CN117170926A - Methods, devices, equipment and storage media for determining the root cause of anomalies - Google Patents

Abstract

The embodiment of the application provides a method, a device, equipment and a storage medium for determining an abnormal root cause, and relates to the field of log analysis. The method comprises the following steps: counting the logs in the counting period to obtain a log set corresponding to the target constant information; determining at least one abnormal log set according to whether the target constant information corresponding to the log set is the reference constant information; obtaining a first abnormal log set chain according to each adjacent abnormal log set; and determining the root cause log in the statistical period according to the first abnormal log set chain. The embodiment of the application realizes more accurate and efficient log root cause analysis.

Description

Methods, devices, equipment and storage media for determining the root cause of anomalies

Technical field

This application relates to the field of operation and maintenance technology. Specifically, this application relates to a method, device, equipment and storage medium for determining the root cause of anomalies.

Background technique

The industry has already conducted research and achieved results on methods for mining and locating IT system logs. The most traditional method is manual step-by-step inspection based on operation and maintenance experience. Currently, there are two most common methods: patterned intelligent analysis method, based on RCA rules. root cause location. However, these two solutions have the following shortcomings:

1. Model-based intelligent analysis. This solution has become a common practice in the industry and has a certain hit rate. However, the actual call of IT system logs is complex and variable. This solution will still aggregate a large number of log models (log models can be understood as constant information of logs), which may lead to missed or misjudged decisions, resulting in inaccurate root cause node positioning. For example: changes in the log model are closely related to the business, and occasional increases or decreases in logs are not necessarily true anomalies.

2. Root cause location based on RCA rules mainly relies on the topological relationship of components to further explore the abnormal correlation relationships of components. It relies heavily on topology relationships. Once the topology does not exist in the CMDB (Configuration Management Database) or the topology is not updated in time, it will directly affect the accuracy of root cause location.

Contents of the invention

The embodiments of the present application provide a method, device, equipment and storage medium for determining the root cause of an abnormality, to solve one of the above technical problems.

On the one hand, embodiments of the present application provide a method for determining the root cause of an abnormality, which method includes:

For each log generated in real time within the statistical period, determine the generation time and constant information of the log; if it is determined that there is no statistical period corresponding to the log, use the constant information of the log as the target constant information, and create a target constant based on the generation time of the log. The statistical period associated with the information, and statistics of the logs generated within the statistical period associated with the created target constant information are performed to obtain a log set corresponding to the target constant information; the constant information of each log in the log set is the target constant information. At least one abnormal log set is determined based on whether the corresponding target constant information of the log set is reference constant information, and the reference constant information is the constant information of the historical log; each abnormal log set is arranged in the order of the statistical period. Obtain the first abnormal log set chain based on each adjacent abnormal log set; the interval between the corresponding statistical periods of the adjacent abnormal log sets in the first abnormal log set chain does not exceed the first duration, the beginning and the end of the abnormal log set The length of time between the corresponding statistical periods shall not exceed the second length of time. Determine the root cause log in the statistical period according to the first abnormal log set chain.

Optional, determine the constant information of the log, including:

Determine the constant feature information and variable feature information in the log. Replace the variable characteristic information in the log with preset constants, and determine the replaced log as the constant information of the log.

Optionally, determine the statistical period corresponding to no logs, including:

For the first log generated within the statistical period, it is determined that there is no statistical period corresponding to the log; for the non-first log generated within the statistical period, if each created statistical period does not include the period of the log If the generation time or the constant information of the log is different from the target constant information corresponding to each statistical period, it is determined that there is no statistical period corresponding to the log.

Optionally, determine at least one exception log set based on whether the target constant information corresponding to the log set is reference constant information, including:

For each log set, if the corresponding target constant information of the log set is not the reference constant information, the log set is determined to be an abnormal log set. If the corresponding target constant information of the log set is reference constant information, the log set is determined to be an abnormal log set based on the number of logs in the log set.

Optionally, each reference constant information is associated with a first fluctuation threshold and a second fluctuation threshold, and the first fluctuation threshold is greater than the second fluctuation threshold;

The log set is determined to be an abnormal log set based on the number of logs in the log set, including:

Determine the reference constant information that is the same as the target constant information corresponding to the log set. If the number of logs in the log set is greater than the first fluctuation threshold associated with the determined reference constant information, or if the number of logs in the log set is less than the second fluctuation threshold associated with the determined reference constant information, the log set is determined to be an abnormal log set.

Optionally, obtain the first exception log set chain based on each adjacent exception log set, including:

Arrange each abnormal log set according to the timing of the corresponding statistical period to obtain the abnormal log set sequence. Determine at least one second abnormal log set chain from the abnormal log set sequence according to the first duration; the interval between the corresponding statistical periods of adjacent abnormal log sets in the second abnormal log set chain does not exceed the First duration. For each second abnormal log set chain, if the length of time between the corresponding statistical periods of the first and last abnormal log sets in the second abnormal log set chain does not exceed the second length of time, determine the second abnormal log set The set chain is the first abnormal log set chain; if the second time period is exceeded, at least one first abnormal log set chain is determined based on the second abnormal log set chain.

