WO2023185335A1 - 一种崩溃聚类方法、装置、电子设备以及存储介质 - Google Patents
一种崩溃聚类方法、装置、电子设备以及存储介质 Download PDFInfo
- Publication number
- WO2023185335A1 WO2023185335A1 PCT/CN2023/078027 CN2023078027W WO2023185335A1 WO 2023185335 A1 WO2023185335 A1 WO 2023185335A1 CN 2023078027 W CN2023078027 W CN 2023078027W WO 2023185335 A1 WO2023185335 A1 WO 2023185335A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- crash
- information
- system crash
- crash information
- kernel
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 84
- 230000008569 process Effects 0.000 claims description 34
- 239000000284 extract Substances 0.000 claims description 19
- 230000014509 gene expression Effects 0.000 claims description 18
- 238000004590 computer program Methods 0.000 claims description 14
- 238000000605 extraction Methods 0.000 claims description 10
- 238000004422 calculation algorithm Methods 0.000 description 6
- 238000010586 diagram Methods 0.000 description 4
- 230000006870 function Effects 0.000 description 4
- 238000004891 communication Methods 0.000 description 3
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 3
- 238000012545 processing Methods 0.000 description 3
- 230000002776 aggregation Effects 0.000 description 2
- 238000004220 aggregation Methods 0.000 description 2
- 238000004364 calculation method Methods 0.000 description 2
- 238000011160 research Methods 0.000 description 2
- 238000006467 substitution reaction Methods 0.000 description 2
- 241000700605 Viruses Species 0.000 description 1
- 230000002159 abnormal effect Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 230000008030 elimination Effects 0.000 description 1
- 238000003379 elimination reaction Methods 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 230000009545 invasion Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000000545 stagnation point adsorption reflectometry Methods 0.000 description 1
- 238000010408 sweeping Methods 0.000 description 1
- 208000024891 symptom Diseases 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0751—Error or fault detection not based on redundancy
- G06F11/0754—Error or fault detection not based on redundancy by exceeding limits
- G06F11/0757—Error or fault detection not based on redundancy by exceeding limits by exceeding a time limit, i.e. time-out, e.g. watchdogs
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0766—Error or fault reporting or storing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
Definitions
- the present disclosure relates to the field of computer technology, and specifically, to a crash clustering method, device, electronic device and storage medium.
- Embodiments of the present disclosure provide at least a crash clustering method, device, electronic device, and storage medium.
- embodiments of the present disclosure provide a crash aggregation method, including:
- For the system crash information extract crash features from the system crash information based on the type of the system crash information
- the crash of the operating system includes a thread crash
- the multiple pieces of system crash information generated after the operating system crashes are obtained, including:
- the system crash information is generated.
- extracting crash features from the system crash information based on the type of the system crash information includes:
- the target identification information of the crash process When the system crash information is generated based on the call stack information, the target identification information of the crash process, the summary information of the system crash information, and the call information of the target process are extracted from the system crash information. , as the crash characteristic.
- extracting the calling information of the target process from the system crash information includes:
- the class name of the target object called by the target process is extracted.
- the crash of the operating system includes a kernel crash
- the multiple pieces of system crash information generated after the operating system crashes are obtained, including:
- the system crash information is generated based on the kernel running log information.
- extracting crash features from the system crash information based on the type of the system crash information includes:
- system crash information is generated based on the kernel operation log information, determine the crash type information indicated in the system crash information;
- crash type information the crash cause information, the instruction information to be executed, and the memory address information are used as the crash characteristics.
- generating a feature identifier corresponding to the system crash information based on the crash feature includes:
- embodiments of the present disclosure also provide a crash clustering device, including:
- the acquisition module is used to obtain multiple pieces of system crash information generated after the operating system crashes;
- An extraction module configured to extract crash features from the system crash information based on the type of the system crash information
- a computing module configured to generate a feature identifier corresponding to the system crash information based on the crash feature
- a classification module configured to cluster a plurality of pieces of system crash information based on the characteristic identifier, and obtain a system crash information group corresponding to at least one crash cause.
- the crash of the operating system includes a thread crash
- the acquisition module is used to obtain multiple pieces of system crash information generated after the operating system crashes:
- the multiple pieces of system crash information generated after the operating system crashes are obtained, including:
- the system crash information is generated.
- the extraction module when extracting crash features from the system crash information based on the type of the system crash information, the extraction module is used to:
- the target identification information of the crash process When the system crash information is generated based on the call stack information, the target identification information of the crash process, the summary information of the system crash information, and the call information of the target process are extracted from the system crash information. , as the crash characteristic.
- the extraction module when extracting the calling information of the target process from the system crash information, the extraction module is used to:
- the class name of the target object called by the target process is extracted.
- the crash of the operating system includes a kernel crash
- the acquisition module obtains multiple pieces of system crash information generated after the operating system crashes, it is specifically used to:
- the extraction module when extracting crash features from the system crash information based on the type of the system crash information, is specifically used to:
- the system crash information When the system crash information is generated based on the kernel operation log information, determine the crash type information indicated in the system crash information, and use the regular expression to extract crash cause information from the system crash information. , extract from the system crash information the instruction information to be executed when the kernel crash occurs and the memory address information where the exception occurs, the crash type information, the crash cause information, the instruction information to be executed and the Memory address information serves as the crash signature.
- the computing module when the computing module generates a feature identifier corresponding to the system crash information based on the crash feature, it is specifically used to:
- embodiments of the present disclosure also provide an electronic device, including: a processor, a memory, and a bus.
- the memory stores machine-readable instructions executable by the processor.
- the processing The processor communicates with the memory through a bus, and when the machine-readable instructions are executed by the processor, the steps in the above-mentioned first aspect, or any possible implementation manner of the first aspect, are performed.
- embodiments of the present disclosure also provide a computer-readable storage medium.
