Root cause location method, system and device

Abstract

Embodiments of the present description provide a root cause location method, system and device. The root cause locating method comprises: acquiring historical link data corresponding to a microservice, and determining a target anomaly location model corresponding to the historical link data; determining link data sets to be processed corresponding to the microservice, clustering said link data sets, and determining cluster center link data on the basis of a clustering result; inputting the cluster center link data into the target anomaly location model to obtain abnormal link node information corresponding to the cluster center link data; and on the basis of the abnormal link node information, determining a target abnormal link corresponding to the microservice, and determining an abnormal link node in the target abnormal link. Model fine adjustment is carried out on the basis of an initial anomaly location model, so that the initial anomaly location model has wide applicability and high generalization ability. Cluster center link data is selected for root cause location, so that the root cause location speed of the microservice is increased.

Description

Root cause location method, system and device Technical Field

[0001] The embodiments of this specification relate to the field of computer technology, and more particularly to a root cause location method. Background Art

[0002] With the advancement of computer technology, microservices in the cloud are rapidly developing. A microservices architecture is highly scalable, highly available, and easy to maintain and update. Due to its faster delivery, improved scalability, and greater autonomy, more and more systems are adopting microservices. With the growing popularity of microservices, security issues are also attracting considerable attention.

[0003] Existing microservice performance debugging efforts are based on correlations, empirical thresholds, or non-scalable algorithms and deep learning models, resulting in low accuracy and slow performance. As microservices scale, algorithms based on experience and rules for root cause identification become unreliable or even incapable of pinpointing the root cause. Therefore, new approaches are needed to pinpoint the root cause of a fault. These empirical and rule-based root cause identification methods are not universally applicable, leading to an urgent need for an effective root cause identification method to address these issues.

[0004] Summary of the Invention

[0005] In view of this, embodiments of this specification provide a root cause location method. One or more embodiments of this specification also relate to a root cause location apparatus, a root cause location system, a computing device, a computer-readable storage medium, and a computer program to address technical deficiencies in the prior art.

[0006] According to a first aspect of an embodiment of this specification, a root cause location method is provided, including:

[0007] Obtain historical link data corresponding to the microservice business, and determine the target anomaly location model corresponding to the historical link data;

[0008] Determine a data set of links to be processed corresponding to the microservice business, cluster the data set of links to be processed, and determine cluster center link data according to the clustering results;

[0009] Inputting the cluster center link data into the target anomaly positioning model to obtain abnormal link node information corresponding to the cluster center link data;

[0010] A target abnormal link corresponding to the microservice business is determined based on the abnormal link node information, and an abnormal link node is determined in the target abnormal link.

[0011] According to a second aspect of the embodiments of this specification, a root cause locating device is provided, including:

[0012] An acquisition module is configured to acquire historical link data corresponding to the microservice business and determine a target anomaly location model corresponding to the historical link data;

[0013] A clustering module is configured to determine a data set of links to be processed corresponding to the microservice business, cluster the data set of links to be processed, and determine cluster center link data according to the clustering results;

[0014] An input module is configured to input the cluster center link data into the target anomaly positioning model to obtain abnormal link node information corresponding to the cluster center link data;

[0015] The determination module is configured to determine a target abnormal link corresponding to the microservice business based on the abnormal link node information, and determine an abnormal link node in the target abnormal link.

[0016] According to a third aspect of the embodiments of this specification, a root cause positioning system is provided, including a server and a client;

[0017] The client submits an exception location request to the server for the target microservice business;

[0018] The server parses the anomaly location request to obtain debugging link data and target link data; updates an initial anomaly location model to a to-be-used anomaly location model based on the debugging link data; clusters the target link data and determines link data to be input based on the clustering result; inputs the to-be-input link data into the to-be-used anomaly location model to obtain abnormal node information corresponding to the target microservice business; determines an abnormal node based on the abnormal node information, and generates abnormal feedback information based on the abnormal node and the abnormal node information; and sends the abnormal feedback information to the client as a response to the anomaly location request;

[0019] The client performs exception handling on the target microservice business based on the exception feedback information.

[0020] According to a fourth aspect of the embodiments of this specification, a computing device is provided, including:

[0021] memory and processor;

[0022] The memory is configured to store computer-executable instructions, and the processor is configured to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the above-mentioned root cause location method are implemented.

[0023] According to a fifth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the above-mentioned root cause location method are implemented.

[0024] According to a sixth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned root cause locating method.

[0025] One embodiment of the present specification obtains historical link data corresponding to a microservice business and determines a target anomaly location model corresponding to the historical link data; determines a to-be-processed link data set corresponding to the microservice business, clusters the to-be-processed link data set, and determines cluster center link data based on the clustering results; inputs the cluster center link data into the target anomaly location model to obtain abnormal link node information corresponding to the cluster center link data; determines the target abnormal link corresponding to the microservice business based on the abnormal link node information, and determines the abnormal link node in the target abnormal link. Fine-tune the model based on the initial anomaly location model, so that the adjusted initial anomaly location model is applicable to a specific microservice business, making the initial anomaly location model have wider applicability and stronger generalization ability; when performing root cause location through the target anomaly location model, select the cluster center link data for root cause location, thereby improving the root cause location speed of the microservice business. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] FIG1 is a schematic diagram of the structure of a root cause location method provided by one embodiment of this specification;

[0027] FIG2 is a flow chart of a root cause location method provided by one embodiment of this specification;

[0028] FIG3 is a flowchart of a processing process of a root cause location method provided by one embodiment of this specification;

[0029] FIG4 is a schematic diagram of a model training of a root cause location method provided by one embodiment of this specification;

[0030] FIG5 is a schematic diagram of a model application of a root cause location method provided by an embodiment of this specification;

[0031] FIG6 is a schematic diagram of microservice synthesis of a root cause location method provided by one embodiment of this specification;

[0032] FIG7 is a schematic structural diagram of a root cause locating device provided by one embodiment of this specification;

[0033] FIG8 is an architecture diagram of a root cause location system provided by one embodiment of this specification;

[0034] FIG9 is a structural block diagram of a computing device provided by one embodiment of this specification. DETAILED DESCRIPTION

[0035] The following description sets forth many specific details to facilitate a thorough understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the scope of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0036] The terms used in one or more embodiments of this specification are for the purpose of describing specific embodiments and are not intended to limit one or more embodiments of this specification. The singular forms "a," "an," "the," and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0037] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "when..." or "when..." or "in response to determining."

[0038] In addition, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0039] First, the terms involved in one or more embodiments of this specification are explained.

[0040] Trace: Link tracing starts from the moment a client initiates a request and reaches the system boundary, and records every service the request passes through until a response is returned to the client. This entire process is called a "trace."

[0041] Span: In a distributed system, the trace link is used to record the call status of a request between multiple services, including the starting point, end point, and intermediate services of the request. Span is the basic unit in the trace link. It represents the process of a service processing a request, including the service receiving the request, processing the request, returning a response, etc. Specifically, each span contains a unique identifier (Span ID), the identifier of the parent span (Parent ID), the start time, end time, span duration, span operation name, span label, and other information. When a request passes through a service, the service creates a new Span object, sets its Span ID to the ID of the parent span, and sets the start time to the current time. When the service completes request processing, it sets the end time to the current time and sends the Span information to the trace link so that subsequent services can obtain this information.

[0042] MicroService: Microservices is an architectural and organizational approach to developing software in which the software consists of small, independent services that communicate through well-defined APIs.

[0043] Few-shot learning: Few-shot learning is a machine learning task that uses a small amount of labeled data to generalize and recognize new data by learning the characteristics or patterns of a small number of data samples. Traditional machine learning models require large amounts of labeled data to train, but few-shot learning can achieve good results with very little data, making it highly applicable.