Optionally, determine the root cause log in the statistical period based on the first abnormal log set chain, including:

For each first abnormal log set chain, the first abnormal log set of the first abnormal log set chain and other abnormal log sets with the same statistical period as the first abnormal log set are used as candidate log sets. If the number of candidate log sets is one, the logs in the candidate log set are used as the root cause logs of the statistical period. If the number of candidate log sets is multiple, determine the candidate log sets whose corresponding target constant information in the multiple candidate log sets is non-reference constant information, and use the logs in the determined candidate log sets as the root cause logs of the statistical period. If the target constant information corresponding to at least two candidate log sets in the multiple candidate log sets is reference constant information, then determine the candidate log sets in at least two abnormal log sets that meet the preset fluctuation conditions, and use the logs in the determined candidate log sets as The root cause log of the statistical period; the preset fluctuation condition is that the number of logs in the candidate log set has the largest fluctuation relative to the first fluctuation threshold or the second fluctuation threshold.

On the other hand, embodiments of the present application provide a device for determining the root cause of anomalies, which device includes:

The statistics module is used to determine the generation time and constant information of the log for each log generated in real time during the statistical period; if it is determined that there is no statistical period corresponding to the log, the constant information of the log will be used as the target constant information, and the log will be generated based on the generation time of the log. Create a statistical period associated with the target constant information, and count the logs generated within the statistical period associated with the created target constant information to obtain a log set corresponding to the target constant information; the constant information of each log in the log set is the target constant information.

The first determination module is used to determine at least one abnormal log set based on whether the corresponding target constant information of the log set is reference constant information, and the reference constant information is the constant information of the historical log; each abnormal log set is arranged in the order of the statistical period.

The aggregation link module is used to obtain a first abnormal log set chain according to each adjacent abnormal log set; the interval between the corresponding statistical periods of adjacent abnormal log sets in the first abnormal log set chain does not exceed the first time length. , the interval between the corresponding statistical periods of the first and last exception log sets shall not exceed the second period.

The second determination module is used to determine the root cause log in the statistical period according to the first abnormal log set chain.

An embodiment of the present application provides an electronic device. The electronic device includes: a memory, a processor, and a computer program stored on the memory. The processor executes the computer program to implement the steps of a method for determining the root cause of an abnormality.

Embodiments of the present application provide a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of a method for determining the root cause of an abnormality are implemented.

The beneficial effects brought by the technical solutions provided by the embodiments of this application are:

Constant information and statistical periods are essentially tools for classifying logs. Therefore, determining the constant information of the log, and when it is determined that there is no statistical period corresponding to the log, creating a statistical period associated with the constant information of the log based on the generation time of the log, can achieve the purpose of creating a classification tool. Furthermore, two tools, statistical period and constant information, can be used to perform preliminary classification processing on the logs generated in real time during the statistical period to obtain a log set. Later, the root cause log set of abnormal events can be analyzed based on the log set.

Furthermore, different exception judgments are implemented for the log sets corresponding to the "new" and "old" target constant information. Determine at least one exception log set according to whether the "target constant information" is reference constant information. For the target constant information that is reference constant information, it is an "old" target constant information, not the target of reference constant information. Constant information is a "new" target constant information. Two different target constant information have different abnormality discrimination standards. Through this step, abnormality judgment can be achieved on log sets with different abnormality standards.

The first duration and the second duration are essentially time slices modeled on the standard settings of abnormal events in real-life scenarios. For example, the first duration is the duration between adjacent abnormal points in the abnormal event, while the second duration is the maximum duration of the abnormal event. duration. Linking each abnormal log set according to the first duration and the second duration is essentially to converge the abnormal log set into a first abnormal log set chain that represents the abnormal event through time slicing. Finally, the first abnormal log set chain can be analyzed Produce the root cause log in the statistical period, that is, the root cause log of abnormal events.

This method can be used to classify and count the massive logs generated in real time, and to achieve accurate and efficient log root cause analysis based on the log set obtained from classification.

Description of drawings

In order to explain the technical solutions in the embodiments of the present application more clearly, the drawings needed to be used in the description of the embodiments of the present application will be briefly introduced below.

Figure 1 is a schematic flowchart of a method for determining the root cause of an abnormality provided by an embodiment of the present application;

Figure 2 is a schematic structural diagram of multiple first exception log set chains provided by the embodiment of the present application;

Figure 3 is a schematic structural diagram of an anomaly reasoning device provided by an embodiment of the present application;

Figure 4 is a schematic diagram of a root cause positioning process provided by an embodiment of the present application;

Figure 5 is a schematic structural diagram of a device for determining the root cause of an abnormality provided by an embodiment of the present application;

FIG. 6 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.

