CN114416560A

CN114416560A - Program crash analysis aggregation method and system

Info

Publication number: CN114416560A
Application number: CN202210060228.4A
Authority: CN
Inventors: 金健翔; 赵晨辰
Original assignee: Shanghai Bilibili Technology Co Ltd
Current assignee: Shanghai Bilibili Technology Co Ltd
Priority date: 2022-01-19
Filing date: 2022-01-19
Publication date: 2022-04-29

Abstract

The application discloses a program crash analysis polymerization method, which comprises the following steps: receiving program crash information of user equipment; filtering the program crash information of the user equipment, and distributing the filtered program crash information; analyzing the filtered program crash information to obtain a label; and storing the filtered program crash information and the label into a database for query, reading and/or aggregation analysis. In the application, the closed-loop full flow is realized through the steps, the safety of data, particularly the safety of program sensitive data is ensured, and the hidden danger of 'system unavailability' of an external platform is eliminated; and problems can be efficiently and accurately located and analysis reports can be generated.

Description

Program crash analysis aggregation method and system

Technical Field

The present application relates to the field of data processing, and in particular, to a method and an apparatus for analyzing and aggregating program crash, a computer device, and a computer-readable storage medium.

Background

With the rapid development of internet technology, more and more application software can be installed on the device. The difference of each platform causes that when the user uses the application software, the online crash situation often occurs, and the online crash situation is analyzed by the aid of an external platform.

The existing program crash analysis aggregation platform has the following defects: (1) data security is poor; (2) the hidden danger of 'system unavailability' of an external platform is easily encountered; (3) problem location and aggregation are inefficient and inaccurate.

Disclosure of Invention

In view of the above, embodiments of the present application provide a program crash analysis and aggregation method, an apparatus, a computer device, a computer readable storage medium, and a program crash analysis and aggregation system, which can solve the above problems.

One aspect of the present application provides a program crash analysis aggregation method, including:

receiving program crash information of user equipment;

filtering the program crash information of the user equipment, and distributing the filtered program crash information;

analyzing the filtered program crash information to obtain a label;

and storing the filtered program crash information and the label into a database for query, reading and/or aggregation analysis.

Optionally, the filtering the program crash information of the user equipment includes:

filtering program crash information of the user equipment according to a plurality of preset fields;

wherein the plurality of fields include a base field and an extension field;

the extension field comprises a crash type, stack information, a crash description, a crash page and equipment running state information during crash.

Optionally, the tag includes a first tag and a second tag, and the filtered program crash information includes stack information and crash description;

the parsing the filtered program crash information to obtain a tag includes:

transmitting the stack information to an analysis layer, and analyzing the stack information through the analysis layer to obtain analyzed stack information;

generating a first label according to the analyzed stack information;

generating a second label according to the crash description;

writing the first tag and the second tag to the database;

wherein the first tag and the second tag are both associated with the program crash information at the database.

Optionally, the generating a first tag according to the parsed stack information includes:

deleting invalid information in the analyzed stack information to obtain valid stack information associated with the program; wherein the invalid information comprises at least one or more of: information, numbers associated with the operating system; and

and calculating the first label through a Hash algorithm according to the effective stack information associated with the program.

Optionally, the user equipment is an iOS device; the analyzing the stack information through the analyzing layer to obtain analyzed stack information includes:

inquiring the name of the target function through the identifier and the offset of the symbol table in the stack information and the symbol table file of the IPA;

wherein the offset is the difference between the address where the crash occurs and a preset reference address;

and the function corresponding to the target function name is used for calling the object with the crash.

Optionally, the user equipment is an Android device; the analyzing the stack information through the analyzing layer to obtain analyzed stack information includes:

inquiring the data before confusion through the confusion data in the stack information and the mapping file for constructing the APK;

wherein the obfuscated data is a class name of the program when running;

and the data before confusion comprises a target function name, and a function corresponding to the target function name is used for calling the object with the crash.

Optionally, the method further includes:

aggregating the program crash information of the preset time period in the database based on the first label and the second label to obtain a plurality of aggregated data; each piece of data in the same aggregated data has the same first label and/or the same second label;

generating an analysis result based on the plurality of aggregated data, the analysis result including one or more problems that caused the program to crash; and

sending the analysis report into one or more target groups associated with the one or more issues.