[0044] SBert-SBERT: Sentence-BERT is a pre-trained model based on BERT that is primarily used to generate vector representations of text, particularly for calculating similarity between sentences. Unlike the traditional BERT model, which takes text sequences as input, SBERT introduces several unique training techniques based on BERT, such as sentence pair construction and multi-task learning. This allows the model to learn more about sentence semantics during pre-training and encode it into a fixed-length vector representation. This vector representation can be used to calculate similarity between sentences, such as cosine similarity and Manhattan distance, enabling tasks such as text matching, semantic search, and sentiment analysis.

[0045] Counterfactuals involve reasoning about past events in reverse order, assuming that the event had occurred differently, inversely, or not occurred, and then observing the consequences of these assumptions. Simply put, it's a way of thinking, "What would have happened if that event hadn't happened the way it did?" This approach can help people better understand and analyze past events, draw valuable conclusions and lessons, and predict and avoid future problems.

[0046] GNN (Graph Neural Network), also known as a graph neural network, is a deep learning model based on graph structures, primarily used to process graph data. In layman's terms, it uses deep learning methods to analyze and process graph data. For example, we can think of data such as friendships in social networks, transportation routes in logistics, and molecular structures in chemical reactions as graph data. Graph neural networks can learn the features and relationships within these graphs, enabling them to perform tasks such as classification, clustering, and prediction on nodes and edges within the graphs. Unlike traditional models such as convolutional neural networks and recurrent neural networks, graph neural networks are primarily designed and optimized based on graph structures and graph algorithms from graph theory. They feature unique operations such as graph convolution and graph attention mechanisms. Through these operations, graph neural networks can effectively process different types of graph data and have achieved numerous successful applications in various tasks, such as node classification, graph classification, and link prediction.

[0047] GIN (Graph Isomorphism Network) is a graph neural network. It is an improved algorithm based on the Graph Convolutional Network (GCN) proposed by Xu et al. GIN aims to perform tasks such as graph classification, clustering, and reconstruction by learning the local neighborhood substructure between nodes.

[0048] Jaccard index: The Jaccard index is an indicator used to calculate the similarity between two sets, and its value ranges from 0 to 1. It is defined as the size of the intersection of two sets divided by the size of their union, that is, J(A, B) = |A∩B| / |A∪B|, where A and B are two sets, and |A| represents the size of set A (the number of elements). The Jaccard index can be used to evaluate the similarity between two sets in terms of elements. The closer the value is to 1, the higher the similarity between the two sets, and the closer the value is to 0, the lower the similarity between the two sets. In practical applications, the Jaccard index is often used in text processing, image processing, data mining and other fields. For example, it is used to calculate the similarity between queries and documents in search engines, or to calculate the similarity between different clusters in cluster analysis.

[0049] With the advancement of computer technology, microservices in the cloud are rapidly developing. The microservices architecture is a highly scalable, highly available, and easy-to-maintain and update service architecture. Due to its faster delivery, improved scalability, and greater autonomy, more and more systems are adopting it. With the growing popularity of microservices, microservice security issues are also attracting considerable attention. The increasing scale of microservices complicates the RPC dependency graph, exacerbating the tail-of-scale effect and rendering many empirical rules unreliable. Previous work on microservice performance debugging has relied on correlations, empirical thresholds, or non-scalable algorithms and deep learning models. These methods have not been quantitatively evaluated using microservice benchmarks at comparable production service scales, making their accuracy and performance questionable for production-scale microservices. As microservices scale, many heuristic root cause analysis algorithms based on experience and rules become unreliable or even unverifiable. In a microservices architecture, since different services may run on different nodes and communication between them may be affected by factors such as network latency and packet loss, new approaches are needed for fault analysis and resolution. In this case, more advanced data analysis techniques and tools are needed to help identify and fix the faults.

[0050] In the existing technology, microservice performance debugging efforts are based on correlation, empirical thresholds, or non-scalable algorithms and deep learning models, resulting in low accuracy and slow speed. When microservices scale, algorithms that rely on experience and rules to locate the root cause become unreliable or even impossible to locate the root cause. Therefore, when a fault occurs, new methods are needed to locate the root cause of the fault. In order to perform root cause diagnosis on microservice trace data in a production environment and improve problem solving efficiency, this embodiment provides a root cause location method.

[0051] Figure 1 shows a structural diagram of a root cause location method provided according to an embodiment of the present specification; as shown in Figure 1, in a microservice business scenario, historical link data corresponding to the microservice business is obtained, and a target abnormality location model for root cause location is determined. The target abnormality location model can be obtained by fine-tuning the initial abnormality location model using the historical link data as a training sample, that is, the initial abnormality location model is updated based on the historical link data to obtain the target abnormality location model. The link data set to be processed corresponding to the microservice business is determined, and the link data set to be processed is clustered, and the cluster center link data is determined based on the clustering results. The cluster center link data is input into the target abnormality location model to obtain the abnormal link node information corresponding to the cluster center link data. The target abnormal link corresponding to the microservice business is determined based on the abnormal link node information, and the abnormal link node is determined in the target abnormal link. The root cause location of the link data to be processed is realized.

[0052] Based on the initial anomaly localization model, the model is fine-tuned to make the adjusted initial anomaly localization model applicable to specific microservice businesses, making the initial anomaly localization model have wider applicability and stronger generalization capabilities; when locating the root cause through the target anomaly localization model, the cluster center link data is selected for root cause localization to improve the root cause localization speed of the microservice business.

[0053] This specification provides a root cause locating method. This specification also relates to a root cause locating apparatus, a root cause locating system, a computing device, and a computer-readable storage medium, which are described in detail in the following embodiments.

[0054] Referring to FIG. 2 , FIG. 2 shows a flow chart of a root cause location method provided according to an embodiment of this specification, which specifically includes the following steps.

[0055] Step S202: Acquire historical link data corresponding to the microservice business, and determine a target anomaly location model corresponding to the historical link data.

[0056] Specifically, microservices is an architecture and organizational method for developing software, in which the software consists of small independent services that communicate through clearly defined APIs; accordingly, microservice business is a business based on the microservice architecture, and the types of services include but are not limited to computing, storage, etc.; historical link data refers to the trace data generated under the microservice business; the target anomaly location model corresponds to the microservice business and has the ability to identify abnormal data in the link data corresponding to the microservice business.

[0057] Based on this, the microservices in the target domain are identified and a small amount of link data generated by these microservices is obtained as historical link data. Model training is performed based on this small amount of historical link data, ensuring that the trained target anomaly localization model matches the microservices in the target domain. The target anomaly localization model can identify anomalies in the link data generated by the microservices in the target domain and locate the root cause of the anomalies.

[0058] In practical applications, when determining the target anomaly localization model, one can first obtain an initial anomaly localization model with anomaly recognition capabilities. This initial anomaly localization model can then be trained based on acquired historical link data to obtain a target anomaly localization model corresponding to the microservice domain. Furthermore, when determining the target legacy localization model, a training set can be constructed based on acquired historical link data corresponding to the microservice domain to construct an initial anomaly localization model for anomaly localization. This initial anomaly localization model can then be trained based on the training set until a target anomaly localization model is obtained that meets the training termination criteria.