Detailed ways

The embodiments of the present application are described below with reference to the drawings in the present application. It should be understood that the embodiments described below in conjunction with the accompanying drawings are exemplary descriptions for explaining the technical solutions of the embodiments of the present application, and do not limit the technical solutions of the embodiments of the present application.

Those skilled in the art will understand that, unless expressly stated otherwise, the singular forms "a", "an", "the" and "the" used herein may also include the plural form. It should be further understood that the terms "comprising" and "including" used in the embodiments of this application mean that the corresponding features can be implemented as the presented features, information, data, steps, operations, elements and/or components, but do not exclude Implementation is other features, information, data, steps, operations, elements, components and/or their combinations supported by the technical field. It should be understood that when we refer to an element being "connected" or "coupled" to another element, it can be directly connected or coupled to the other element, or one element and the other element may be connected to the other element through intervening elements. Establish connections. Additionally, "connected" or "coupled" as used herein may include wireless connections or wireless couplings. The term "and/or" as used herein indicates at least one of the items defined by the term, for example, "A and/or B" indicates implemented as "A", or implemented as "A", or implemented as "A and B" ".

In order to make the purpose, technical solutions and advantages of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

First, several terms involved in this application will be introduced and explained:

Convergence: Convergence is an economics and mathematics term and an important tool for studying functions. It means converging on a point and approaching a certain value. Convergence types include convergence sequence, function convergence, global convergence, and local convergence.

Log model: Log is a kind of semi-structured data generated by specific code. As the mainstream method of log analysis in the industry, the model can help us quickly understand the log overview and compress millions of logs into hundreds of log templates. It can achieve the purpose of being visible to the human eye. For example, the constant information of the log in the embodiment of this application is a log model.

Sequence (or dynamic sequence): refers to a sequence in which the values of the same statistical indicator are arranged in the order of their occurrence time.

Root cause analysis: Root cause analysis is a structured problem-solving method that is used to gradually find out the root cause of the problem and solve it, rather than just focusing on the symptoms of the problem. The so-called root cause is the most basic reason that causes the problem we are concerned about.

The following describes the technical solutions of the embodiments of the present application and the technical effects produced by the technical solutions of the present application through the description of several exemplary embodiments. It should be noted that the following embodiments can be referred to, borrowed from, or combined with each other. The same terms, similar features, and similar implementation steps in different embodiments will not be repeatedly described.

Figure 1 shows a schematic flowchart of a method for determining the root cause of an anomaly. Among them, the method includes steps S110 to S140.

S110, for each log generated in real time during the statistical period, determine the generation time and constant information of the log; if it is determined that there is no statistical period corresponding to the log, use the constant information of the log as the target constant information, and create a log based on the generation time of the log. The statistical period associated with the target constant information, and statistics of logs generated within the statistical period associated with the created target constant information are performed to obtain a log set corresponding to the target constant information; the constant information of each log in the log set is the target constant information.

Among them, after obtaining the logs in the statistical period, the logs are preprocessed to clean up unimportant logs or invalid logs and other dirty logs to reduce interference to the abnormality judgment process.

Specifically, for each log generated in real time during the statistical period, it is determined whether there is a statistical period corresponding to the log according to the order of the log generation time. Among them, the statistical period corresponding to the log can be understood as the generation time of the log within the statistical period, and the constant information string of the log is the target constant information corresponding to the statistical period.

Among them, each statistical period is a preset duration.

In one possible implementation, implementation steps for determining the statistical period corresponding to no log are provided, including:

For the first log generated within the statistical period, it is determined that there is no statistical period corresponding to the log. For non-first logs generated within the statistical period, if each created statistical period does not include the generation time of the log, or the constant information of the log is different from the target constant information corresponding to each statistical period, It is determined that there is no statistical period corresponding to the log.

S120: Determine at least one abnormal log set according to whether the corresponding target constant information of the log set is reference constant information, and the reference constant information is the constant information of the historical log; each abnormal log set is arranged in the order of the statistical period.

S130: Obtain a first abnormal log set chain according to each adjacent abnormal log set; the interval between the corresponding statistical periods of the adjacent abnormal log sets in the first abnormal log set chain does not exceed the first duration, the beginning and the end. The interval between the corresponding statistical periods of the exception log sets shall not exceed the second period.

S140: Determine the root cause log in the statistical period according to the first abnormal log set chain.

Each first abnormal log set chain event represents an abnormal event in the statistical period. Therefore, for abnormal events occurring in the statistical period, the root cause log of the abnormal event can be determined through the first abnormal log set chain.

Since constant information is a tool for classifying logs generated in real time within a statistical period, how to determine this tool is a problem that needs to be solved. To this end, the embodiment of this application also provides a possible implementation manner.