Another aspect of the embodiments of the present application provides a program crash analysis and aggregation apparatus, including:

the receiving module is used for receiving program crash information of the user equipment;

the distribution module is used for filtering the program crash information of the user equipment and distributing the filtered program crash information;

the analysis module is used for analyzing the filtered program crash information to obtain a label;

and the storage module is used for storing the filtered program crash information and the label into a database for query, reading and/or aggregation analysis.

Yet another aspect of embodiments of the present application provides a computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, the processor when executing the computer program implementing the steps of the program crash analysis aggregation method as described above.

Yet another aspect of embodiments of the present application provides a computer-readable storage medium having stored therein a computer program executable by at least one processor to cause the at least one processor to perform the steps of the program crash analysis aggregation method as described above.

Yet another aspect of an embodiment of the present application provides a program crash analysis and aggregation system, including:

the data transmission layer is used for receiving program crash information of the user equipment;

the data consumption layer is used for receiving and filtering the program crash information of the user equipment and distributing the filtered program crash information;

the data cleaning layer is used for analyzing the filtered program collapse information to obtain a label;

and the storage layer is used for storing the filtered program crash information and the label for inquiry, reading and/or aggregation analysis.

Optionally, the data consumption layer is further configured to:

wherein the plurality of fields include a base field and an extension field;

the data cleaning layer is further configured to:

generating a first label according to the analyzed stack information;

generating a second label according to the crash description;

writing the first tag and the second tag to the storage layer;

wherein the first tag and the second tag are both associated with the program crash information at the storage tier.

wherein the obfuscated data is a class name of the program when running;

Optionally, an automatic diagnostic system is further included for:

aggregating the program crash information of the storage layer in a preset time period based on the first label and the second label to obtain a plurality of aggregated data; each piece of data in the same aggregated data has the same first label and/or the same second label; and

The program crash analysis and aggregation method, device, equipment, computer-readable storage medium and program crash analysis and aggregation system provided by the application have the following advantages:

(1) the closed-loop full flow is realized, and the safety of data, especially the safety of program sensitive data, is ensured;

(2) based on the closed-loop full flow, the method does not depend on the data management of an external platform any more, and eliminates the hidden trouble of 'system unavailability' of the external platform;

(3) the filtered program crash information is analyzed to obtain a label, and the label is stored in the database together, so that each piece of data of the database can be aggregated through the label, problems can be efficiently and accurately located, and an analysis report can be generated.

Drawings

FIG. 1 schematically shows an architecture diagram of a program crash analysis aggregation system according to a first embodiment of the present application;

FIG. 2 schematically illustrates a workflow of an automated diagnostic system;

FIG. 3 schematically shows a flow diagram of a program crash analysis aggregation system according to a second embodiment of the present application;

FIG. 4 schematically shows a sub-flowchart of step S302 in FIG. 3;

FIG. 5 schematically shows a sub-flowchart of step S304 in FIG. 3;

FIG. 6 schematically shows a sub-flowchart of step S502 in FIG. 5;

FIG. 7 schematically shows a sub-flowchart of step S500 in FIG. 5;

FIG. 8 schematically shows another sub-flowchart of step S500 in FIG. 5;

FIG. 9 is a flowchart schematically illustrating additional steps of a program crash analysis aggregation method according to a second embodiment of the present application;

fig. 10 schematically shows a block diagram of a program crash analysis aggregation apparatus according to a third embodiment of the present application;

fig. 11 schematically shows a hardware architecture diagram of a computer device suitable for implementing the program crash analysis aggregation method according to a fourth embodiment of the present application.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

It should be noted that the descriptions relating to "first", "second", etc. in the embodiments of the present application are only for descriptive purposes and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In addition, technical solutions between various embodiments may be combined with each other, but must be realized by a person skilled in the art, and when the technical solutions are contradictory or cannot be realized, such a combination should not be considered to exist, and is not within the protection scope of the present application.

In the description of the present application, it should be understood that the numerical references before the steps do not identify the order of performing the steps, but merely serve to facilitate the description of the present application and to distinguish each step, and therefore should not be construed as limiting the present application.

The applicant has appreciated that:

the problem of online crash, typically with third party platforms such as Bugly, firbase …, has several problems:

1) the rights cannot converge. After leaving the job, some personnel still have the authority to check the APP sensitive data.

2) The maintenance strength gradually becomes lower, and the situation of 'unable to analyze normally' gradually occurs.

3) The requirements cannot be customized, the data of the three-party platform is too closed, and the expansion business cannot be consumed normally.