[0059] Furthermore, in order to make the target anomaly localization model have better anomaly localization capabilities, it can be trained on the basis of the initial anomaly localization model to obtain the target anomaly localization model. The initial anomaly localization model is a prediction model with anomaly detection and root cause localization capabilities. Considering the generalization ability of the initial localization model, it can be considered to use rich training samples when training the model. The link data corresponding to at least two initial microservice businesses can be obtained to construct a link data sample set. The specific implementation is as follows:

[0060] The initial anomaly location model is updated to a target anomaly location model corresponding to the historical link data; wherein, the training of the initial anomaly location model includes: determining a link data set to be trained based on at least two initial microservice businesses; constructing a link data sample set based on at least two link data to be trained contained in the link data set to be trained; and using the link data sample set to train the anomaly location model to be trained until an initial anomaly location model that meets the training stop condition is obtained.

[0061] Specifically, the initial microservice business can be a microservice business in any business scenario, such as a computing business or a storage business. The link data set to be trained refers to a data set consisting of the collected link data corresponding to the initial microservice business. The link data sample set refers to a sample set used for model training. Accordingly, the initial anomaly location model is an anomaly location model that has the ability to locate the root cause after training the anomaly location model based on the link data sample set. When collecting link data samples contained in the link data sample set, a variety of sampling methods can be used. For example, for any microservice system, it is necessary to divide trace data within a certain period of time according to different microservice entry points, calculate the overall delay distribution of each service entry trace within this period, and sample these trace data based on the calculated delay distribution to obtain complete original training data. The initial anomaly location model is used to locate the root cause of the trace data and determine the root cause node of the anomaly in the trace data. The target anomaly location model refers to the anomaly location model obtained after updating the initial anomaly location model. The historical link data is used to adjust the initial anomaly location model so that the target anomaly location model has the ability to identify anomalies in the link data corresponding to the microservice business.

[0062] Based on this, at least two initial microservice businesses are determined, and link data from each initial microservice business is collected to construct a link data set to be trained. At least two link data to be trained are determined to be included in the link data set to be trained, and each link data to be trained is processed separately to obtain link data samples corresponding to the link data to be trained, forming a link data sample set. The link data sample set is used to train the anomaly location model to be trained, and causal modeling of the link data samples based on the anomaly location model to be trained is achieved. The link data samples are embedded and encoded using the anomaly location model to be trained, and then the anomaly location model to be trained is trained using a specific loss function, so that the anomaly location model to be trained learns the embedded features until an initial anomaly location model that meets the training stop condition is obtained.

[0063] Determine the initial anomaly localization model and update it based on a small amount of historical link data, ensuring that the updated model matches the microservices in the target domain. Update the initial anomaly localization model to the target anomaly localization model. This enables the target anomaly localization model to identify anomalies in the link data generated by the microservices in the target domain and locate the root cause of the anomalies.

[0064] In practical applications, the initial anomaly localization model is trained based on link data from multiple microservices across multiple domains, resulting in strong generalization capabilities. When using the initial anomaly localization model for anomaly localization, it can be fine-tuned based on link data from different microservices. This fine-tuned model can then be used to locate the root cause of the link data. Root cause localization and anomaly root cause analysis can be performed using a counterfactual approach. A counterfactual query asks, under specific circumstances, what would the expected trace duration and error status be if certain spans were restored to a normal state? In other words, this query is based on a hypothetical scenario: what would the overall system performance be if certain spans were in a normal state? The initial anomaly localization model uses an iterative approach to restore services to a normal state, predict the counterfactual trace status, and check whether the predicted state is normal, thereby locating the root cause of the anomaly.

[0065] For example, we identify the initial microservices for providing computing services and storage services, obtain link data for each microservice, and construct a link data sample set. We then use this link data sample set to train the GNN-based anomaly localization model until we obtain an initial anomaly localization model that meets the training stop criteria.

[0066] To sum up, a link data sample set for training the anomaly localization model to be trained is constructed based on the link data of at least two initial microservice businesses, so that the anomaly localization model to be trained can adapt to various types of microservice businesses, and the trained anomaly localization model to be trained has better generalization ability.

[0067] Furthermore, considering that the link data of microservice business contains various types of data such as type, start time, end time, status, etc., when training the anomaly location model based on link data, considering the model's predictive ability, we can make full use of various types of data in the link data. The specific implementation is as follows:

[0068] The link data to be trained is converted into a text vector, and the time information and status information of the link data to be trained are determined; the text vector is updated based on the time information and the status information, and a link data sample corresponding to the link data to be trained is constructed based on the updated text vector.

[0069] Specifically, the text vector can be understood as an embedded feature representation of the link data to be trained. This text vector can be generated using various methods, such as the Bert model. Time information can include information such as the start time, end time, and elapsed time of the link data to be trained. State information can be determined based on the link data to be trained, using the state code or link state contained in the link data to be trained as state information. Time information can also include the start time, end time, or exclusive time corresponding to a link node contained in the link data to be trained. State information can include node state information of the link node contained in the link data to be trained.

[0070] Based on this, the link data to be trained is converted into a text vector using a coding model or coding algorithm. Time and state information of the training link data is determined. The text vector is updated based on the time and state information, incorporating the time and state information into the text vector. Link data samples corresponding to the link data to be trained are constructed based on the updated text vector.

[0071] Continuing with the above example, use the BERT or SBert model to convert the link data to be trained into a text vector. Based on the start and end times of the spans in the link data to be trained, calculate the span's exclusive time as the time information corresponding to the link data to be trained. When calculating a span's exclusive time, the relationship between parent and child spans also needs to be considered. If a span is a child span of its parent span, its exclusive time is the sum of the parent span's time minus the child span's time. If a span starts at T1 and ends at T2, and has two child spans with start times T3 and T4 and end times T5 and T6, the span's exclusive time is (T2 - T1) - (T5 - T3) - (T6 - T4).

[0072] In summary, the time information and state information of the link data are integrated into the link data to be trained, so that the anomaly localization model is trained using the link data to be trained, thereby improving the prediction accuracy of the anomaly localization model.

[0073] Furthermore, considering the high training cost of the initial anomaly localization model, in order to improve the utilization rate of the initial anomaly localization model, a more common method is to improve the generalization ability of the initial anomaly localization model so that the initial anomaly localization model has higher applicability. The specific implementation is as follows:

[0074] Determine at least two initial microservice businesses; collect at least two link data corresponding to the at least two initial microservice businesses according to a preset data collection strategy; divide the at least two link data corresponding to the at least two initial microservice businesses according to a preset data division rule, and determine a subset of link data to be trained corresponding to each initial microservice business based on the division result; and construct a link data set to be trained based on the at least two link data subsets to be trained.

[0075] Specifically, the data collection strategy can be to collect data through data collection tools, or to obtain data through manual collection; the data division rules can be divided according to the data collection time or the data generation time, or according to the data type, and the data type can be either computing data or storage data.

[0076] Based on this, at least two initial microservices of various types, such as traffic-intensive nodes, disk I / O-intensive nodes, and compute-intensive nodes, are determined. At least two pieces of link data corresponding to the at least two initial microservices are collected according to a preset data collection strategy. The at least two pieces of link data corresponding to the at least two initial microservices are partitioned according to a preset data partitioning rule. Based on the partitioning results, a subset of link data to be trained corresponding to each initial microservice is determined. A link data set to be trained is constructed based on the at least two subsets of link data to be trained.

[0077] Continuing with the previous example, select the microservices for which data collection is required, from various types of microservices, such as traffic-intensive nodes, disk I / O-intensive nodes, and compute-intensive nodes. Obtain the link data generated by each microservice. Then, perform data segmentation on the acquired link data generated by each microservice to achieve data classification. Based on the classification results, determine the link data subset corresponding to each microservice. Based on these link data subsets, construct link datasets for training in various dataset types.

[0078] In summary, a link dataset to be trained is constructed based on the link data of at least two initial microservice businesses, thereby enriching the data types and business types in the link dataset to be trained. After training the anomaly localization model, the generalization ability of the model and the prediction accuracy of the model are improved.