Among them, the specific implementation steps for determining the constant information of the log in S110 include:

Determine the constant characteristic information and variable characteristic information in the log; replace the variable characteristic information in the log with preset constants, and determine the replaced log as the constant information of the log.

In one example, the contents of log 1 look like this:

IDMM{

"220";["state":true"astRunTime":"20220630000016""lastDealTime":"20220629212250"},

"221":{"state";true,"lastRunTime":"20220630000015","lastDealTime":"20220629203437"}

}

Based on the contents of log 1, the obtained constant information of log 1 is as follows:

IDMM{

"XX";["state":XX"LastRunTime":"XX""lastDealTime":"XX"]

}

How to filter out the abnormal log set from the log set is a key step in abnormal judgment. The embodiment of the present application also provides an implementation method to perform independent judgment on each log set, thereby obtaining at least one abnormal log set. Among them, at least one abnormal log set is determined according to whether the corresponding target constant information of the log set is reference constant information, including:

For each log set, if the corresponding target constant information of the log set is not the reference constant information, the log set is determined to be an abnormal log set. If the corresponding target constant information of the log set is reference constant information, the log set is determined to be an abnormal log set based on the number of logs in the log set.

For the target constant information that appears in the statistical period, if it appears for the first time, it is the new constant information; if it does not appear for the first time, it is the old constant information. For new target constant information, its appearance is most likely to indicate that an exception has occurred. This type of log set can be directly determined as an abnormal log set; for old target constant information, if the number of logs corresponding to the old target constant information is within the normal range , it is not an anomaly. Only when the number of logs exceeds the normal range can it be determined to be an anomaly. In this case, you can determine whether an exception occurs based on the number of logs in the log set.

Optionally, each reference constant information is associated with a first fluctuation threshold and a second fluctuation threshold, and the first fluctuation threshold is greater than the second fluctuation threshold. The first fluctuation threshold and the second fluctuation threshold can be determined based on the historical log corresponding to the reference constant information. It should be noted that the determination process of the first fluctuation threshold and the second fluctuation threshold may refer to related technologies, and for the sake of simplicity of description, details will not be described again here.

Among them, the log set is determined to be an abnormal log set according to the number of logs in the log set, including the following implementation steps Sa1 to Sa2.

Sa1, determine the reference constant information that is the same as the target constant information corresponding to the log set.

Sa2, if the number of logs in the log set is greater than the first fluctuation threshold associated with the determined reference constant information, or if the number of logs in the log set is less than the second fluctuation threshold associated with the determined reference constant information, the log set is determined to be an abnormal log set .

Since there is at least one abnormal log set, how to perform link operations between abnormal log sets is also a problem that needs to be solved. To this end, the embodiment of this application also provides a possible implementation manner. Among them, linking adjacent exception log sets to obtain the first exception log set chain includes the following steps Sb1 to Sb3.

Sb1, arrange each abnormal log set according to the timing of the corresponding statistical period, and obtain the abnormal log set sequence.

Specifically, first, each abnormal log set obtains the initial abnormal log set sequence according to the timing of the statistical period. Among them, the exception log sets with the same statistical period in the initial exception log set sequence are in the same sequence. Secondly, for each abnormal log set in the same order, rearrange it according to the number of logs from high to low. Finally, the obtained initial exception log set sequence is used as the exception log set sequence.

Each exception log set includes an exception log set that is a root cause and an exception log set that is a non-root cause. Generally speaking, the exception log set that is the root cause usually precedes the exception log set that is the non-root cause, and is the reason why the non-root cause exception log set is generated. Therefore, orderly arranging each abnormal log set according to the order of statistical periods can lay the foundation for analyzing root cause logs.

Sb2: Link adjacent abnormal log sets in the abnormal log set sequence according to the first duration to obtain at least one second abnormal log set chain; the corresponding statistical periods of adjacent abnormal log sets in the second abnormal log set chain are not separated by the same length of time. exceeds the first duration.

In anomaly detection in related technologies, the interval between two adjacent anomalies will not exceed a specific length of time, such as 5 minutes. If the interval exceeds 5 minutes, it can be understood that there is no correlation between the two adjacent anomalies and they do not belong to the same abnormal event. In the embodiment of the present application, the first duration can be understood as the specific duration.

Through the first duration of convergence and aggregation of each abnormal log set, the essence is to organize the fragmented abnormal log sets to form an independent and complete abnormal log set chain. In the formed abnormal log set chain, we can intuitively see the information of each abnormal log set, such as statistical period, number of logs, and corresponding target constant information.

Sb3, for each second abnormal log set chain, if the interval between the corresponding statistical periods of the first and last abnormal log sets in the second abnormal log set chain does not exceed the second time length, determine the second abnormal log set chain. The abnormal log set chain is the first abnormal log set chain; if the second time period is exceeded, at least one first abnormal log set chain is determined based on the second abnormal log set chain.