4) The problem of large disks cannot be solved, and different problems cannot be divided into different services.

The application aims to provide a program crash analysis aggregation scheme, which is implemented by a closed-loop process, stack analysis and aggregation and a derivative product system. The program crash analysis aggregation scheme can be referred to the following examples.

Example one

As shown in fig. 1, an embodiment of the present application provides a program crash analysis and aggregation system, including:

(1) and the data transmission layer 2 is used for receiving the program crash information of the user equipment.

The data transport layer 2 may be implemented by a Kafka system or other messaging system for receiving program crash information for a large number of user terminals. The Kafka system is a distributed, partitioned, multi-copy, multi-subscriber and zookeeper-based coordinated distributed log system (which can be commonly used for web/nginx logs, access logs, message services and the like).

As an example, the user equipment may be configured to report program crash information. Among other things, the user devices may include mobile devices, tablet devices, laptop computers, smart devices (e.g., smart watches, smart glasses), virtual reality headsets, gaming devices, set-top boxes, digital streaming devices, robots, vehicle terminals, smart televisions, e-book readers, MP4 (moving picture experts group audio layer IV) players, and the like. The user equipment can run Windows system and Android (Android)^TM) System or iOS system, etc. The user can install various application program installation packages according to the requirements, so that the application programs realizing various specific functions can be obtained. The user equipment may be preset with a program for embedding points, and the program for embedding points may report program crash information.

Taking the reporting of the program crash information from the user equipment a as an example, a buried point program may be implanted in the user equipment a. The buried point is also called Event tracing (Event tracing), and can capture, process, and transmit the behavior or Event in the device. In the case of detecting that a program of the user equipment a crashes, the user equipment a may cache crash information of the program into a local file. And after the program is started again, reporting the crash information to the data transmission layer 2. For example, APM (Application Performance Management) may be distributed to Kafka system for execution on a specified call link.

(2) And the data consumption layer 4 is used for receiving and filtering the program crash information of the user equipment and distributing the filtered program crash information.

The data consumption layer 4 is responsible for the filtering and distribution of messages.

Namely: crash-related information is retrieved from the data transport layer 2 and the filtered "valid data" is passed to the data cleansing layer 6.

As an alternative embodiment, the data consumption layer 4 is also used to: filtering program crash information of the user equipment according to a plurality of preset fields; wherein the plurality of fields include a base field and an extension field; the extension field comprises a crash type, stack information, a crash description, a crash page and equipment running state information during crash. The base field may include the following fields: crash occurrence time, device model, program version, system version, program distribution channel, etc. The device operational state information at crash time may include the following fields: crash memory information, CPU information, disk information, etc. In this alternative embodiment, by filtering out valid information that can be used for crash analysis, interference of invalid information and system burden can be reduced.

(3) And the data cleaning layer 6 is used for analyzing the filtered program crash information to obtain a label.

The filtered program crash information includes stack information, crash description, and the like.

The stack information is used for recording and tracing a function calling process, such as a function called when a program crashes. However, the stack information directly provided by the user equipment is not readable, and thus needs to be parsed to obtain readable stack information. Further, abnormality, problem classification, and labeling are performed by the readable stack information. Therefore, the crash information of each program of the same type of problems can be determined through the label, and query and management are facilitated.

As an alternative embodiment, the label includes a first label and a second label, and the filtered program crash information includes stack information and a crash description;

the data cleaning layer 6 is further configured to:

generating a first label according to the analyzed stack information;

generating a second label according to the crash description;

writing the first and second tags to the storage layer 8;

In the above optional embodiment, the first tag and the second tag are configured for each piece of program crash information, and are considered as follows: in some cases, the stack information after the analysis is empty, and the valid tag cannot be set, so the second tag is set as a supplement. In addition, in the case where the first label and the second label are mutually certified, efficient aggregation is facilitated.

It should be noted that the first label and the second label may be hash values or values obtained based on other algorithms. The hash value is obtained by mapping a long piece of data (String) into a short piece of data through a hash algorithm (e.g., MD5, SHA-1), and the short piece of data is the hash value. The hash value has uniqueness, and if the hash values corresponding to different crash descriptions are different, the same crash description corresponds to the same hash value, so that the hash value can be used for subsequent classification and aggregation.

The stack information differs for different types of user equipment, and several exemplary parsing approaches are provided below.