- a computer program is stored on the computer-readable storage medium.
- the computer program executes the above-mentioned first aspect, or any of the first aspects. steps in a possible implementation.
- the crash clustering method, device, electronic device and storage medium provided by the embodiments of the present disclosure first obtain multiple pieces of system crash information generated after the operating system crashes, and then, for the system crash information, based on the type of the system crash information , extract crash features from the system crash information, and then, based on the crash features, generate feature identifiers corresponding to the system crash information. Finally, based on the feature identifiers, cluster multiple pieces of system crash information to obtain System crash information group corresponding to at least one crash cause.
- the embodiments of the present disclosure extract crash features from the system crash information based on the type of the system crash information.
- the crash features can reflect the characteristic points about the crash in the system crash information and are representative.
- the feature identifiers generated by the crash features can identify the crash features. Characterize the characteristics of the crash. Therefore, the crash identification can reflect various characteristics of the crash and achieve a high degree of summary of the crash. It does not directly cluster the system crash information, but clusters the feature identification, which can eliminate a large amount of irrelevant information. , on the premise of retaining various crash-related features, improving clustering efficiency and reducing the types of problems for developers to view and correct.
- Figure 1 shows a flow chart of a crash clustering method provided by an embodiment of the present disclosure
- Figure 2 shows a schematic diagram of a crash clustering device provided by an embodiment of the present disclosure
- FIG. 3 shows a schematic diagram of an electronic device provided by an embodiment of the present disclosure.
- a and/or B can mean: A alone exists, A and B exist simultaneously, and B alone exists. situation.
- at least one herein means any one of a plurality or any combination of at least two of a plurality, for example, including at least one of A, B, and C, which can mean including from A, Any one or more elements selected from the set composed of B and C.
- the present disclosure provides a crash clustering method. For crashes that occur in the operating system, the system crash information generated after the crash is classified according to certain characteristics, and crashes caused by the same cause are divided into the same category, reducing The problem types are easy for developers to view.
- the execution subject of the crash clustering method provided by an embodiment of the present disclosure is generally a computer device with certain computing capabilities.
- the crash clustering method can be implemented by a processor calling computer-readable instructions stored in a memory.
- FIG. 1 is a flow chart of a crash clustering method provided by an embodiment of the present disclosure, the method includes steps S101 to S104, wherein:
- the operating system is a computer program that manages computer hardware and software resources. It needs to handle basic matters such as managing and configuring memory, determining the priority of system resource supply and demand, controlling input devices and output devices, operating networks, and managing file systems. It provides a An operating interface that allows users to interact with the system.
- the operating systems mainly include PC and mobile
- PC terminals include but are not limited to Microsoft Windows systems (usually used for ordinary computers) and Linux systems (usually used for servers);
- mobile terminals include but are not limited to Android systems and iOS systems. Operating systems are used in a wide range of applications, from smart desk lamps, sweeping robots, mobile phones, computers to large servers, all require operating systems.
- operating system crash refers to symptoms in which the system fails to operate normally and crashes frequently due to operating errors or virus invasion, including thread crashes and kernel crashes.
- thread crash refers to the operating system crash caused by the thread being unable to continue due to resource occupation or other reasons.
- a watchdog is usually used to monitor the operating status of the operating system.
- the watchdog is essentially a timer circuit and generally has an input and an output. The input is called a feeder and the output is generally connected to another A partial reset terminal.
- the operating system is running stably, it will feed the dog after executing specific instructions. If the watchdog does not receive the dog feeding signal from the software within a certain period, the system is considered abnormal.
- the call stack information corresponding to the crashed thread of the operating system can be obtained, and the system crash information is generated based on the call stack information.
- the process name of the target process is the target identification information, and then generate summary information of the system crash information based on the characteristics in the call stack information. , Finally, generate system crash information including the target identification information of the crashed process, the above summary information, and the above call stack information.
- a kernel crash refers to a crash that occurs in the kernel. If the operating system crashes as a kernel crash, the system crash information is obtained from the kernel running log information before restarting due to the kernel crash.
- the kernel running log is used to record information about kernel problems in the operating system. It can also monitor events that occur in the system and can be used to check the cause of a crash or find traces left by the attacker when being attacked. If the system crash information is generated based on the kernel running log information, the crash type indicated in the system crash information is a kernel crash.
- the kernel running log information of the operating system before restarting due to the kernel crash can be obtained; and then, the system crash information is generated based on the kernel running log information.
- generating the system crash information based on the kernel running log information includes:
- the extracted information is used as the system crash information.
- S102 For the system crash information, extract crash features from the system crash information based on the type of the system crash information.
- crash characteristics can be extracted from the system crash information based on the type of the system crash information.
- the target identification information of the crash process When the system crash information is generated based on the call stack information, the target identification information of the crash process, the summary information of the system crash information and the call of the target process can be extracted from the system crash information. information as described as crash characteristics.
- the class name of the target object called by the target process, the method name of the target object, and the lock information corresponding to the target object are extracted from the call information of the target process that eliminates interference from the address information.
- locks are used to reasonably allocate resources during multi-thread operation, and lock holding means that a certain thread is occupying a certain resource.
- the lock-holding information in the call information usually contains the memory address corresponding to the lock-holding object, and the address of the lock-holding object in the memory will change, in the case of changes, if the memory address is still used for aggregation Class, the same type of problems will be clustered into different types of problems. Therefore, the address information of the lock-holding object can be deleted, thereby eliminating the impact of the address information on the feature identification.
- the crash characteristics can be extracted from the system crash information through the following steps:
- the crash type information indicated in the system crash information is determined, and then a regular expression matching the crash type information is determined, according to the regular expression expression, extract the crash cause information from the system crash information, and then extract the instruction information to be executed when the kernel crash occurs and the memory address information where the exception occurs from the system crash information; finally, extract the extracted
- the crash type information, the crash cause information, the instruction information to be executed, and the memory address information serve as the crash characteristics.