In anomaly detection in related technologies, an abnormal event will not continue endlessly, that is, its duration will not exceed a specific duration, such as a characteristic duration of 2 hours. If it lasts for more than 2 hours, it can be considered that the abnormality after 2 hours has nothing to do with the abnormal event.

The first abnormal log set chain obtained by convergence and aggregation is divided according to the second duration to form an abnormal log set chain that conforms to the logic of the abnormal event, which increases the dimension of the abnormal log set chain and greatly improves the reliability of the anomaly detection results. .

In order to understand the first abnormal log set chain, this application also provides multiple examples of the first abnormal log set chain, as shown in Figure 2. The horizontal axis of Figure 2 is time, and the vertical axis is the number of logs.

In this example, the statistical period is from 0:00 to 24:00, and a total of 16 exception log sets are determined. The 16 exception log sets are arranged in order and identified as 1 to 16.

In this example, 3 first abnormal log set chains are determined for 16 abnormal log sets. Each first abnormal log set chain represents an event, namely event 1 to event 3 respectively. Among them, the abnormal log sets on the first abnormal log set chain representing event 1 are: 1, 2, 3, 4, 5; the abnormal log sets on the first abnormal log set chain representing event 2 are: 6, 7, 8, 9, 10, 11, 12; the abnormal log sets on the first abnormal log set chain representing event 3 are: 13, 14, 15, and 16 respectively.

How to mine abnormal root cause logs through each first abnormal log set chain is also a key issue that needs to be solved in the embodiment of this application. To this end, the embodiment of the present application also provides a possible implementation manner. In this implementation manner, step S140 also includes the following implementation steps.

For each first exception log set chain:

The first exception log set in the first exception log set chain and other exception log sets with the same statistical period as the first exception log set are used as candidate log sets. Among them, in the anomaly detection of related technologies, the earliest generated log is usually the root cause log of an abnormal event. Therefore, it is necessary to filter out the earliest abnormal log set in the statistical period in the first abnormal log set chain and use it as a candidate log set to determine the root cause log.

Continuing with the example shown in Figure 2, for the first abnormal log set chain characterizing event 1, the abnormal log set identified as "1" is a candidate log. For the first abnormal log set chain characterizing event 2, the abnormal log sets identified as “6” and “7” are candidate logs.

If the number of candidate log sets is one, the logs in the candidate log set are used as the root cause logs of the statistical period.

If the number of candidate log sets is multiple, determine the candidate log sets whose corresponding target constant information in the multiple candidate log sets is non-reference constant information, and use the logs in the determined candidate log sets as the root cause logs of the statistical period. Among them, in this statistical period, if the target constant information is reference constant information, the target constant information can be understood as a kind of "new" constant information. If the target constant information is non-reference constant information, the target constant information can be understood as a kind of "old" constant information.

If the target constant information corresponding to at least two candidate log sets in the multiple candidate log sets is reference constant information, then determine the candidate log sets in at least two abnormal log sets that meet the preset fluctuation conditions, and use the logs in the determined candidate log sets as The root cause log of the statistical period; the preset fluctuation condition is that the number of logs in the candidate log set has the largest fluctuation relative to the first fluctuation threshold or the second fluctuation threshold.

Combined with the statistical period of each abnormal log set in the first abnormal log set chain, whether the target constant information is reference constant information, and the fluctuation of the number of logs, comprehensive reasoning is performed to finally clarify the root cause of the abnormal event represented by the first abnormal log set chain. Because of the log.

The method for determining the root cause of anomalies provided by the embodiments of this application can achieve accurate and efficient log root cause analysis in a variety of anomaly detection scenarios. In order to understand the technical effect of this method more clearly, the embodiment of this application also provides an example. Among them, this example includes an anomaly reasoning device, as shown in Figure 3.

In this example, the log model of the log is the constant information of the log in the above embodiment.

In this example, the anomaly reasoning device includes four modules, namely the data access module, the model training module, the real-time anomaly detection module and the real-time root cause reasoning module.

Among them, the functions of the data access module include: preprocessing the logs generated in real time to obtain processable logs. On the one hand, the log data that can be processed is stored as historical log data for the statistical period after the current statistical period. On the other hand, processable real-time logs and historical logs are sent to the model training module.

Among them, the functions of the model training module include: receiving processable real-time logs and historical logs; constructing log template features for real-time logs, obtaining constant feature information and variable feature information of real-time logs, and performing log mode based on each feature information of real-time logs Model training to obtain a log model of real-time logs. For each log model, conduct time series data feature statistics to obtain at least one time series statistical data of the log model (the time series statistical data of the log model is equivalent to the log set obtained by counting the logs corresponding to the target constant information within a statistical period) .