[0079] Furthermore, considering the complexity of the data structure of the link data to be trained, the various types of data in the link data to be trained can be integrated, so that when the anomaly localization model is subsequently trained, the anomaly localization model can fully learn the characteristics of the sample data and improve the prediction ability of the anomaly localization model. The specific implementation is as follows:

[0080] The link data to be trained is encoded, and a text vector corresponding to the link data to be trained is determined based on the processing result; the start time and end time of the sub-link data contained in the link data to be trained are calculated, and the time information corresponding to the link data to be trained is determined based on the calculation result; and the sub-state information of the sub-link data contained in the link data to be trained is used as the state information of the link data to be trained.

[0081] Based on this, the SBert model is used to encode the link data to be trained. The text vector corresponding to the link data to be trained is determined based on the processing results. The sub-link data contained in the link data to be trained is determined, and the exclusive time of the sub-link data is calculated based on the start and end times of the sub-link data. The exclusive time of the sub-link data contained in the link data to be trained is used as the time information of the link data to be trained. The sub-state information of the sub-link data contained in the link data to be trained is used as the state information of the link data to be trained.

[0082] Continuing with the previous example, encode the service and name in the trace data with semantic information (using SBert to convert them into a 768-dimensional vector). During encoding, remove special characters, perform hexadecimal encoding, and uniformly convert uppercase and lowercase letters. Calculate the exclusive time of the span (sub-link data). The duration of a synchronization span for non-leaf nodes includes the time spent in the service and the wait time of its subspans. Separating the duration from the wait time facilitates locating the root cause of high trace latency.

[0083] To summarize, various types of data such as time information and state information in the training link data are integrated, so that when the anomaly localization model is subsequently trained, the anomaly localization model can fully learn the characteristics of the sample data and improve the prediction ability of the anomaly localization model.

[0084] Step S204: determining a link data set to be processed corresponding to the microservice business, clustering the link data set to be processed, and determining cluster center link data according to the clustering result.

[0085] Specifically, after obtaining the historical link data corresponding to the microservice business and updating the initial anomaly location model to the target anomaly location model based on the historical link data, the link data set to be processed corresponding to the microservice business can be determined, and the link data set to be processed can be clustered, and the cluster center link data can be determined according to the clustering results, wherein the link data set to be processed refers to the link data set obtained by collecting link data for the microservice business; the link data set to be processed contains link data with anomalies; the clustering method can use the DBSCAN algorithm, k-means algorithm, etc., and this embodiment does not impose any restrictions on this; the cluster center link data refers to the link data of the cluster center to be processed obtained after clustering the link data set to be processed, which is used to input into the target anomaly location model for anomaly detection.

[0086] Based on this, after obtaining the historical link data corresponding to the microservice business and updating the initial anomaly localization model to the target anomaly localization model based on the historical link data, link data collection is performed on the microservice business. The link data collection strategy is used to collect the link data corresponding to the microservice business as the link data set to be processed. The distance index corresponding to the link data to be processed is determined, and the link data set to be processed is clustered based on the distance index. The cluster center link data is determined based on the clustering results.

[0087] In practical applications, a span identifier consists of its label: a (Service, name, kind) tuple, its error state, and the labels of all ancestor spans within a maximum distance of d_max to reflect the structure and state of a given trace. Different spans sharing the same identifier are merged in a set, and their weight is equal to the sum of their durations. When the structure and execution state of two traces are similar, identical elements with similar weights can be found in the two trace sets. We use the extended Jaccard index to calculate the similarity of trace sets. Clustering is performed using the DBSCAN algorithm to obtain trace clusters with similar structures, and representative trace links (cluster centers) are found from them as trace links to be analyzed for root cause.

[0088] Step S206: inputting the cluster center link data into the target anomaly location model to obtain abnormal link node information corresponding to the cluster center link data.

[0089] Specifically, after determining the pending link data set corresponding to the microservice business and clustering the pending link data set, and determining the cluster center link data based on the clustering results, the cluster center link data can be input into the target anomaly positioning model to obtain the abnormal link node information corresponding to the cluster center link data, wherein the abnormal link node information refers to the abnormal description information or abnormal node description information. For example, if the abnormal description information records type A data, the abnormal link node is the node that records type A data; if the abnormal description information records data B (data or string), the abnormal link node is the node that records data B. The abnormal link node information can be the abnormal information contained in the cluster center link data, and the types of abnormalities include but are not limited to data abnormalities, label abnormalities, state abnormalities, time abnormalities, and resource abnormalities.

[0090] Based on this, after determining the pending link data set corresponding to the microservice business and clustering it, the cluster center link data is determined based on the clustering results. This cluster center link data is then input into the target anomaly localization model. The target anomaly localization model uses a counterfactual method to locate the root cause of the cluster center link data. The target anomaly localization model then outputs the abnormal link node information corresponding to the cluster center link data. Based on this abnormal link node information, anomaly analysis and fault recovery are then performed.

[0091] In practical applications, the target anomaly location model can be an anomaly location model obtained by causally modeling trace data using a GNN model. Causal Bayesian Networks (CBN) based on Bayesian theory is used to characterize the propagation of error information in trace data. GIN is used to embed the trace link data, and learning is performed through a specific loss function to finally complete the learning of the embedded features. The loss function can be the following formula (1):

[0092] Among them, d i Indicates the time taken by Span; Indicates the exclusive time of Span; e i Indicates the error state of Span; This means that during the error propagation process of a parent span, the parent span's own error, the duration of the child span, and the error status must be considered, and the largest value among these is selected as the parent span's error. This ensures that the error can be correctly propagated along the causal DAG (directed acyclic graph).

[0093] Furthermore, when determining the link data to be processed corresponding to the microservice business, considering the convenience and accuracy of data acquisition, existing data collection technology can be used to implement data collection. The specific implementation is as follows:

[0094] At least two pieces of to-be-processed link data corresponding to the microservice business are acquired based on a preset data acquisition strategy; and a to-be-processed link data set is constructed using the at least two pieces of to-be-processed link data.

[0095] Based on this, we use OpenTelemetry (a distributed link tracing standard) and link data collection tools to collect link data for microservices. We then obtain data on at least two pending links corresponding to the microservices based on a pre-set data acquisition strategy. We then store the data on at least two pending links in a dataset to build a dataset of pending links.

[0096] Continuing with the previous example, OpenTelemetry consists of a set of APIs and SDK tools used to observe, generate, collect, and export various observable data. When collecting microservice link data, OpenTelemetry is used to collect trace data from microservices. The collected trace data is stored in a collection to construct the link dataset to be processed.

[0097] In summary, the link data to be processed corresponding to the microservice business is obtained through the preset data acquisition strategy, thereby improving the efficiency and accuracy of link data acquisition.

[0098] Furthermore, considering the large amount of link data in microservices, performing anomaly detection and root cause location on each link data will consume a lot of computing resources and processing time. To improve the efficiency of anomaly detection and root cause location, the link data to be processed can be clustered to determine the cluster center link data, and then the cluster center link data can be input into the target anomaly location model. The specific implementation is as follows:

[0099] Determine the link data to be processed contained in the link data set to be processed; cluster the link data set to be processed according to the data structure, link state and time weight of each link data to be processed in the link data set to be processed, and determine the cluster center link data according to the clustering result.

[0100] Specifically, clustering is the process of dividing a collection of physical or abstract objects into clusters of similar objects. A cluster is a collection of data objects that are similar to objects in the same cluster and dissimilar to objects in other clusters. Clustering can be achieved using clustering algorithms such as the k-means algorithm and the DBSCAN algorithm.