- the crash types of kernel crashes include KE (kernel crash) type and non-KE type; for the KE type, the value of the crash type information may be KE (kernel exception), JE (Java exception) and NE (native exception); for non-KE types, the value of crash type information may be HWT, HW_REBOOT, THERMAL_REBOOT, OCP, SPAR, UVLO, HANG_DETECT, etc.
- a regular expression matching the crash type information is determined, and the crash cause information is extracted from the system crash information using the regular expression.
- the value of the crash type information of the crash cause information has the following five situations:
- Kernel bug on (the location where the crash occurred) uses regular expressions to use the field kernel BUG at as a handle to extract crash cause information, which is used to extract common crash information causes;
- Virtual address (virtual address) problem uses regular expressions to use the field Unable to handle kernel paging request at virtual address (unable to process kernel paging request at virtual address) as a handle to extract crash cause information, which is used to extract virtual address exception information;
- Null pointer (null pointer) problem uses regular expressions to use the field Unable to handle kernel NULL pointer dereference at virtual address (cannot handle null pointer reference at virtual address) as a handle to extract crash cause information, which is used to cause exception information caused by misuse of pointers. extraction;
- the sysrq-trigger (system request trigger) problem uses regular expressions and uses the field sysrq (system request) as a handle to extract crash cause information, which is used to extract exception information when the system encounters an exception that is difficult to reproduce;
- the information in the field exception_info (the crash information) is directly used as the crash cause information.
- the information summary value of the crash feature may be determined first, and then the information summary value may be used as the feature identifier corresponding to the system crash information.
- the message digest value can be determined by the message digest algorithm (Message-Digest Algorithm, MD5), which is a cryptographic hash function that can produce a 128-bit (16-byte) hash value and is usually used to ensure that information The transmission is complete and consistent. Specifically, if multiple strings are input, a corresponding string of fixed values can be obtained through the MD5 algorithm. That is to say, if strings with the same characteristics are input, the same characteristic identifier will be obtained. Therefore, use The MD5 information summary algorithm determines the information summary value, which can group system crash information with the same characteristics into one category and improve the efficiency of crash information classification.
- MD5 message digest algorithm
- S104 Based on the characteristic identifier, cluster multiple pieces of the system crash information to obtain a system crash information group corresponding to at least one crash cause.
- the system crash information group includes one or more pieces of operating system crash information with the same or similar characteristic identifiers.
- the same or similar feature identifiers are determined through the MD5 information digest algorithm: common operating system crash information feature identifiers (a 128-bit hash value) are extracted and the first threshold is set. If the characteristic identifier of the operating system crash information determined by the MD5 information digest algorithm is within the first threshold of the characteristic identifier of a common operating system crash information, then the operating system crash information belongs to the common operating system crash information group. This can classify a large amount of operating system crash information and reduce the amount of operating system crash information that developers have to deal with.
- the crash clustering method obtains multiple pieces of system crash information generated after the operating system crashes; for the system crash information, based on the type of the system crash information, crash features are extracted from the system crash information ; Based on the crash characteristics, generate a characteristic identifier corresponding to the system crash information; based on the characteristic identifier, cluster multiple pieces of the system crash information to obtain a system crash information group corresponding to at least one crash cause.
- the embodiment of the present disclosure extracts crash features from the system crash information based on the type of system crash information.
- the crash features can reflect the characteristic points of the crash in the system crash information and are representative.
- the feature identifiers generated by the crash features can predict the crash features. Characterize the characteristics.
- the crash identification can reflect various characteristics of the crash and achieve a high degree of summary of the crash. It does not directly cluster the system crash information, but clusters the feature identification, which can eliminate a large amount of irrelevant information. On the premise of retaining various crash-related features, the clustering efficiency is improved and the types of problems are reduced to facilitate developers to view and correct them.
- the writing order of each step does not mean a strict execution order and does not constitute any limitation on the implementation process.
- the specific execution order of each step should be based on its function and possible The internal logic is determined.
- the embodiment of the present disclosure also provides a crash clustering device corresponding to the crash clustering method. Since the principle of solving the problem of the device in the embodiment of the present disclosure is similar to the crash clustering method mentioned above in the embodiment of the present disclosure, therefore For the implementation of the device, please refer to the implementation of the method, and repeated details will not be repeated.
- FIG. 2 a schematic diagram of a crash clustering device provided by an embodiment of the present disclosure is provided.
- the device includes:
- the acquisition module 201 is used to acquire multiple pieces of system crash information generated after the operating system crashes;
- the extraction module 202 is configured to extract crash features from the system crash information based on the type of the system crash information
- the calculation module 203 is configured to generate a feature identifier corresponding to the system crash information based on the crash feature;
- the classification module 204 is configured to cluster multiple pieces of the system crash information based on the feature identifiers to obtain a system crash information group corresponding to at least one crash cause.
- crash features are extracted from the system crash information based on the type of system crash information.
- the crash features can reflect the characteristic points about the crash in the system crash information and are representative.
- the feature identifier generated by the crash features can identify the crash. Characterize the characteristics of the features. Therefore, the crash identification can reflect various characteristics of the crash and achieve a high degree of summary of the crash. It does not directly cluster the system crash information, but clusters the feature identification, which can classify a large amount of irrelevant information. Elimination improves clustering efficiency and reduces problem types while retaining various crash-related features for developers to view and correct.
- the crash of the operating system includes a thread crash
- the acquisition module 201 acquires multiple pieces of system crash information generated after the operating system crashes, it is used to:
- the system crash information is generated.
- the extraction module 202 when extracting crash features from the system crash information based on the type of the system crash information, the extraction module 202 is used to:
- the target identification information of the crash process When the system crash information is generated based on the call stack information, the target identification information of the crash process, the summary information of the system crash information, and the call information of the target process are extracted from the system crash information. , as the crash characteristic.