As an optional embodiment, the user equipment is an iOS device; the analyzing the stack information through the analyzing layer to obtain analyzed stack information includes: inquiring the name of the target function through the identifier and the offset of the symbol table in the stack information and the symbol table file of the IPA; wherein the offset is the difference between the address where the crash occurs and a preset reference address; and the function corresponding to the target function name is used for calling the object with the crash.

After an IPA (Apple program application file) is built, the iOS device generates a side file dSYM symbol table file (each symbol table corresponds to a universal unique identification code uuid), and stores a function name + an offset inside. After the symbol table file is parsed, the mapping relationship information + uuid is stored in a database (such as MySQL).

When the stack information is acquired, the target function name is found back from the MySQL database through the symbol table uuid + offset (abnormal address-base address calculation) of the stack information, namely, the target function name fed back by the iOS device is rapidly analyzed.

As an optional embodiment, the user equipment is an Android device; the analyzing the stack information through the analyzing layer to obtain analyzed stack information includes: inquiring the data before confusion through the confusion data in the stack information and the mapping file for constructing the APK; wherein the obfuscated data is a class name of the program when running; and the data before confusion comprises a target function name, and a function corresponding to the target function name is used for calling the object with the crash.

After an Android device constructs an APK (Android application package), a byproduct mapping file is generated, and a class name classname of an installation package in actual operation is confusion data, for example: xx, x needs to perform back-check analysis through the content in mapping. In this embodiment, the mapping file is analyzed, and the mapping relationship obtained through the analysis is stored in a database (for example, MySQL).

When the stack information is acquired, aiming at the obfuscated information, data before obfuscation is led out from the MySQL database, and a target function name is obtained through reverse search, namely the target function name fed back by the Android device is rapidly analyzed.

As an optional embodiment, the generating a first label according to the parsed stack information includes: deleting invalid information in the analyzed stack information to obtain valid stack information associated with the program; wherein the invalid information comprises at least one or more of: information, numbers associated with the operating system; and calculating the first label through a Hash algorithm according to the effective stack information associated with the program. Cleaning through the analyzed stack information: (1) filtering floating noise data such as some binary offsets, some numbers, system symbol table information and the like can ensure that first labels (hash values) corresponding to a plurality of pieces of program crash information which are crashed due to the same problem are the same, and effective aggregation is ensured. (2) And information related to the operating system is cleaned, only information related to the program is reserved, and the problem of the program is quickly checked.

The data cleansing rule, the analysis rule, and the like of the data cleansing layer 6 may be defined by a configuration file. Moreover, various functions in the data cleaning layer 6 can be plugged in, so that automatic customization and expansion of the functions are realized.

(4) And the storage layer 8 is used for storing the filtered program crash information and the label for inquiry, reading and/or aggregation analysis.

The storage tier 8 may be based on Elasticsearch, Clickhouse, Hive, MySQL, etc.

The elastic search is a search server based on Lucene, and provides a full-text search engine with distributed multi-user capability based on RESTful web interface. The ClickHouse is based on OLAP scene requirements, a set of efficient column type storage engines is customized and developed, and functions of data ordered storage, primary key index, sparse index, data partitioning, primary and standby copying and the like are achieved. Hive is a data warehouse tool based on Hadoop, which is used for data extraction, transformation and loading, and is a mechanism for storing, querying and analyzing large-scale data stored in Hadoop. MySQL is a Relational Database Management System, one of RDBMS (Relational Database Management System) application software.

Each piece of data in the storage layer 8 includes: the filtered program crash information, tags (first tag, second tag).

Each piece of data may be categorized based on its label, such that pieces of data having the same label are aggregated.

The storage layer 8 may provide data services for third party service platforms.

The third-party service platform can analyze the change trend of the crash and can inquire and locate a certain type of problem.

In specific application, the change trend of the crash and the query and positioning of a certain kind of problems can be displayed through the front-end page. The front-end page is also configured with a plurality of components, such as components of "program version", "system version", "device model", "network type", "crash page", "process", "thread", and the like. Taking "system version" as an example, when the user triggers the component, the system versions with crashes are listed, and the number of crashes, the occupation ratio, and the like of the system versions are analyzed and displayed. And the front-end page is also provided with a downloading component, and the program crash information of the selected system version can be downloaded through the downloading component.

(5) Optionally, the system may also customize the automated diagnostic system 10.

An automated diagnostic system 10 for: the sorting and aggregation operations are performed according to the label of each piece of data in the storage layer 8.