[0101] Based on this, the link data set to be processed includes at least two link data to be processed. The link data set to be processed is clustered according to the data structure such as the name label, type label, link status and time weight of each link data to be processed in the link data set to be processed, and at least one cluster center link data is determined based on the clustering result.

[0102] Continuing with the above example, a span identifier consists of a label: a (Service, name, kind) tuple, as well as the error state and the labels of all ancestor spans within the maximum distance, reflecting the structure and state of a given trace. Different spans sharing the same identifier are merged in a set, with a weight equal to the sum of their durations. When the structure and execution state of two traces are similar, identical elements with similar weights can be found in the two trace sets. We use the extended Jaccard index to calculate the similarity of trace sets. Clustering is performed using the DBSCAN algorithm to obtain trace clusters with similar structures, and representative trace links (cluster centers) are found from them as trace links to be analyzed for root cause.

[0103] In summary, by clustering the link data set to be processed and determining the cluster center link data based on the clustering results, the cluster center link data is input into the target anomaly location model to determine the abnormal link nodes, thereby improving the efficiency of anomaly detection and root cause location and reducing the consumption of computing resources and time.

[0104] Step S208: Determine a target abnormal link corresponding to the microservice business based on the abnormal link node information, and determine an abnormal link node in the target abnormal link.

[0105] Specifically, after inputting the cluster center link data into the target anomaly positioning model and obtaining the abnormal link node information corresponding to the cluster center link data, the target abnormal link corresponding to the microservice business can be determined based on the abnormal link node information, and the abnormal link node can be determined in the target abnormal link, wherein the target abnormal link refers to the microservice business link corresponding to the abnormal link node information; since the target abnormal link contains at least one link node, the abnormal link node is the node with an abnormality in the target abnormal link.

[0106] Based on this, after inputting the cluster center link data into the target anomaly location model and obtaining the abnormal link node information corresponding to the cluster center link data, the target abnormal link data corresponding to the microservice business is determined based on the abnormal link node information. The target abnormal link is then determined based on the target abnormal link data, and the abnormal link node is then determined within the target abnormal link. This facilitates subsequent anomaly analysis and handling of the target abnormal link node, achieving anomaly recovery.

[0107] Furthermore, considering that the abnormal link node information contains attribute information such as the abnormal link identifier, the target abnormal link data is prioritized before determining the target abnormal link. The specific implementation is as follows:

[0108] Based on the abnormal link node information, target abnormal link data is determined in the link data set to be processed; based on the target abnormal link data, a target abnormal link corresponding to the microservice business is determined; based on the abnormal link node information, an abnormal link node is determined in the target abnormal link.

[0109] Specifically, the target abnormal link data refers to the link data with abnormalities in the link data set to be processed. The abnormal data in the target abnormal link data may be of various types, including but not limited to data abnormalities, label abnormalities, state abnormalities, time abnormalities, and resource abnormalities.

[0110] Based on this, target abnormal link data corresponding to the abnormal link node information and having an abnormality is determined in the link data set to be processed based on the abnormal link node information. A target abnormal link in the microservice business that matches the target abnormal link data is determined based on the target abnormal link data. An abnormal link node is determined in the target abnormal link based on the abnormal node information contained in the abnormal link node information.

[0111] Continuing with the above example, the abnormal link node information can include the link label of the abnormal link and the label of the link node that caused the abnormality in the abnormal link. Based on the link label contained in the abnormal link node information, the target abnormal link data corresponding to the abnormal link node information with the abnormality is determined in the link dataset to be processed. The target abnormal link A corresponding to the target abnormal link data is determined, and based on the link node label that caused the abnormality in the abnormal link, the link node a that caused the abnormality is determined in the target abnormal link A. This facilitates subsequent abnormality processing for link node a.

[0112] In summary, the target abnormal link corresponding to the microservice business is determined based on the target abnormal link data, and then the abnormal link node in the target abnormal link is determined, thereby improving the accuracy of abnormal link node determination.

[0113] Furthermore, after determining the abnormal link node, considering that the abnormal node will lead to the normal operation of the microservice business, it is necessary to perform subsequent abnormal feedback and abnormal processing on the abnormal link node. The specific implementation is as follows:

[0114] Generate abnormal information based on the abnormal link node; and feed back the abnormal information to an information receiver corresponding to the microservice business.

[0115] Specifically, the abnormal information may include the link node identifier of the abnormal link node, the abnormal type, the abnormal time, and other information; the information receiver may be a client or user who performs root cause location.

[0116] Based on this, the abnormal type and abnormal time of the abnormal link node are determined, and abnormal information is generated based on the link node identifier, abnormal type, abnormal time and other information of the abnormal link node. The abnormal information is fed back to the information receiver corresponding to the microservice business.

[0117] Continuing with the previous example, after the abnormal link node is identified, its node label P and the abnormality type (calculation anomaly and the time when the anomaly occurred) are determined. Based on the abnormal link node's node label P, the calculation anomaly, and the time when the anomaly occurred, anomaly information is generated and sent to the client or user.

[0118] In summary, by obtaining historical link data corresponding to the microservice business and determining the target anomaly location model corresponding to the historical link data; determining the link data set to be processed corresponding to the microservice business, clustering the link data set to be processed, and determining the cluster center link data based on the clustering results; inputting the cluster center link data into the target anomaly location model to obtain the abnormal link node information corresponding to the cluster center link data; based on the abnormal link node information, determining the target abnormal link corresponding to the microservice business, and identifying the abnormal link node in the target abnormal link. Based on the initial anomaly location model, the model is fine-tuned to make the adjusted initial anomaly location model applicable to the specific microservice business, making the initial anomaly location model more widely applicable and more generalizable; when locating the root cause through the target anomaly location model, the cluster center link data is selected for root cause location, thereby improving the root cause location speed of the microservice business.

[0119] The following further describes the root cause location method provided in this specification using the application of the root cause location method in root cause location as an example, with reference to FIG3 . FIG3 shows a flowchart of a process of a root cause location method provided in one embodiment of this specification, specifically including the following steps.

[0120] With the advancement of computer technology, microservices in the cloud are rapidly developing. A microservices architecture is highly scalable, highly available, and easy to maintain and update. The increasing scale of microservices complicates the RPC dependency graph, exacerbating the tail-of-scale effect and rendering many empirical rules unreliable. Previous work on microservice performance debugging has relied on correlations, empirical thresholds, or non-scalable algorithms and deep learning models. These methods have not been quantitatively evaluated using microservice benchmarks at comparable production service scales, making their accuracy and performance questionable for production-scale microservices. As microservices scale, many heuristic root cause analysis algorithms based on empirical and rule-based approaches become unreliable or even unverifiable.

[0121] In the existing technology, microservice performance debugging efforts are based on correlation, empirical thresholds, or non-scalable algorithms and deep learning models, resulting in low accuracy and slow speed. When microservices scale, algorithms that rely on experience and rules to locate the root cause become unreliable or even impossible to locate the root cause. Therefore, when a fault occurs, new methods are needed to locate the root cause of the fault. In order to perform root cause diagnosis on microservice trace data in a production environment and improve problem solving efficiency, this embodiment provides a root cause location method.

[0122] Step S302: determining at least two initial microservices, and collecting at least two pieces of link data corresponding to the at least two initial microservices according to a preset data collection strategy.

[0123] To increase the richness of data samples, trace data from different business systems is collected during link data collection. This improves the generalization capabilities of subsequent models. As shown in Figure 4, during data collection, existing data generated by multiple business systems is obtained and used as raw trace data. Link data collection can be implemented using Open Telemetry (a distributed link tracing standard).