- the extraction module 202 when extracting the calling information of the target process from the system crash information, the extraction module 202 is used to:
- the class name of the target object called by the target process is extracted.
- the crash of the operating system includes a kernel crash
- the acquisition module 201 acquires multiple pieces of system crash information generated after the operating system crashes, it is used to:
- the system crash information is generated based on the kernel running log information.
- the extraction module 202 when extracting crash features from the system crash information based on the type of the system crash information, the extraction module 202 is used to:
- system crash information is generated based on the kernel operation log information, determine the crash type information indicated in the system crash information;
- crash type information the crash cause information, the instruction information to be executed, and the memory address information are used as the crash characteristics.
- the calculation module 203 when generating a feature identifier corresponding to the system crash information based on the crash feature, the calculation module 203 is used to:
- an embodiment of the present disclosure also provides an electronic device 300.
- a schematic structural diagram of the electronic device 300 provided by an embodiment of the present disclosure includes:
- processor 31 memory 32, and bus 33; memory 32 is used to store execution instructions, including memory 321 and external memory 322; memory 321 here is also called internal memory, and is used to temporarily store operation data in processor 31, and with The processor 31 exchanges data with the external memory 322 such as a hard disk through the memory 321 and the external memory 322.
- the processor 31 and the memory 32 communicate through the bus 33, so that The processor 31 executes the following instructions:
- For the system crash information extract crash features from the system crash information based on the type of the system crash information
- the crash that occurs in the operating system includes a thread crash
- the multiple pieces of system crash information generated after the operating system crashes are obtained, including:
- the system crash information is generated.
- the crash characteristics are extracted from the system crash information based on the type of the system crash information, including:
- the target identification information of the crash process When the system crash information is generated based on the call stack information, the target identification information of the crash process, the summary information of the system crash information, and the call information of the target process are extracted from the system crash information. , as the crash characteristic.
- the calling information of the target process is extracted from the system crash information, including:
- the class name of the target object called by the target process is extracted.
- the crash that occurs in the operating system includes a kernel crash
- the multiple pieces of system crash information generated after the operating system crashes are obtained, including:
- the system crash information is generated based on the kernel running log information.