By way of example, the automated diagnostic system 10 is configured to:

aggregating the program crash information of the storage layer in a preset time period based on the first label and the second label to obtain a plurality of aggregated data; each piece of data in the same aggregated data has the same first label and/or the same second label;

The automated diagnostic system 10 may be diagnostic online or offline. The online diagnosis refers to automatic detection and diagnosis according to real-time incremental data (e.g., a preset time period). The online diagnosis is not stopped, the diagnosis range of the online diagnosis is large, and the content of the display information is also large. The offline diagnosis refers to automatic detection and diagnosis according to offline data. The mass data can be processed asynchronously through off-line diagnosis, and the method is suitable for background full-scale analysis.

As shown in fig. 2, the automated diagnostic system 10 may be used to include:

when an online abnormity occurs, triggering an automatic diagnosis/analysis service;

the automatic diagnosis/analysis service pulls out a large amount of user data (full link monitoring data, user logs or other data, wherein the full link monitoring data can comprise program crash information) for automatic analysis aiming at the abnormal time period to obtain an analysis result;

and generating an analysis report based on the analysis result, and pushing the analysis report to a target group, such as an instant messaging group.

Illustratively, the analysis report may be as follows: "

And (4) crash alarm:

the application comprises the following steps: XX Equipment model

Version: 64700100

First trigger time: 2021-11-0810:42:21

Current trigger time: 2021-11-0810:43:36

Influence scope:

in the last 5 minutes, 166 users were affected in total, 75067 total users were started, and the collapse rate was 0.22%.

Problem location: (last 5 minutes data)

Sorting by exception type

The first type of abnormal proportion: 90.70 percent;

the second type of anomaly accounts for: 5.81 percent;

the third type of anomaly accounts for: 1.16 percent;

sorting by crash information

First-class collapse ratio: 90.12 percent;

second type collapse ratio: 5.81 percent;

…”。

in the above embodiment, the analysis report may be sent to the corresponding target group according to the located problem, thereby implementing service isolation, where the crashes are all large disk problems, and different problems may be divided into different groups.

In an exemplary embodiment, the business alert system, the stack resolution platform, etc. may also be customized based on the storage tier 8. The stack parsing platform is used for stack parsing, ANR (Application Not Responding) parsing, stuck analysis, memory analysis, disk analysis, os analysis, and the like. On Android, applications are not sensitive enough to respond for a while, and the system displays a dialog box called ANR dialog box to the user. The user may choose to have the program continue running or exit.

It should be noted that the above layers are implemented by servers, such as rack servers, blade servers, tower servers, or rack servers (including independent servers or a server cluster composed of multiple servers).

In addition, the above layers are connected by one or more networks. The one or more networks may include, among other things, various network devices such as routers, switches, multiplexers, hubs, modems, bridges, repeaters, firewalls, proxy devices, and/or the like. The one or more networks may also include physical links, such as coaxial cable links, twisted pair cable links, fiber optic links, combinations thereof, and/or the like, and may also include wireless links, such as cellular links, satellite links, Wi-Fi links, and/or the like.

The data transfer layer 2, the data consumption layer 4, the data cleansing layer 6, the storage layer 8, and the automatic diagnostic system 10 are described in detail above.

The program crash analysis and aggregation system provided by the embodiment of the application has the following advantages:

(1) the internal chains of the data transmission layer 2, the data consumption layer 4, the data cleaning layer 6 and the storage layer 8 realize a closed-loop whole flow, so that the safety of data, especially program sensitive data, is ensured;

(2) by adopting the closed loop process, the data management of an external platform is not relied on, and the hidden danger of 'system unavailability' of the external platform is eliminated;

(3) the data cleaning layer 6 updates the analysis rule in real time, and the cleaning and effective analysis of the stack data are ensured through the data cleaning layer 6;

(4) the data processing function can be expanded through a customized automatic diagnosis system and monitoring/alarming of a service line custom rule;

(5) the polymerization can be carried out through the label, the polymerization degree is high and accurate, the problem can be efficiently and accurately positioned, and an analysis report can be generated;

(6) the analysis report can be sent to the corresponding target group according to the positioned problem, thereby realizing service isolation.

Example two

The embodiment provides a program crash analysis aggregation method, and specific details can refer to the first embodiment.

Fig. 3 schematically shows a flowchart of a program crash analysis aggregation method according to the second embodiment of the present application.

As shown in fig. 3, the program crash analysis aggregation method may include steps S300 to S306, wherein:

step S300, receiving program crash information of the user equipment.