[0124] Step S304: Divide the at least two link data corresponding to the at least two initial microservice businesses according to a preset data division rule, and construct a link data set to be trained based on the division result.

[0125] Since the amount of raw trace data collected is large, it is necessary to divide the link data in the business system according to the Service dimension and sample it according to a certain distribution based on the service operation time, so that the training samples can cover all service nodes and as many trace data forms as possible.

[0126] Step S306: performing encoding processing on the link data to be trained in the link data set to be trained, and determining the text vector corresponding to the link data to be trained according to the processing result.

[0127] Perform feature engineering on raw trace data. This includes steps such as text vectorization, span exclusive time, error status determination, and span exclusive time normalization. In the text vectorization step, the SBert model is used to process the raw trace data and convert text into vectors.

[0128] Step S308: Determine the time information and state information corresponding to the link data to be trained in the link data set to be trained.

[0129] Calculate the exclusive time and true state of spans in trace data as labels for subsequent model training. By processing Open Telemetry trace data, use the spanID and parentSpanID in the data to construct an RPC dependency graph (remote procedure call dependency graph), renaming the dependency graph with the corresponding (service, name, kind). The trace start time (startTime), end time (endTime), duration (duration), and status code are proactively obtained.

[0130] The service and name in the trace data are semantically encoded (converted to a 768-dimensional vector using SBert). Special characters are removed, hexadecimal encoding is performed, and uppercase and lowercase letters are uniformly converted. Span exclusive time is calculated. The duration of a synchronization span for a non-leaf node includes the time spent in the service and the wait time of its child spans. Separating the span duration from the wait time can help pinpoint the root cause of high-latency traces, as the span duration can be used to predict potential time savings if the performance issues associated with the span are mitigated. In Figure 4, the exclusive time of the parent span (P) is (T1-T0)+(T5-T4), the exclusive time of span (A) is T3-T1, and the exclusive time of span (B) is T4-T2. Span duration conversion: Duration values ​​are scaled using a base-10 logarithmic transformation. Furthermore, we normalize the dataset using a global mean of 4.0 and a standard deviation of 1.0 so that the anomaly localization model can be directly applied to the tracking dataset without rescaling.

[0131] Step S310: construct link data samples corresponding to the link data to be trained based on the time information, state information and text vector, and form a link data sample set.

[0132] Figure 4 illustrates a feature in detail. In the graph, 1, 2, and 3 represent Service, Operation, and Kind, respectively. 4 and 5 represent SpanID and Parent SpanID, respectively. 6, 7, 8, and 9 represent Start, End, Duration, and Status, respectively. The graph represents a trace data sample.

[0133] Step S312: train the anomaly localization model to be trained using the link data sample set until an initial anomaly localization model that meets the training stop condition is obtained.

[0134] The GIN model is trained using a sample set of link data to obtain an anomaly location model with generalization capabilities. Anti-real-time queries are generated to locate the root cause of abnormal trace links. CBN (Causal Bayesian Networks, a causal inference network based on Bayesian theory) is used to characterize the propagation of error information in trace data. GIN (Graph Isomorphism Network) is used to embed and encode trace link data, and learning is performed through a specific loss function to ultimately complete the learning of embedded features. Root cause analysis is performed using a counterfactual method. Counterfactual queries refer to what the expected trace duration and error status would be if certain spans were restored to normal under specific circumstances. In other words, this query is based on a hypothetical situation, that is, assuming that certain spans are in a normal state, how would the entire system operate?

[0135] Step S314: Obtain historical link data corresponding to the microservice business, and update the initial anomaly location model to the target anomaly location model based on the historical link data.

[0136] After obtaining an initial anomaly localization model capable of locating the root cause of anomalies, the initial anomaly localization model can be applied. As shown in Figure 5, existing data from the microservice business is obtained as historical link data for fine-tuning the initial anomaly localization model. The initial anomaly localization model is fine-tuned by combining existing data with log data from log storage. This pre-training process results in a new model suitable for the current microservice business, namely the target anomaly localization model.

[0137] Step S316: Determine the to-be-processed link data set corresponding to the microservice business, and determine the to-be-processed link data contained in the to-be-processed link data set.

[0138] When performing trace root cause diagnosis, link data is collected in real time, and the collected link data is filtered based on specific filtering conditions to obtain candidate data. Based on the candidate data, a data set of links to be processed that require root cause diagnosis in the microservice business is constructed.

[0139] Step S318: clustering the link data set to be processed, and determining the cluster center link data according to the clustering result.

[0140] A specific clustering algorithm is used to cluster the candidate data and obtain candidate data for each cluster center. The span identifier consists of its label: (Service, name, kind) tuple, its error state and the labels of all ancestor spans within a maximum distance of d_max to reflect the structure and state of a given trace. Different spans sharing the same identifier are merged in a set, and their weight is equal to the sum of their durations. When the structure and execution state of two traces are similar, the same elements with similar weights can be found in the two trace sets. We use the extended Jaccard index to calculate the similarity of trace sets. , Use the DBSCAN algorithm for clustering to obtain trace clusters with similar structures, and find representative (cluster center) trace links from them as trace links to be analyzed for root cause.

[0141] Step S320: input the cluster center link data into the target anomaly location model to obtain the abnormal link node information corresponding to the cluster center link data.

[0142] The new model obtained after updating the initial anomaly location model is loaded, and the candidate data of each cluster center is inferred based on the new model to achieve the root cause location of each cluster center candidate data.

[0143] Step S322: Determine the target abnormal link corresponding to the microservice business based on the abnormal link node information, and determine the abnormal link node in the target abnormal link.

[0144] After determining the abnormal link nodes corresponding to each cluster center candidate data, determine the abnormal link nodes where the abnormality is located, and perform abnormal processing on the abnormal nodes, or record abnormal information.

[0145] In practical applications, microservices can be synthesized to provide larger-scale validation data. However, the microservice systems found in open-source data are relatively simple, involving a limited number of service node types. This cannot accurately reflect the scale and complexity of microservice systems in real production environments. Furthermore, given the limited number of tested microservice systems, it is also impossible to accurately assess the capabilities of each individual system. Therefore, during the experimental evaluation phase, a microservice generation system was developed that supports the generation of microservice systems with complex network structures and provides common fault injection methods.

[0146] As shown in Figure 6, several services (0-9) are generated, and RPCs are assigned to different services, forming the entire microservice system. A service is randomly labeled as a frontend, middleware, backend, or leaf node, with these services having different positions and fan-outs in the RPC dependency graph. A set of commonly used service and RPC names is also collected and assigned to services and RPCs to enhance their semantics in trace data. The generated services and RPCs are then used to generate a logical RPC dependency graph based on certain policies. This execution graph describes the order and dependencies of child RPCs called by the same parent node. An edge from a parent RPC to a child RPC indicates that the parent node can directly call the child RPC without waiting for the results of any other child RPCs. An edge between two child RPCs indicates that the target RPC is called after receiving and processing the response from the source RPC. Through these steps, a microservice system can be generated with a clear definition. Different types of services (such as traffic-intensive nodes, disk I / O-intensive nodes, and compute-intensive nodes) are attached to each node, and the microservice system is deployed on a cloud platform. With the help of relevant data collectors, subsequent algorithm verification can be carried out.

[0147] In this example, we designed a GNN-based model to identify root causes in microservices. This model outperforms previous work in terms of accuracy, performance, and flexibility, particularly at large scale. We also proposed a distance metric to measure the similarity between two traces for clustering. This metric is capable of distinguishing traces with different call paths and failure modes. To quantitatively evaluate our approach on production-scale microservices, we designed an evaluation method using synthetic benchmark generation. This benchmark can be generated at any scale and deployed in a Kubernetes cluster to mimic the behavior of real-world production services.