- the crash characteristics are extracted from the system crash information based on the type of the system crash information, including:
- system crash information is generated based on the kernel operation log information, determine the crash type information indicated in the system crash information;
- crash type information the crash cause information, the instruction information to be executed, and the memory address information are used as the crash characteristics.
- the characteristic identifier corresponding to the system crash information is generated based on the crash characteristics, including:
- Embodiments of the present disclosure also provide a computer-readable storage medium.
- a computer program is stored on the computer-readable storage medium.
- the storage medium may be a volatile or non-volatile computer-readable storage medium.
- Embodiments of the present disclosure also provide a computer program product.
- the computer program product carries program code.
- the instructions included in the program code can be used to execute the steps of the crash clustering method described in the above method embodiment. For details, see the above Method embodiments will not be described again here.
- the above-mentioned computer program product can be specifically implemented by hardware, software or a combination thereof.
- the computer program product is embodied as a computer storage medium.
- the computer program product is embodied as a software product, such as a Software Development Kit (SDK), etc. wait.
- SDK Software Development Kit
- the disclosed devices and methods can be implemented in other ways.
- the device embodiments described above are only illustrative.
- the division of the units is only a logical function division.
- multiple units or components may be combined or Some features can be ignored, or not implemented.
- the coupling or direct coupling or communication connection between each other shown or discussed may be through some communication interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
- the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
- each functional unit in various embodiments of the present disclosure may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
- the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor.
- the technical solution of the present disclosure is essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product.
- the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present disclosure.
- the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk, etc.
Abstract
本公开提供了一种崩溃聚类方法、装置、电子设备以及存储介质，其中，该方法包括：获取多条在操作系统发生崩溃后生成的系统崩溃信息；针对所述系统崩溃信息，基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征；基于所述崩溃特征，生成所述系统崩溃信息对应的特征标识；基于所述特征标识，对多条所述系统崩溃信息进行聚类，得到至少一种崩溃原因对应的系统崩溃信息组。本公开实施例针对操作系统发生的崩溃，将崩溃后产生的系统崩溃信息按照某些特征进行分类，将相同原因导致的崩溃划分为同一类，减少问题种类便于开发者查看。
Description
本申请要求于2022年03月28日提交中国专利局、申请号为202210312150.0、申请名称为“一种崩溃聚类方法、装置、电子设备以及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
本公开涉及计算机技术领域，具体而言，涉及一种崩溃聚类方法、装置、电子设备以及存储介质。
目前，在用户终端发生崩溃后，崩溃信息会上传到数据库中，便于开发者查看、分析崩溃发生原因以及修复问题。由于上报的崩溃量是非常庞大的，需要按照某些特征将崩溃进行分类，将相同原因导致的崩溃划分为同一类，减少问题种类便于开发者处理，某些问题的发生次数还可以在一定程度上代表该类问题的重要程度和影响大小。用户终端发生崩溃的情况有应用程序发生崩溃和操作系统发生崩溃，现有类似技术只有针对应用程序发生的崩溃的聚类，缺少针对操作系统发生的崩溃聚类方法。
发明内容