Step S302, filtering the program crash information of the user equipment, and distributing the filtered program crash information.

Step S304, the filtered program crash information is analyzed to obtain a label.

Step S306, storing the filtered program crash information and the label into a database for query, reading and/or aggregation analysis.

The program crash analysis and polymerization method provided by the embodiment of the application has the following advantages:

(1) the closed-loop full process is realized through the steps, so that the safety of data, particularly the safety of program sensitive data, is ensured;

(3) the filtered program crash information is analyzed to obtain a label, and the label is stored in the database together, so that each piece of data in the database can be aggregated through the label, and problems can be efficiently and accurately located and an analysis report can be generated;

(4) the data processing function can be expanded through a customized automatic diagnosis system and monitoring/alarming of a service line custom rule.

As an alternative embodiment, as shown in fig. 4, step S302 may be implemented as follows:

step S400, filtering program crash information of the user equipment according to a plurality of preset fields;

wherein the plurality of fields include a base field and an extension field;

Wherein the base field may include the following fields: crash occurrence time, device model, program version, system version, program distribution channel, etc. The device operational state information at crash time may include the following fields: crash memory information, CPU information, disk information, etc. In this alternative embodiment, by filtering out valid information that can be used for crash analysis, interference of invalid information and system burden can be reduced.

as shown in fig. 5, step S304 can be implemented as follows:

step S500, transmitting the stack information to an analysis layer, and analyzing the stack information through the analysis layer to obtain analyzed stack information;

step S502, generating a first label according to the analyzed stack information;

step S504, generating a second label according to the crash description;

step S506, writing the first label and the second label into the database;

In the above optional embodiment, the first tag and the second tag are configured for each piece of program crash information, which is considered as follows: in some cases, the stack information after the analysis is empty, and the valid tag cannot be set, so the second tag is set as a supplement. In addition, in the case where the first label and the second label are mutually certified, efficient aggregation is facilitated.

As an alternative embodiment, as shown in fig. 6, step S502 may be implemented as the following steps:

step S600, deleting invalid information in the analyzed stack information to obtain valid stack information associated with the program; wherein the invalid information comprises at least one or more of: information, numbers associated with the operating system; and

step S602, calculating by a hash algorithm according to the valid stack information associated with the program itself to obtain the first label.

Cleaning the analyzed stack information: (1) filtering floating noise data such as some binary offsets, some numbers, system symbol table information and the like can ensure that first labels (hash values) corresponding to a plurality of pieces of program crash information which are crashed due to the same problem are the same, and effective aggregation is ensured. (2) And information related to the operating system is cleaned, only information related to the program is reserved, and the problem of the program is quickly checked.

As an optional embodiment, the user equipment is an iOS device; as shown in fig. 7, step S500 may be implemented as follows:

step S700, inquiring the name of the target function through the mark and the offset of the symbol table in the stack information and constructing a symbol table file of IPA;

When the stack information is acquired, the target function name is found back from the MySQL database through the symbol table uuid + offset (abnormal address-base address calculation) of the stack information, and the target function name fed back by the iOS device can be effectively analyzed.

As an optional embodiment, the user equipment is an Android device; as shown in fig. 8, step S500 may be implemented as follows:

step S800, inquiring the data before confusion through the confusion data in the stack information and the mapping file for constructing the APK;

wherein the obfuscated data is a class name of the program when running;

Specifically, when the stack information is acquired, for the information after confusion, data before confusion is led out from the MySQL database, and a target function name is obtained through reverse search, so that the target function name fed back by the Android device can be effectively analyzed.

As an alternative embodiment, as shown in fig. 9, the method may further include:

step S900, aggregating program crash information in a preset time period in the database based on the first label and the second label to obtain a plurality of aggregated data; each piece of data in the same aggregated data has the same first label and/or the same second label;

step S902, generating an analysis result based on the aggregated data, wherein the analysis result comprises one or more problems causing program crash; and

step S904, sending the analysis report to one or more target groups associated with the one or more questions.

In the above optional embodiment, the analysis report may be sent to the corresponding target group according to the located problem, thereby implementing service isolation, where the crashes are all large disk problems, and different problems may be divided into different groups.