[0148] In summary, by obtaining historical link data corresponding to the microservice business and determining the target anomaly location model corresponding to the historical link data; determining the link data set to be processed corresponding to the microservice business, clustering the link data set to be processed, and determining the cluster center link data based on the clustering results; inputting the cluster center link data into the target anomaly location model to obtain the abnormal link node information corresponding to the cluster center link data; based on the abnormal link node information, determining the target abnormal link corresponding to the microservice business, and identifying the abnormal link node in the target abnormal link. Based on the initial anomaly location model, the model is fine-tuned to make the adjusted initial anomaly location model applicable to the specific microservice business, making the initial anomaly location model more widely applicable and more generalizable; when locating the root cause through the target anomaly location model, the cluster center link data is selected for root cause location, thereby improving the root cause location speed of the microservice business.

[0149] Corresponding to the above method embodiment, this specification also provides an embodiment of a root cause location device. FIG7 shows a schematic diagram of the structure of a root cause location device provided in one embodiment of this specification. As shown in FIG7, the device includes:

[0150] The acquisition module 702 is configured to acquire historical link data corresponding to the microservice business and update the initial anomaly localization model to a target anomaly localization model based on the historical link data;

[0151] The clustering module 704 is configured to determine a data set of links to be processed corresponding to the microservice business, cluster the data set of links to be processed, and determine cluster center link data according to the clustering result;

[0152] An input module 706 is configured to input the cluster center link data into the target anomaly location model to obtain abnormal link node information corresponding to the cluster center link data;

[0153] The determination module 708 is configured to determine a target abnormal link corresponding to the microservice business based on the abnormal link node information, and determine an abnormal link node in the target abnormal link.

[0154] In an optional embodiment, the acquisition module 702 is further configured to:

[0155] The initial anomaly location model is updated to a target anomaly location model corresponding to the historical link data; wherein the training of the initial anomaly location model includes: determining a link data set to be trained based on at least two initial microservice businesses; constructing a link data sample set based on at least two link data to be trained contained in the link data set to be trained;

[0156] The link data sample set is used to train the anomaly localization model to be trained until an initial anomaly localization model that meets the training stop condition is obtained.

[0157] In an optional embodiment, the acquisition module 702 is further configured to:

[0158] The link data to be trained is converted into a text vector, and the time information and status information of the link data to be trained are determined; the text vector is updated based on the time information and the status information, and a link data sample corresponding to the link data to be trained is constructed based on the updated text vector.

[0159] In an optional embodiment, the acquisition module 702 is further configured to:

[0160] Determine at least two initial microservice businesses; collect at least two link data corresponding to the at least two initial microservice businesses according to a preset data collection strategy; divide the at least two link data corresponding to the at least two initial microservice businesses according to a preset data division rule, and determine a subset of link data to be trained corresponding to each initial microservice business based on the division result; and construct a link data set to be trained based on the at least two link data subsets to be trained.

[0161] In an optional embodiment, the acquisition module 702 is further configured to:

[0162] The link data to be trained is encoded, and a text vector corresponding to the link data to be trained is determined based on the processing result; the start time and end time of the sub-link data contained in the link data to be trained are calculated, and the time information corresponding to the link data to be trained is determined based on the calculation result; and the sub-state information of the sub-link data contained in the link data to be trained is used as the state information of the link data to be trained.

[0163] In an optional embodiment, the input module 706 is further configured to:

[0164] At least two pieces of to-be-processed link data corresponding to the microservice business are acquired based on a preset data acquisition strategy; and a to-be-processed link data set is constructed using the at least two pieces of to-be-processed link data.

[0165] In an optional embodiment, the input module 706 is further configured to:

[0166] Determine the link data to be processed contained in the link data set to be processed; cluster the link data set to be processed according to the data structure, link state and time weight of each link data to be processed in the link data set to be processed, and determine the cluster center link data according to the clustering result.

[0167] In an optional embodiment, the determining module 708 is further configured to:

[0168] Based on the abnormal link node information, target abnormal link data is determined in the link data set to be processed; based on the target abnormal link data, a target abnormal link corresponding to the microservice business is determined; based on the abnormal link node information, an abnormal link node is determined in the target abnormal link.

[0169] In an optional embodiment, the determining module 708 is further configured to:

[0170] Generate abnormal information based on the abnormal link node; and feed back the abnormal information to an information receiver corresponding to the microservice business.

[0171] In summary, by obtaining historical link data corresponding to the microservice business and determining the target anomaly location model corresponding to the historical link data; determining the link data set to be processed corresponding to the microservice business, clustering the link data set to be processed, and determining the cluster center link data based on the clustering results; inputting the cluster center link data into the target anomaly location model to obtain the abnormal link node information corresponding to the cluster center link data; based on the abnormal link node information, determining the target abnormal link corresponding to the microservice business, and identifying the abnormal link node in the target abnormal link. Based on the initial anomaly location model, the model is fine-tuned to make the adjusted initial anomaly location model applicable to the specific microservice business, making the initial anomaly location model more widely applicable and more generalizable; when locating the root cause through the target anomaly location model, the cluster center link data is selected for root cause location, thereby improving the root cause location speed of the microservice business.

[0172] The above is a schematic diagram of a root cause locating device according to this embodiment. It should be noted that the technical solution of the root cause locating device and the technical solution of the root cause locating method described above are based on the same concept. For details not described in detail in the technical solution of the root cause locating device, please refer to the description of the technical solution of the root cause locating method described above.

[0173] Corresponding to the above method embodiments, this specification also provides a root cause positioning system embodiment. FIG8 is an architecture diagram of a root cause positioning system provided by one embodiment of this specification. The root cause positioning system 800 includes a server 810 and a client 820.

[0174] The client 820 submits an exception location request to the server 810 for the target microservice business;

[0175] The server 810 parses the anomaly location request to obtain debugging link data and target link data; updates the initial anomaly location model to a to-be-used anomaly location model based on the debugging link data; clusters the target link data and determines the to-be-input link data based on the clustering result; inputs the to-be-input link data into the to-be-used anomaly location model to obtain abnormal node information corresponding to the target microservice business; determines an abnormal node based on the abnormal node information, and generates abnormal feedback information based on the abnormal node and the abnormal node information; and sends the abnormal feedback information as a response to the anomaly location request to the client 820;

[0176] The client 820 performs exception processing on the target microservice business based on the exception feedback information.

[0177] In practical applications, the client corresponds to any demander who needs to locate the root cause of a microservice. The demander, through the client, submits an anomaly location request to the server. The server parses the anomaly location request and obtains debug link data and target link data. The debug link data is used to fine-tune the initial anomaly location model, ensuring that the adjusted initial anomaly location model's predictive capabilities are sufficient to locate anomalies in the target microservice's link data. Based on the debug link data, the initial anomaly location model is updated to the intended anomaly location model. The target link data is clustered, and the input link data is determined based on the clustering results. The input link data is input into the intended anomaly location model to obtain abnormal node information corresponding to the target microservice. Based on the abnormal node information, the abnormal node is determined, and abnormal feedback information is generated based on the abnormal node and abnormal node information. The abnormal feedback information is sent to the client as a response to the anomaly location request. After receiving the abnormal feedback information, the client can perform exception handling for the target microservice based on the abnormal feedback information. This exception handling includes, but is not limited to, recovering from the anomaly, recording the abnormality type and cause, and sending the abnormal feedback information to the abnormality handler.