Among them, the functions of the model training module also include: constructing log template features for historical logs, obtaining constant feature information and variable feature information of historical logs, conducting log mode model training based on each feature information of historical logs, and obtaining log models of historical logs. ; Determine multiple reference log models; analyze the time series feature data of each reference log model, and perform abnormal threshold training on each reference log model to obtain the maximum and minimum values in the time series statistics of the reference log model. The maximum value is equivalent to the first fluctuation threshold in the above embodiment, and the minimum value is equivalent to the second fluctuation threshold in the above embodiment.

Further, the time series statistics of each log model and the maximum and minimum values associated with each log model are sent to the real-time anomaly detection module.

Among them, the functions of the real-time anomaly detection module include: for each log model, match the log model with the reference log model in the log model library. If the log model is a reference log model, new model anomaly detection is used; if the log model is a non-reference log model, log volume anomaly detection is used, and the maximum and minimum values of the time series statistics of the log model are used for anomaly detection. Through the aforementioned two kinds of anomaly detection, the timing statistical data of N anomalies are determined from the timing statistical data, which are respectively referred to as anomaly 1, anomaly 2, anomaly 3...anomaly N (each anomaly is equivalent to the anomaly log set in the above embodiment) ).

Further, abnormality 1 to abnormality N are sent to the real-time root cause inference module.

Among them, the functions of the real-time root cause inference module include: performing event convergence based on anomaly 1 to anomaly N, and obtaining event 1, event 2...event N (each event is equivalent to the first exception log set chain in the above embodiment). Perform root cause analysis on each event to obtain the anomalies that serve as root causes in each event. For example, for event 1, its abnormal root causes are exception 1 and exception 5.

Furthermore, the root causes of each event are summarized and used as the root causes of the current statistical period.

In addition, this application also provides a detailed process example for the operation process of the real-time anomaly detection module and real-time root cause reasoning in the anomaly reasoning device, as shown in Figure 4. Among them, the process includes steps S1001 to S1010.

S1001. Obtain time series statistical data of the log model.

Among them, various time series statistical data of all log models within the statistical period are obtained.

S1002, detect whether the timing statistics of the log model are abnormal.

If the time series statistical data is abnormal, the abnormal time series statistical data is regarded as an abnormality, and step S1003 is executed.

S1003, aggregate the exceptions to obtain a complete initial event (the initial event is equivalent to the second exception log set chain in the above embodiment).

S1004, converge the initial events and obtain independent events (this event is equivalent to the first abnormal log set chain).

When there are multiple events, steps S1005 to S1009 are executed for each event.

S1005: Determine whether the candidate exception is one item.

Among them, for each event, the exception with the earliest occurrence time is used as a candidate exception (candidate exception, equivalent to the candidate log set in the above embodiment). Among them, the candidate anomaly can be one or multiple.

Among them, if the number of candidate exceptions is one, the candidate exception is used as the root cause of the event. If the number of candidate anomalies is multiple, step S1006 is executed.

S1006: Determine whether the log model corresponding to the candidate exception is a reference log model.

Among them, for any candidate anomaly among the plurality of candidate anomalies, if the log model corresponding to the candidate anomaly is a non-reference log model, the time series statistical data corresponding to the candidate anomaly will be used as the root cause of the event. If the log model corresponding to the candidate exception is the reference log model, execute S1007.

S1007: Determine whether the log model of at least two candidate anomalies is a reference log model.

If yes, execute S1008. If not, enter the root cause judgment process of the next event.

S1008: Determine whether the data fluctuations of at least two candidate anomalies exceed a preset range.

Among them, each exception is a time series statistic. For each candidate anomaly, the candidate anomaly with the largest fluctuation in the corresponding time series statistical data is used as the root cause of the event.

S1009, determine the root cause of the incident.

S1010, output the root cause of each event within the statistical period.

Referring to Figure 5, an embodiment of the present application also provides a device 500 for determining the root cause of an abnormality. Among them, the device includes a statistics module 510, a first determination module 520, an aggregation link module 530, and a second determination module 540.

The statistics module 510 is used to determine the generation time and constant information of the log for each log generated in real time within the statistical period; if it is determined that there is no statistical period corresponding to the log, the constant information of the log is used as the target constant information, and the log is generated according to the log generation time. Create a statistical period associated with the target constant information at all times, and count the logs generated within the statistical period associated with the created target constant information to obtain a log set corresponding to the target constant information; the constant information of each log in the log set is the target constant information .

The first determination module 520 is used to determine at least one abnormal log set based on whether the target constant information corresponding to the log set is reference constant information, and the reference constant information is the constant information of the historical log; each abnormal log set is arranged in the order of the statistical period.

The aggregation link module 530 is used to obtain a first abnormal log set chain according to each adjacent abnormal log set; the interval between the corresponding statistical periods of adjacent abnormal log sets in the first abnormal log set chain does not exceed the first The duration, the interval between the corresponding statistical periods of the first and last exception log sets shall not exceed the second duration.