EXAMPLE III

Fig. 10 schematically shows a block diagram of a program crash analysis aggregation apparatus according to a third embodiment of the present application. The program crash analysis aggregation apparatus may be divided into one or more program modules, and the one or more program modules are stored in a storage medium and executed by one or more processors to implement the embodiments of the present application. The program modules referred to in the embodiments of the present application refer to a series of computer program instruction segments that can perform specific functions, and the following description will specifically describe the functions of the program modules in the embodiments.

As shown in fig. 10, the crash analysis aggregation apparatus 1000 may include:

a receiving module 1010, configured to receive program crash information of a user equipment;

a distributing module 1020, configured to filter program crash information of the user equipment, and distribute the filtered program crash information;

the analysis module 1030 is configured to analyze the filtered program crash information to obtain a tag;

the storage module 1040 is configured to store the filtered program crash information and the tag in a database for querying, reading, and/or aggregation analysis.

As an alternative embodiment, the distribution module 1020 is further configured to:

wherein the plurality of fields include a base field and an extension field;

the parsing module 1030 is further configured to:

generating a first label according to the analyzed stack information;

generating a second label according to the crash description;

writing the first tag and the second tag to the database;

As an alternative embodiment, the parsing module 1030 is further configured to:

As an optional embodiment, the user equipment is an iOS device; the parsing module 1030 is further configured to:

As an optional embodiment, the user equipment is an Android device; the parsing module 1030 is further configured to:

wherein the obfuscated data is a class name of the program when running;

As an optional embodiment, the apparatus further comprises an analysis module configured to:

Example four

Fig. 11 schematically shows a hardware architecture diagram of a computer device suitable for implementing the program crash analysis aggregation method according to a fourth embodiment of the present application. In this embodiment, the computer device 10000 is a device capable of automatically performing numerical calculation and/or information processing according to a preset or stored instruction, for example, a mobile device, a tablet device, a laptop computer, a smart device (e.g., a smart watch, smart glasses), a virtual reality headset, a game device, a set-top box, a digital streaming device, a robot, a vehicle-mounted terminal, a smart television, an electronic book reader, an MP4 (moving picture experts group audio layer IV) player, and the like. As shown in fig. 11, computer device 10000 includes at least, but is not limited to: the memory 10010, processor 10020, and network interface 10030 may be communicatively linked to each other via a system bus. Wherein:

the memory 10010 includes at least one type of computer-readable storage medium including a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory, etc.), a Random Access Memory (RAM), a Static Random Access Memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, and the like. In some embodiments, the storage 10010 may be an internal storage module of the computer device 10000, such as a hard disk or a memory of the computer device 10000. In other embodiments, the memory 10010 may also be an external storage device of the computer device 10000, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), or the like, provided on the computer device 10000. Of course, the memory 10010 may also include both internal and external memory modules of the computer device 10000. In this embodiment, the memory 10010 is generally used for storing an operating system and various application software installed in the computer device 10000, such as program codes of the program crash analysis and aggregation method. In addition, the memory 10010 may also be used to temporarily store various types of data that have been output or are to be output.

Processor 10020, in some embodiments, can be a Central Processing Unit (CPU), controller, microcontroller, microprocessor, or other data Processing chip. The processor 10020 is generally configured to control overall operations of the computer device 10000, such as performing control and processing related to data interaction or communication with the computer device 10000. In this embodiment, the processor 10020 is configured to execute program codes stored in the memory 10010 or process data.

Network interface 10030 may comprise a wireless network interface or a wired network interface, and network interface 10030 is generally used to establish a communication link between computer device 10000 and other computer devices. For example, the network interface 10030 is used to connect the computer device 10000 to an external terminal through a network, establish a data transmission channel and a communication link between the computer device 10000 and the external terminal, and the like. The network may be a wireless or wired network such as an Intranet (Intranet), the Internet (Internet), a Global System of Mobile communication (GSM), Wideband Code Division Multiple Access (WCDMA), a 4G network, a 5G network, Bluetooth (Bluetooth), or Wi-Fi.

It should be noted that fig. 11 only shows a computer device having the components 10010-10030, but it should be understood that not all of the shown components are required to be implemented, and more or less components may be implemented instead.

In this embodiment, the program crash analysis and aggregation method stored in the memory 10010 can be further divided into one or more program modules and executed by one or more processors (in this embodiment, the processor 10020) to complete the present application.

EXAMPLE five

The present embodiment further provides a computer-readable storage medium, on which a computer program is stored, and the computer program, when executed by a processor, implements the steps of the program crash analysis and aggregation method in the second embodiment.