本公开实施例至少提供一种崩溃聚类方法、装置、电子设备以及存储介质。
第一方面，本公开实施例提供了一种崩溃聚合方法，包括：
获取多条在操作系统发生崩溃后生成的系统崩溃信息；
针对所述系统崩溃信息，基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征；
基于所述崩溃特征，生成所述系统崩溃信息对应的特征标识；
基于所述特征标识，对多条所述系统崩溃信息进行聚类，得到至少一种崩溃原因对应的系统崩溃信息组。
一种可选的实施方式中，所述操作系统发生的崩溃包括线程崩溃；
所述获取多条在操作系统发生崩溃后生成的系统崩溃信息，包括：
获取所述操作系统中发生崩溃的线程对应的调用栈信息；
基于所述调用栈信息，生成所述系统崩溃信息。
一种可选的实施方式中，所述基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征，包括：
在所述系统崩溃信息为基于所述调用栈信息生成的情况下，从所述系统崩溃信息中提取出崩溃进程的目标标识信息、所述系统崩溃信息的摘要信息以及所述目标进程的调用信息，作为所述崩溃特征。
一种可选的实施方式中，从所述系统崩溃信息中提取出所述目标进程的调用信息，包括：
从所述系统崩溃信息中，提取出所述目标进程调用的目标对象的类名、所述目标对象的方法名以及所述目标对象对应的持锁信息。
一种可选的实施方式中，所述操作系统发生的崩溃包括内核崩溃；
所述获取多条在操作系统发生崩溃后生成的系统崩溃信息，包括：
获取所述操作系统在因内核崩溃重启之前的内核运行日志信息；
基于所述内核运行日志信息，生成所述系统崩溃信息。
一种可选的实施方式中，所述基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征，包括：
在所述系统崩溃信息为基于所述内核运行日志信息生成的情况下，确定所述系统崩溃信息中指示的崩溃类型信息；
确定与所述崩溃类型信息匹配的正则表达式；
利用所述正则表达式，从所述系统崩溃信息中提取崩溃原因信息；
从所述系统崩溃信息中提取出发生所述内核崩溃时的待执行指令信息以及发生异常的内存地址信息；
将所述崩溃类型信息、所述崩溃原因信息、所述待执行指令信息以及所述内存地址信息作为所述崩溃特征。
一种可选的实施方式中，所述基于所述崩溃特征，生成所述系统崩溃信息对应的特征标识，包括：
确定所述崩溃特征的信息摘要值，并将所述信息摘要值作为所述系统崩溃信息对应的特征标识。
第二方面，本公开实施例还提供一种崩溃聚类装置，包括：
获取模块，用于获取多条在操作系统发生崩溃后生成的系统崩溃信息；
提取模块，用于针对所述系统崩溃信息，基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征；
计算模块，用于基于所述崩溃特征，生成所述系统崩溃信息对应的特征标识；
归类模块，用于基于所述特征标识，对多条所述系统崩溃信息进行聚类，得到至少一种崩溃原因对应的系统崩溃信息组。
一种可选的实施方式中，所述操作系统发生的崩溃包括线程崩溃；
所述获取模块在获取多条在操作系统发生崩溃后生成的系统崩溃信息时用于：
所述获取多条在操作系统发生崩溃后生成的系统崩溃信息，包括：
获取所述操作系统中发生崩溃的线程对应的调用栈信息；
基于所述调用栈信息，生成所述系统崩溃信息。
一种可选的实施方式中，所述提取模块在基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征时，用于：
在所述系统崩溃信息为基于所述调用栈信息生成的情况下，从所述系统崩溃信息中提取出崩溃进程的目标标识信息、所述系统崩溃信息的摘要信息以及所述目标进程的调用信息，作为所述崩溃特征。
一种可选的实施方式中，所述提取模块在从所述系统崩溃信息中提取出所述目标进程的调用信息时，用于：
从所述系统崩溃信息中，提取出所述目标进程调用的目标对象的类名、所述目标对象的方法名以及所述目标对象对应的持锁信息。
一种可选的实施方式中，所述操作系统发生的崩溃包括内核崩溃；
所述获取模块在获取多条在操作系统发生崩溃后生成的系统崩溃信息时，具体用于：
获取所述操作系统在因内核崩溃重启之前的内核运行日志信息，基于所述内核运行日志信息，生成所述系统崩溃信息。
一种可选的实施方式中，所述提取模块在基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征时，具体用于：
在所述系统崩溃信息为基于所述内核运行日志信息生成的情况下，确定所述系统崩溃信息中指示的崩溃类型信息，用所述正则表达式，从所述系统崩溃信息中提取崩溃原因信息，从所述系统崩溃信息中提取出发生所述内核崩溃时的待执行指令信息以及发生异常的内存地址信息，所述崩溃类型信息、所述崩溃原因信息、所述待执行指令信息以及所述内存地址信息作为所述崩溃特征。
一种可选的实施方式中，所述计算模块在基于所述崩溃特征，生成所述系统崩溃信息对应的特征标识时，具体用于：
确定所述崩溃特征的信息摘要值，并将所述信息摘要值作为所述系统崩溃信息对应的特征标识。
第三方面，本公开实施例还提供一种电子设备，包括：处理器、存储器和总线，所述存储器存储有所述处理器可执行的机器可读指令，当电子设备运行时，所述处理器与所述存储器之间通过总线通信，所述机器可读指令被所述处理器执行时执行上述第一方面，或第一方面中任一种可能的实施方式中的步骤。
第四方面，本公开实施例还提供一种计算机可读存储介质，该计算机可读存储介质上存储有计算机程序，该计算机程序被处理器运行时执行上述第一方面，或第一方面中任一种可能的实施方式中的步骤。
本公开实施例提供的崩溃聚类方法、装置、电子设备及存储介质，首先获取多条在操作系统发生崩溃后生成的系统崩溃信息，然后，针对系统崩溃信息，基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征，之后，基于所述崩溃特征，生成所述系统崩溃信息对应的特征标识，最后，基于所述特征标识，对多条系统崩溃信息进行聚类，得到至少一种崩溃原因对应的系统崩溃信息组。
本公开实施例通过基于系统崩溃信息的类型，从系统崩溃信息中提取崩溃特征，崩溃特征能够体现系统崩溃信息中关于崩溃的特征点，具有代表性，由崩溃特征生成的特征标识能够对崩溃特征的特征进行表征，因此，崩溃标识能够体现崩溃的各种特征，实现了对崩溃高度概括，不直接对系统崩溃信息进行聚类，而是对特征标识的聚类，能够将大量的无关信息剔除，在保留各种与崩溃相关的特征的前提下，提高聚类效率，减少问题种类便于开发者查看和修正。
为使本公开的上述目的、特征和优点能更明显易懂，下文特举较佳实施例，并配合所附附图，作详细说明如下。
为了更清楚地说明本公开实施例的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，此处的附图被并入说明书中并构成本说明书中的一部分，这些附图
示出了符合本公开的实施例，并与说明书一起用于说明本公开的技术方案。应当理解，以下附图仅示出了本公开的某些实施例，因此不应被看作是对范围的限定，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他相关的附图。
图1示出了本公开实施例所提供的一种崩溃聚类方法的流程图；
图2示出了本公开实施例所提供的一种崩溃聚类装置的示意图；
图3示出了本公开实施例所提供的一种电子设备的示意图。
为使本公开实施例的目的、技术方案和优点更加清楚，下面将结合本公开实施例中附图，对本公开实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本公开一部分实施例，而不是全部的实施例。通常在此处附图中描述和示出的本公开实施例的组件可以以各种不同的配置来布置和设计。因此，以下对在附图中提供的本公开的实施例的详细描述并非旨在限制要求保护的本公开的范围，而是仅仅表示本公开的选定实施例。基于本公开的实施例，本领域技术人员在没有做出创造性劳动的前提下所获得的所有其他实施例，都属于本公开保护的范围。