The second determination module 540 is configured to determine the root cause log in the statistical period according to the first abnormal log set chain.

The device of the embodiment of the present application can execute the method provided by the embodiment of the present application, and its implementation principle is similar. The actions performed by each module in the device of the embodiment of the present application are the same as the steps in the method of the embodiment of the present application. Correspondingly, for the detailed functional description of each module of the device, please refer to the description in the corresponding method shown above, and will not be described again here.

The embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory. The processor executes the above computer program to implement the steps of a method for determining the root cause of an abnormality, which is consistent with the existing technology. Compared with what is achievable: Achieve more accurate and efficient log root cause analysis.

Referring to Figure 6, the embodiment of the present application also provides a specific example of an electronic device. The electronic device 6000 shown in Figure 6 includes: a processor 6001 and a memory 6003. Among them, the processor 6001 and the memory 6003 are connected, such as through a bus 6002. Optionally, the electronic device 6000 may also include a transceiver 6004, which may be used for data interaction between the electronic device and other electronic devices, such as data transmission and/or data reception. It should be noted that in practical applications, the number of transceivers 6004 is not limited to one, and the structure of the electronic device 6000 does not constitute a limitation on the embodiments of the present application.

The processor 6001 can be a CPU (Central Processing Unit, central processing unit), a general-purpose processor, a DSP (Digital Signal Processor, data signal processor), ASIC (Application Specific Integrated Circuit, application specific integrated circuit), FPGA (Field Programmable Gate Array, field programmable gate array) or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute the various illustrative logical blocks, modules, and circuits described in connection with this disclosure. The processor 6001 can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

Bus 6002 may include a path that carries information between the components described above. The bus 6002 may be a PCI (Peripheral Component Interconnect, Peripheral Component Interconnect Standard) bus or an EISA (Extended Industry Standard Architecture, Extended Industry Standard Architecture) bus, or the like. The bus 6002 can be divided into an address bus, a data bus, a control bus, etc. For ease of presentation, only one thick line is used in Figure 6, but it does not mean that there is only one bus or one type of bus.

The memory 6003 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, RAM (Random Access Memory, random access memory) or other types that can store information and instructions. Dynamic storage devices can also be EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact DiscRead Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, Laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media, other magnetic storage devices, or any other media that can be used to carry or store computer programs and can be read by a computer, are not limited here.

The memory 6003 is used to store computer programs for executing embodiments of the present application, and is controlled by the processor 6001 for execution. The processor 6001 is used to execute the computer program stored in the memory 6003 to implement the steps shown in the foregoing method embodiments.

Among them, electronic equipment includes but is not limited to: servers.

Embodiments of the present application provide a computer-readable storage medium. A computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, the steps and corresponding contents of the foregoing method embodiments can be implemented.

Embodiments of the present application also provide a computer program product, including a computer program. When the computer program is executed by a processor, the steps and corresponding contents of the foregoing method embodiments can be implemented.

It should be understood that although each operation step is indicated by arrows in the flow chart of the embodiment of the present application, the order of implementation of these steps is not limited to the order indicated by the arrows. Unless otherwise specified herein, in some implementation scenarios of the embodiments of the present application, the implementation steps in each flowchart may be executed in other orders according to requirements. In addition, some or all of the steps in each flowchart are based on actual implementation scenarios and may include multiple sub-steps or multiple stages. Some or all of these sub-steps or stages may be executed at the same time, and each of these sub-steps or stages may also be executed at different times. In scenarios with different execution times, the execution order of these sub-steps or stages can be flexibly configured according to needs, and the embodiments of the present application do not limit this.

The above are only optional implementation modes of some implementation scenarios of the present application. It should be pointed out that for those of ordinary skill in the technical field, without departing from the technical concept of the solution of the present application, adopting solutions based on the technical ideas of the present application Other similar implementation means also fall within the protection scope of the embodiments of this application.

Claims (10)

1. A method of determining an abnormal root cause, the method comprising:

determining the generation time and constant information of each log generated in real time in a statistical period; if no statistical period corresponding to the log is determined, taking constant information of the log as target constant information, creating a statistical period associated with the target constant information according to the generation time of the log, and counting the log generated in the created statistical period associated with the target constant information to obtain a log set corresponding to the target constant information; the constant information of each log in the log set is the target constant information;

determining at least one abnormal log set according to whether the target constant information corresponding to the log set is reference constant information or not, wherein the reference constant information is constant information of a history log; each abnormal log set is arranged according to the sequence of the statistical time periods;

Obtaining a first abnormal log set chain according to each adjacent abnormal log set; the interval duration of the corresponding statistical time periods of the adjacent abnormal log sets in the first abnormal log set chain does not exceed the first duration, and the interval duration of the corresponding statistical time periods of the first abnormal log set and the last abnormal log set does not exceed the second duration;

and determining the root cause log in the statistical period according to the first abnormal log set chain.