In this embodiment, the computer-readable storage medium includes a flash memory, a hard disk, a multimedia card, a card type memory (e.g., SD or DX memory, etc.), a Random Access Memory (RAM), a Static Random Access Memory (SRAM), a Read Only Memory (ROM), an Electrically Erasable Programmable Read Only Memory (EEPROM), a Programmable Read Only Memory (PROM), a magnetic memory, a magnetic disk, an optical disk, and the like. In some embodiments, the computer readable storage medium may be an internal storage unit of the computer device, such as a hard disk or a memory of the computer device. In other embodiments, the computer readable storage medium may be an external storage device of the computer device, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), and the like provided on the computer device. Of course, the computer-readable storage medium may also include both internal and external storage devices of the computer device. In this embodiment, the computer-readable storage medium is generally used for storing an operating system and various types of application software installed in a computer device, for example, the program code of the program crash analysis aggregation method in the embodiment, and the like. Further, the computer-readable storage medium may also be used to temporarily store various types of data that have been output or are to be output.

It will be apparent to those skilled in the art that the modules or steps of the embodiments of the present application described above may be implemented by a general purpose computing device, they may be centralized on a single computing device or distributed across a network of multiple computing devices, and alternatively, they may be implemented by program code executable by a computing device, such that they may be stored in a storage device and executed by a computing device, and in some cases, the steps shown or described may be performed in an order different from that described herein, or they may be separately fabricated into individual integrated circuit modules, or multiple ones of them may be fabricated into a single integrated circuit module. Thus, embodiments of the present application are not limited to any specific combination of hardware and software.

The above description is only a preferred embodiment of the present application, and not intended to limit the scope of the present application, and all modifications of equivalent structures and equivalent processes, which are made by the contents of the specification and the drawings of the present application, or which are directly or indirectly applied to other related technical fields, are included in the scope of the present application.

Claims

1. A program crash analysis aggregation method, comprising:

receiving program crash information of user equipment;

analyzing the filtered program crash information to obtain a label; and

2. The program crash analysis aggregation method as recited in claim 1,

the filtering program crash information of the user equipment comprises:

wherein the plurality of fields include a base field and an extension field;

3. The program crash analysis aggregation method of claim 1, wherein the tags comprise a first tag and a second tag, and wherein the filtered program crash information comprises stack information and a crash description;

the parsing the filtered program crash information to obtain a tag includes:

generating a first label according to the analyzed stack information;

generating a second label according to the crash description;

writing the first tag and the second tag to the database;

4. The program crash analysis aggregation method according to claim 3, wherein the generating a first tag according to the parsed stack information comprises:

5. The program crash analysis aggregation method according to claim 3, wherein the user device is an iOS device; the analyzing the stack information through the analyzing layer to obtain analyzed stack information includes:

6. The program crash analysis and aggregation method according to claim 3, wherein the user equipment is an Android device; the analyzing the stack information through the analyzing layer to obtain analyzed stack information includes:

wherein the obfuscated data is a class name of the program when running;

7. The program crash analysis aggregation method according to any one of claims 3 to 6, further comprising:

8. A program crash analysis aggregation apparatus, comprising:

9. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor is configured to implement the steps of the program crash analysis aggregation method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, having stored thereon a computer program which is executable by at least one processor to cause the at least one processor to perform the steps of the program crash analysis aggregation method according to any one of claims 1 to 7.

11. A program crash analysis aggregation system, comprising:

12. The program crash analysis aggregation system of claim 11, wherein the data consumption layer is further configured to:

wherein the plurality of fields include a base field and an extension field;

13. The program crash analysis aggregation system of claim 11, wherein the tags comprise a first tag and a second tag, and wherein the filtered program crash information comprises stack information and a crash description;

the data cleaning layer is further configured to:

generating a first label according to the analyzed stack information;

generating a second label according to the crash description;

writing the first tag and the second tag to the storage layer;

14. The program crash analysis and aggregation system of claim 13, wherein the generating a first tag from the parsed stack information comprises:

15. The program crash analysis and aggregation system of claim 13, wherein the user device is an iOS device; the analyzing the stack information through the analyzing layer to obtain analyzed stack information includes:

16. The program crash analysis and aggregation system of claim 13, wherein the user device is an Android device; the analyzing the stack information through the analyzing layer to obtain analyzed stack information includes:

wherein the obfuscated data is a class name of the program when running;

17. The program crash analysis aggregation system of any one of claims 13-16, further comprising an automated diagnostic system to: