059] Memory 1 is used to store computer programs; Processor 2 is used to execute computer programs to perform the following steps: Receive bare metal computing node anomaly events; determine the type of the bare metal computing node anomaly event based on the source event code in the bare metal computing node anomaly event; if the bare metal computing node anomaly event does not carry complete context information, query and supplement the context information according to the bare metal computing node scheduling record; obtain multi-source diagnostic evidence based on the type of the bare metal computing node anomaly event and the supplemented context information, and determine the root cause category of the bare metal computing node anomaly based on the multi-source diagnostic evidence; generate a diagnostic result object based on the root cause category, and write the diagnostic result object into the anomaly record.

[0060] For a description of the equipment provided in this application, please refer to the above method embodiments; further details will not be provided here.

[0061] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can perform the following steps: Receive bare metal computing node anomaly events; determine the type of the bare metal computing node anomaly event based on the source event code in the bare metal computing node anomaly event; if the bare metal computing node anomaly event does not carry complete context information, query and supplement the context information according to the bare metal computing node scheduling record; obtain multi-source diagnostic evidence based on the type of the bare metal computing node anomaly event and the supplemented context information, and determine the root cause category of the bare metal computing node anomaly based on the multi-source diagnostic evidence; generate a diagnostic result object based on the root cause category, and write the diagnostic result object into the anomaly record.

[0062] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0063] For a description of the computer-readable storage medium provided in this application, please refer to the above method embodiments; further details will not be repeated here.

[0064] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatuses, devices, and computer-readable storage media disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant details can be found in the method section.

[0065] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0066] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0067] The foregoing has provided a detailed description of the method, apparatus, equipment, and medium for identifying the root causes of bare metal computing node anomalies provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A method for identifying the root causes of anomalies in bare metal computing nodes, characterized in that, include: Receive abnormal events from bare metal computing nodes; The type of the bare metal computing node abnormal event is determined based on the source event code in the bare metal computing node abnormal event; If the bare metal computing node abnormal event does not carry complete context information, the context information is queried and supplemented according to the bare metal computing node scheduling record; Based on the type of the bare metal computing node anomaly event and the supplemented context information, obtain multi-source diagnostic evidence, and determine the root cause category of the bare metal computing node anomaly based on the multi-source diagnostic evidence. Based on the root cause category, a diagnostic result object is generated and written into the exception record.

2. The method for identifying the root causes of anomalies in bare metal computing nodes according to claim 1, characterized in that, Based on the type of the bare metal computing node anomaly event and the supplemented context information, multi-source diagnostic evidence is obtained, and the root cause category of the bare metal computing node anomaly is determined based on the multi-source diagnostic evidence, including: If the abnormal event of the bare metal computing node is a blue screen disconnection, then query the blue screen dump result according to the startup identifier in the context information; If the blue screen dump result matches the preset dump rule, then the bare metal computing power node anomaly is identified as the corresponding fault blue screen. If the blue screen dump result does not match the preset dump rule, then analyze the startup event logs retrieved within the preset time window based on the event occurrence time in the context information; If the startup event log matches a preset startup feature, then the bare metal computing node anomaly is determined to be an anomaly related to the preset startup feature.

3. The method for identifying the root causes of anomalies in bare metal computing nodes according to claim 2, characterized in that, Also includes: If the startup event log does not match the preset startup characteristics, the bare metal computing node anomaly will be identified as a default blue screen disconnection anomaly.

4. The method for identifying the root cause of anomalies in bare metal computing nodes according to claim 1, characterized in that, Based on the type of the bare metal computing node anomaly event and the supplemented context information, multi-source diagnostic evidence is obtained, and the root cause category of the bare metal computing node anomaly is determined based on the multi-source diagnostic evidence, including: If the abnormal event of the bare metal computing node is a system freeze, then the startup event log is obtained according to the event occurrence time in the context information; If the startup event log matches a preset startup feature, then the bare metal computing node anomaly is determined to be an anomaly related to the preset startup feature; If the startup event does not match the preset startup characteristics, a supplementary match is performed on the most recent preset number of historical startup events before the anomaly occurred, so as to determine the root cause category of the bare metal computing node anomaly based on the supplementary match results.

5. The method for identifying the root cause of anomalies in bare metal computing nodes according to claim 4, characterized in that, Also includes: If the supplementary matching fails, the root cause category of the bare metal computing power node anomaly will be determined as the default system freeze.

6. The method for identifying the root causes of anomalies in bare metal computing nodes according to claim 1, characterized in that, Based on the root cause category, the generated diagnostic result object includes: A diagnostic result object is generated based on the root cause category, including the root cause category, the source of the hit evidence, a summary of the evidence, and a diagnostic description.

7. The method for identifying the root causes of anomalies in bare metal computing nodes according to claim 1, characterized in that, Also includes: Based on the root cause category, map the handling action and output the corresponding diagnostic classification identifier, alarm classification identifier, or governance strategy identifier.

8. A device for identifying the root cause of anomalies in bare metal computing nodes, characterized in that, include: The receiving unit is used to receive abnormal events of bare metal computing nodes; The first determining unit is used to determine the type of the bare metal computing node abnormal event based on the source event code in the bare metal computing node abnormal event; The supplementation unit is used to query and supplement the context information based on the bare metal computing node scheduling record if the abnormal event of the bare metal computing node does not carry complete context information. The second determining unit is used to obtain multi-source diagnostic evidence based on the type of the bare metal computing power node abnormal event and the supplemented context information, and to determine the root cause category of the bare metal computing power node abnormality based on the multi-source diagnostic evidence. The generation unit is used to generate a diagnostic result object based on the root cause category and write the diagnostic result object into the exception record.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the bare metal computing node anomaly root cause identification method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the bare metal computing node anomaly root cause identification method as described in any one of claims 1 to 7.

Images