[0178] In summary, the model is fine-tuned based on the initial anomaly localization model, so that the adjusted initial anomaly localization model is applicable to specific microservice businesses, making the initial anomaly localization model have wider applicability and stronger generalization ability; when locating the root cause through the target anomaly localization model, the cluster center link data is selected for root cause localization, which improves the root cause localization speed of the microservice business.

[0179] Figure 9 shows a block diagram of a computing device 900 according to one embodiment of the present disclosure. Components of the computing device 900 include, but are not limited to, a memory 910 and a processor 920. The processor 920 is connected to the memory 910 via a bus 930, and a database 950 is configured to store data.

[0180] The computing device 900 also includes an access device 940 that enables the computing device 900 to communicate via one or more networks 960. Examples of such networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 940 may include one or more of any type of network interface (e.g., a network interface card (NIC)) whether wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a Worldwide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, or a near field communication (NFC) interface.

[0181] In one embodiment of the present specification, the aforementioned components of computing device 900 and other components not shown in FIG9 may also be connected to each other, for example, via a bus. It should be understood that the computing device block diagram shown in FIG9 is for illustrative purposes only and does not limit the scope of this specification. Those skilled in the art may add or replace other components as needed.

[0182] The computing device 900 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook computer, etc.), a mobile phone (e.g., a smartphone), a wearable computing device (e.g., a smartwatch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 900 may also be a mobile or stationary server.

[0183] The processor 920 is configured to execute the following computer-executable instructions, which implement the steps of the above-mentioned root cause location method when executed by the processor.

[0184] The above is a schematic diagram of a computing device according to this embodiment. It should be noted that the technical solution of the computing device and the technical solution of the root cause localization method described above are based on the same concept. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solution of the root cause localization method described above.

[0185] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned root cause location method.

[0186] The above is an illustrative embodiment of a computer-readable storage medium. It should be noted that the technical solution of this storage medium and the technical solution of the root cause localization method described above share the same concept. For details not described in detail in the technical solution of the storage medium, refer to the description of the technical solution of the root cause localization method described above.

[0187] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned root cause location method.

[0188] The above is an illustrative solution of a computer program of this embodiment. It should be noted that the technical solution of the computer program and the technical solution of the root cause localization method described above are based on the same concept. For details not described in detail in the technical solution of the computer program, please refer to the description of the technical solution of the root cause localization method described above.

[0189] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0190] The computer instructions include computer program code, which may be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal, and software distribution medium. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media does not include electric carrier signals and telecommunication signals.

[0191] It should be noted that for the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0192] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0193] The preferred embodiments disclosed above are provided to help illustrate this specification. The optional embodiments do not describe all details in detail, nor do they limit the invention to the specific embodiments described. Obviously, many modifications and variations can be made based on the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that those skilled in the art can better understand and use this specification. This specification is limited by the claims and their full scope and equivalents.

Claims

1. A root cause location method, comprising: Obtain historical link data corresponding to the microservice business, and determine a target anomaly location model corresponding to the historical link data; Determine a link data set to be processed corresponding to the microservice business, cluster the link data set to be processed, and determine cluster center link data according to the clustering result; Inputting the cluster center link data into the target anomaly positioning model to obtain abnormal link node information corresponding to the cluster center link data; A target abnormal link corresponding to the microservice business is determined based on the abnormal link node information, and an abnormal link node is determined in the target abnormal link.

2. According to the method of claim 1, the step of determining a target anomaly location model corresponding to the historical link data comprises: The initial anomaly location model is updated to a target anomaly location model corresponding to the historical link data; wherein the training of the initial anomaly location model comprises: determining a link data set to be trained based on at least two initial microservice businesses; constructing a link data sample set based on at least two link data to be trained contained in the link data set to be trained; and using the link data sample set to train the anomaly location model to be trained until an initial anomaly location model that meets the training stop condition is obtained.

3. The method according to claim 2, wherein the construction of any one link data sample in the link data sample set comprises: Convert the link data to be trained into a text vector, and determine the time information and state information of the link data to be trained; The text vector is updated based on the time information and the state information, and a link data sample corresponding to the link data to be trained is constructed based on the updated text vector.

4. The method according to claim 2, wherein determining the link data set to be trained based on at least two initial microservice businesses comprises: Identify at least two initial microservices. Collect at least two link data corresponding to at least two initial microservice businesses respectively according to a preset data collection strategy; Divide at least two link data corresponding to at least two initial microservice businesses respectively according to a preset data division rule, and determine a link data subset to be trained corresponding to each initial microservice business according to the division result; A link data set to be trained is constructed based on at least two link data subsets to be trained.

5. The method according to claim 3, wherein converting the link data to be trained into a text vector and determining the time information and state information of the training link data comprises: Performing encoding processing on the link data to be trained, and determining a text vector corresponding to the link data to be trained according to the processing result; The start time and end time of the sub-link data included in the link data to be trained are calculated, and the start time and end time of the sub-link data included in the link data to be trained are calculated according to the calculation result. Determine the time information corresponding to the link data to be trained; The sub-state information of the sub-link data included in the link data to be trained is used as the state information of the link data to be trained.

6. According to the method of claim 1, the step of determining the to-be-processed link data set corresponding to the microservice business comprises: Acquire at least two to-be-processed link data corresponding to the microservice business based on a preset data acquisition strategy; A link data set to be processed is constructed using at least two link data to be processed.

7. The method according to claim 1, wherein clustering the link data set to be processed and determining the cluster center link data according to the clustering result comprises: Determining the link data to be processed contained in the link data set to be processed; The link data sets to be processed are clustered according to the data structure, link state and time weight of each link data to be processed in the link data sets to be processed, and cluster center link data is determined according to the clustering result.

8. The method according to claim 1, wherein determining the target abnormal link corresponding to the microservice business based on the abnormal link node information, and determining the abnormal link node in the target abnormal link, comprises: Determine target abnormal link data in the link data set to be processed based on the abnormal link node information; Determine the target abnormal link corresponding to the microservice business based on the target abnormal link data; An abnormal link node is determined in the target abnormal link based on the abnormal link node information.

9. The method according to claim 1, after the step of determining abnormal link nodes in the target abnormal link is performed, further comprising: Generate abnormal information based on the abnormal link node; The abnormal information is fed back to the information receiver corresponding to the microservice business.

10. A root cause location system, comprising a server client; The client submits an exception location request to the server for the target microservice business; The server parses the abnormality location request to obtain debugging link data and target link data; based on the debugging link data, updates the initial abnormality location model to the abnormality location model to be used; Clustering the target link data, and determining link data to be input according to the clustering result; Input the link data to be input into the abnormal location model to be used to obtain abnormal node information corresponding to the target microservice business; Determine an abnormal node based on the abnormal node information, and generate abnormal feedback information based on the abnormal node and the abnormal node information; Sending the abnormality feedback information to the client as a response to the abnormality location request; The client performs exception processing on the target microservice business based on the exception feedback information.

11. A root cause locating device, comprising: An acquisition module is configured to acquire historical link data corresponding to the microservice business and determine a target anomaly location model corresponding to the historical link data; A clustering module is configured to determine a data set of links to be processed corresponding to the microservice business, cluster the data set of links to be processed, and determine cluster center link data according to the clustering result; An input module is configured to input the cluster center link data into the target anomaly positioning model to obtain abnormal link node information corresponding to the cluster center link data; The determination module is configured to determine a target abnormal link corresponding to the microservice business based on the abnormal link node information, and determine an abnormal link node in the target abnormal link.

12. A computing device comprising: Memory and processor; The memory is configured to store computer-executable instructions, and the processor is configured to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the root cause locating method according to any one of claims 1 to 9 are implemented.

13. A computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, implement the steps of the root cause locating method according to any one of claims 1 to 9.

Images