2. The method of claim 1, wherein said determining constant information for the log comprises:

determining constant characteristic information and variable characteristic information in the log;

and replacing the variable characteristic information in the log with a preset constant, and determining the replaced log as constant information of the log.

3. The method of claim 1, wherein the determining that there is no statistical period corresponding to the log comprises:

for the first log generated in the statistical period, determining that no statistical period corresponding to the log exists;

and for the non-first log generated in the statistical period, if each created statistical period does not comprise the generation time of the log or the constant information of the log is different from the corresponding target constant information of each statistical period, determining that the statistical period corresponding to the log does not exist.

4. The method of claim 1, wherein determining at least one abnormal log set according to whether the target constant information corresponding to the log set is the reference constant information, comprises:

for each log set, if the corresponding target constant information of the log set is not the reference constant information, determining the log set as the abnormal log set;

and if the target constant information corresponding to the log set is the reference constant information, determining that the log set is the abnormal log set according to the log quantity of the log set.

5. The method of claim 4, wherein each reference constant information is associated with a first ripple threshold and a second ripple threshold, the first ripple threshold being greater than the second ripple threshold;

the determining that the log set is the abnormal log set according to the log quantity of the log set includes:

determining the same reference constant information as the target constant information corresponding to the log set;

and if the number of the logs in the log set is larger than a first fluctuation threshold associated with the determined reference constant information, or if the number of the logs in the log set is smaller than a second fluctuation threshold associated with the determined reference constant information, determining the log set as the abnormal log set.

6. The method of claim 1, wherein the obtaining a first chain of anomaly log sets from each adjacent anomaly log set comprises:

arranging the abnormal log sets according to the time sequence of the corresponding statistical time period to obtain an abnormal log set sequence;

determining at least one second abnormal log set chain from the abnormal log set sequence according to the first time length; the interval duration of the corresponding statistical time period of the adjacent abnormal log sets in the second abnormal log set chain does not exceed the first duration;

for each second abnormal log set chain, if the interval duration of the corresponding statistical time periods of the first abnormal log set and the last abnormal log set in the second abnormal log set chain is not longer than the second duration, determining the second abnormal log set chain as the first abnormal log set chain; and if the second time period is longer than the second time period, determining at least one first abnormal log set chain according to the second abnormal log set chain.

7. The method of claim 1, wherein said determining a root log in the statistical period from the first chain of anomaly log sets comprises:

for each first abnormal log set chain, taking a first abnormal log set of the first abnormal log set chain and other abnormal log sets with the same statistical time period as the first abnormal log set as candidate log sets;

If the number of the candidate log sets is one, taking the logs in the candidate log sets as root logs of the statistical period;

if the number of the candidate log sets is multiple, determining that the corresponding target constant information in the multiple candidate log sets is a candidate log set of non-reference constant information, and taking the logs in the determined candidate log sets as root logs of the statistical period;

if the target constant information corresponding to at least two candidate log sets in the plurality of candidate log sets is the reference constant information, determining the candidate log sets which accord with the preset fluctuation condition in the at least two abnormal log sets, and taking the logs in the determined candidate log sets as root cause logs of the statistical period; the preset fluctuation condition is that the fluctuation amount of the log quantity of the logs in the candidate log set relative to the first fluctuation threshold value or the second fluctuation threshold value is maximum.

8. An apparatus for determining an cause of an anomaly, the apparatus comprising:

the statistics module is used for determining the generation time and constant information of each log generated in real time in a statistics period; if no statistical period corresponding to the log is determined, taking constant information of the log as target constant information, creating a statistical period associated with the target constant information according to the generation time of the log, and counting the log generated in the created statistical period associated with the target constant information to obtain a log set corresponding to the target constant information; the constant information of each log in the log set is the target constant information;

The first determining module is used for determining at least one abnormal log set according to whether the target constant information corresponding to the log set is reference constant information or not, wherein the reference constant information is constant information of a history log; each abnormal log set is arranged according to the sequence of the statistical time periods;

the aggregation link module is used for obtaining a first abnormal log set chain according to each adjacent abnormal log set; the interval duration of the corresponding statistical time periods of the adjacent abnormal log sets in the first abnormal log set chain does not exceed the first duration, and the interval duration of the corresponding statistical time periods of the first abnormal log set and the last abnormal log set does not exceed the second duration;

and the second determining module is used for determining the root cause log in the statistical period according to the first abnormal log set chain.

9. An electronic device comprising a memory, a processor and a computer program stored on the memory, characterized in that the processor executes the computer program to carry out the steps of the method according to any one of claims 1-7.

10. A computer readable storage medium having stored thereon a computer program, which when executed by a processor performs the steps of the method of determining the root cause of an anomaly of any one of claims 1 to 7.