应注意到：相似的标号和字母在下面的附图中表示类似项，因此，一旦某一项在一个附图中被定义，则在随后的附图中不需要对其进行进一步定义和解释。
本文中术语“和/或”，仅仅是描述一种关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中术语“至少一种”表示多种中的任意一种或多种中的至少两种的任意组合，例如，包括A、B、C中的至少一种，可以表示包括从A、B和C构成的集合中选择的任意一个或多个元素。
经研究发现，在用户终端发生崩溃后，崩溃信息会上传到数据库中，便于开发者查看、分析崩溃发生原因以及修复问题，但是由于数据量非常庞大，开发者处理起来需要很多时间。
基于上述研究，本公开提供了一种崩溃聚类的方法，对操作系统发生的崩溃，将崩溃后产生的系统崩溃信息按照某些特征进行分类，将相同原因导致的崩溃划分为同一类，减少问题种类便于开发者查看。
为便于对本实施例进行理解，首先对本公开实施例所公开的一种崩溃聚类方法进行详细介绍，本公开实施例所提供的崩溃聚类方法的执行主体一般为具有一定计算能力的计算机设备。在一些可能的实现方式中，该崩溃聚类方法可以通过处理器调用存储器中存储的计算机可读指令的方式来实现。
参见图1所示，为本公开实施例提供的崩溃聚类方法的流程图，所述方法包括步骤S101～S104，其中：
S101：获取多条在操作系统发生崩溃后生成的系统崩溃信息。
其中，操作系统是管理计算机硬件与软件资源的计算机程序，需要处理如管理与配置内存、决定系统资源供需的优先次序、控制输入设备与输出设备、操作网络与管理文件系统等基本事务，提供一个让用户和系统交互的操作界面。目前操作系统主要有PC端和移
动端两种类型，PC端包括但不限于微软Windows系统(通常用于普通计算机)和Linux系统(通常用于服务器)；移动端包括但不限于安卓系统和iOS系统。操作系统的应用非常广泛，从智能台灯、扫地机器人、手机、计算机到大型服务器，都需要操作系统。
可选的，操作系统崩溃是指由操作失误或病毒入侵导致系统无法正常运作、频繁死机的症状，包括线程崩溃和内核崩溃。
其中，线程崩溃是指线程因资源被占用或其他原因无法继续进行导致的操作系统崩溃。通常使用watchdog(看门狗)监控操作系统的运行状况，所述看门狗从本质上来说是一个定时器电路，一般有一个输入和输出，其中输入被称为喂狗，输出一般连接到另外一个部分的复位端。操作系统稳定运行时会在执行完特定指令后进行喂狗，若在一定周期内看门狗没有收到来自软件的喂狗信号，则认为系统异常。
若操作系统两次喂狗超时，则所述操作系统崩溃为线程崩溃，所述系统崩溃信息从所有线程的调用栈信息中获取。
具体的，在所述崩溃为线程崩溃的情况下，可以获取操作系统发生崩溃的线程对应的调用栈信息，并基于调用栈信息，生成所述系统崩溃信息。
示例性的，可以通过操作系统上运行崩溃检测程序，获取发生崩溃的目标进程的进程名，目标进程的进程名即为目标标识信息，然后基于调用栈信息中的特征生成系统崩溃信息的摘要信息，最后，生成包含发生崩溃的进程的目标标识信息、上述摘要信息及上述调用栈信息的系统崩溃信息。
可选的，内核崩溃是指发生在内核的崩溃，若操作系统崩溃为内核崩溃时，所述系统崩溃信息从因内核崩溃重启之前的内核运行日志信息中获取。
其中，内核运行日志是用来记录操作系统中内核问题的信息，同时还可以监视系统中发生的事件，可用来检查崩溃发生的原因或寻找受到攻击时攻击者留下的痕迹。若所述系统崩溃信息为是基于所述内核运行日志信息生成的，则所述系统崩溃信息中指示的崩溃类型为内核崩溃。
具体的，在所述崩溃为内核崩溃的情况下，可以获取所述操作系统在因内核崩溃重启之前的内核运行日志信息；然后，基于所述内核运行日志信息，生成所述系统崩溃信息。
具体的，所述基于所述内核运行日志信息，生成所述系统崩溃信息，包括：
通过从上到下遍历所述内核运行日志中回溯堆栈的代码行，将提取的信息作为所述系统崩溃信息。
S102：针对所述系统崩溃信息，基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征。
例如，可以针对每条系统崩溃信息，基于系统崩溃信息的类型，从系统崩溃信息中提取崩溃特征。
在所述系统崩溃信息为基于所述调用栈信息生成的情况下，可以从所述系统崩溃信息中提取出崩溃进程的目标标识信息、所述系统崩溃信息的摘要信息以及所述目标进程的调用信息，作为所述崩溃特征。
进一步的，从排除地址信息干扰的所述目标进程的调用信息中，提取出所述目标进程调用的目标对象的类名、所述目标对象的方法名以及所述目标对象对应的持锁信息。
其中，锁是用来在多线程运行过程中合理分配资源的，持锁是指某线程正在占用某资源。
需要注意的是，由于调用信息中的持锁信息通常包含持锁对象对应的内存地址，而持锁对象在内存中的地址会发生变化，在发生变化的情况下，若仍利用内存地址进行聚类，相同类型的问题会被聚类为不同类型的问题，因此，可以将持锁对象的地址信息删除，从而排除了地址信息对特征标识的影响。
示例性的，若所述系统崩溃信息为基于所述内核运行日志信息生成的时，可以通过以下步骤从所述系统崩溃信息中提取崩溃特征：
在所述系统崩溃信息为基于所述内核运行日志信息生成的情况下，确定所述系统崩溃信息中指示的崩溃类型信息，然后确定与所述崩溃类型信息匹配的正则表达式，根据所述正则表达式，从所述系统崩溃信息中提取崩溃原因信息，再从所述系统崩溃信息中提取出发生所述内核崩溃时的待执行指令信息以及发生异常的内存地址信息；最后，将提取出的所述崩溃类型信息、所述崩溃原因信息、所述待执行指令信息以及所述内存地址信息作为所述崩溃特征。
具体的，根据自定义崩溃类型，内核崩溃的崩溃类型包括KE(内核崩溃)类型和非KE类型；对于KE类型，崩溃类型信息取值可能为KE(内核异常)、JE(Java异常)和NE(native异常)；对于非KE类型，崩溃类型信息取值可能为HWT、HW_REBOOT、THERMAL_REBOOT、OCP、SPAR、UVLO、HANG_DETECT等。
在确定了所述系统崩溃信息的崩溃类型后，确定与所述崩溃类型信息匹配的正则表达式，利用所述正则表达式，从所述系统崩溃信息中提取崩溃原因信息。
其中，对于KE类型，所述崩溃原因信息的崩溃类型信息取值有以下五种情况：
1、kernel bug on(崩溃发生的位置)问题利用正则表达式使用字段kernel BUG at作为句柄提取崩溃原因信息，用于常见崩溃信息原因的提取；
2、virtual address(虚拟地址)问题利用正则表达式使用字段Unable to handle kernel paging request at virtual address(无法在虚拟地址处理内核分页请求)作为句柄提取崩溃原因信息，用于虚拟地址异常信息的提取；
3、null pointer(空指针)问题利用正则表达式使用字段Unable to handle kernel NULL pointer dereference at virtual address(无法在虚拟地址处理空指针引用)作为句柄提取崩溃原因信息，用于误用指针引起异常信息的提取；
4、sysrq-trigger(系统请求触发器)问题利用正则表达式使用字段sysrq(系统请求)作为句柄提取崩溃原因信息，用于系统出现难重现异常时异常信息的提取；
5、其他问题直接使用字段exception_info(所述崩溃信息)中的信息作为崩溃原因信息。
对于非KE问题，直接使用字段exception_info(所述崩溃信息)中的信息作为崩溃原因信息。
S103：基于所述崩溃特征，生成所述系统崩溃信息对应的特征标识。
示例性的，可以先确定所述崩溃特征的信息摘要值，然后将所述信息摘要值作为所述系统崩溃信息对应的特征标识。
其中，信息摘要值可以通过信息摘要算法(Message-Digest Algorithm，MD5)确定，这是一种密码散列函数，可以产生出一个128位(16字节)的散列值，通常用于确保信息传输完整一致，具体来说，将多个字符串输入，通过MD5算法，可以获得一串对应的固定值，也就是说，输入相同特征的字符串，就会获得相同的特征标识，因此，使用MD5信息摘要算法来确定信息摘要值，可以将具有相同特征的系统崩溃信息归为一类，提高崩溃信息分类效率。
S104：基于所述特征标识，对多条所述系统崩溃信息进行聚类，得到至少一种崩溃原因对应的系统崩溃信息组。
具体的，所述系统崩溃信息组中包括一条或一条以上具有相同或相似特征标识的操作系统崩溃信息。
其中，所述相同或相似特征标识通过MD5信息摘要算法来确定：提取常见操作系统崩溃信息特征标识(一个128位的散列值)，设定第一阈值。若操作系统崩溃信息通过MD5信息摘要算法确定的特征标识，在某常见操作系统崩溃信息特征标识的第一阈值内，则该操作系统崩溃信息属于归为该常见操作系统崩溃信息组。这样可以将大量的操作系统崩溃信息进行分类，减少开发人员要处理的操作系统崩溃信息量。
本公开实施例提供的崩溃聚类方法，获取多条在操作系统发生崩溃后生成的系统崩溃信息；针对系统崩溃信息，基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征；基于所述崩溃特征，生成所述系统崩溃信息对应的特征标识；基于所述特征标识，对多条所述系统崩溃信息进行聚类，得到至少一种崩溃原因对应的系统崩溃信息组。本公开实施例基于系统崩溃信息的类型，从系统崩溃信息中提取崩溃特征，崩溃特征能够体现系统崩溃信息中关于崩溃的特征点，具有代表性，由崩溃特征生成的特征标识能够对崩溃特征的特征进行表征，因此，崩溃标识能够体现崩溃的各种特征，实现了对崩溃高度概括，不直接对系统崩溃信息进行聚类，而是对特征标识的聚类，能够将大量的无关信息剔除，在保留各种与崩溃相关的特征的前提下，提高聚类效率，减少问题种类便于开发者查看和修正。
本领域技术人员可以理解，在具体实施方式的上述方法中，各步骤的撰写顺序并不意味着严格的执行顺序而对实施过程构成任何限定，各步骤的具体执行顺序应当以其功能和可能的内在逻辑确定。
基于同一发明构思，本公开实施例中还提供了与崩溃聚类方法对应的崩溃聚类装置，由于本公开实施例中的装置解决问题的原理与本公开实施例上述崩溃聚类方法相似，因此装置的实施可以参见方法的实施，重复之处不再赘述。
参照图2所示，为本公开实施例提供的一种崩溃聚类装置的示意图，所述装置包括：
获取模块201，用于获取多条在操作系统发生崩溃后生成的系统崩溃信息；
提取模块202，用于针对所述系统崩溃信息，基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征；
计算模块203，用于基于所述崩溃特征，生成所述系统崩溃信息对应的特征标识；
归类模块204，用于基于所述特征标识，对多条所述系统崩溃信息进行聚类，得到至少一种崩溃原因对应的系统崩溃信息组。
本公开实施例中，基于系统崩溃信息的类型，从系统崩溃信息中提取崩溃特征，崩溃特征能够体现系统崩溃信息中关于崩溃的特征点，具有代表性，由崩溃特征生成的特征标识能够对崩溃特征的特征进行表征，因此，崩溃标识能够体现崩溃的各种特征，实现了对崩溃高度概括，不直接对系统崩溃信息进行聚类，而是对特征标识的聚类，能够将大量的无关信息剔除，在保留各种与崩溃相关的特征的前提下，提高聚类效率，减少问题种类便于开发者查看和修正。
一种可选的实施方式中，所述操作系统发生的崩溃包括线程崩溃；
所述获取模块201在获取多条在操作系统发生崩溃后生成的系统崩溃信息时，用于：
获取所述操作系统中发生崩溃的线程对应的调用栈信息；
基于所述调用栈信息，生成所述系统崩溃信息。
一种可选的实施方式中，所述提取模块202在基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征时，用于：
在所述系统崩溃信息为基于所述调用栈信息生成的情况下，从所述系统崩溃信息中提取出崩溃进程的目标标识信息、所述系统崩溃信息的摘要信息以及所述目标进程的调用信息，作为所述崩溃特征。
一种可选的实施方式中，所述提取模块202在从所述系统崩溃信息中提取出所述目标进程的调用信息时，用于：
从所述系统崩溃信息中，提取出所述目标进程调用的目标对象的类名、所述目标对象的方法名以及所述目标对象对应的持锁信息。
一种可选的实施方式中，所述操作系统发生的崩溃包括内核崩溃；
所述获取模块201在获取多条在操作系统发生崩溃后生成的系统崩溃信息时，用于：
获取所述操作系统在因内核崩溃重启之前的内核运行日志信息；
基于所述内核运行日志信息，生成所述系统崩溃信息。
一种可选的实施方式中，所述提取模块202在基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征时，用于：
在所述系统崩溃信息为基于所述内核运行日志信息生成的情况下，确定所述系统崩溃信息中指示的崩溃类型信息；
确定与所述崩溃类型信息匹配的正则表达式；
利用所述正则表达式，从所述系统崩溃信息中提取崩溃原因信息；
从所述系统崩溃信息中提取出发生所述内核崩溃时的待执行指令信息以及发生异常的内存地址信息；
将所述崩溃类型信息、所述崩溃原因信息、所述待执行指令信息以及所述内存地址信息作为所述崩溃特征。
一种可选的实施方式中，所述计算模块203在基于所述崩溃特征，生成所述系统崩溃信息对应的特征标识时，用于：
确定所述崩溃特征的信息摘要值，并将所述信息摘要值作为所述系统崩溃信息对应的特征标识。
关于装置中的各模块的处理流程、以及各模块之间的交互流程的描述可以参照上述方
法实施例中的相关说明，这里不再详述。
对应于图1中的崩溃聚类方法，本公开实施例还提供了一种电子设备300，如图3所示，为本公开实施例提供的电子设备300结构示意图，包括：
处理器31、存储器32、和总线33；存储器32用于存储执行指令，包括内存321和外部存储器322；这里的内存321也称内存储器，用于暂时存放处理器31中的运算数据，以及与硬盘等外部存储器322交换的数据，处理器31通过内存321与外部存储器322进行数据交换，当所述电子设备300运行时，所述处理器31与所述存储器32之间通过总线33通信，使得所述处理器31执行以下指令：
获取多条在操作系统发生崩溃后生成的系统崩溃信息；
针对所述系统崩溃信息，基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征；
基于所述崩溃特征，生成所述系统崩溃信息对应的特征标识；
基于所述特征标识，对多条所述系统崩溃信息进行聚类，得到至少一种崩溃原因对应的系统崩溃信息组。
一种可能的实施方案中，所述处理器31执行的指令中，所述操作系统发生的崩溃包括线程崩溃；
所述获取多条在操作系统发生崩溃后生成的系统崩溃信息，包括：
获取所述操作系统中发生崩溃的线程对应的调用栈信息；
基于所述调用栈信息，生成所述系统崩溃信息。
一种可能的实施方案中，所述处理器31执行的指令中，所述基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征，包括：
在所述系统崩溃信息为基于所述调用栈信息生成的情况下，从所述系统崩溃信息中提取出崩溃进程的目标标识信息、所述系统崩溃信息的摘要信息以及所述目标进程的调用信息，作为所述崩溃特征。
一种可能的实施方案中，所述处理器31执行的指令中，从所述系统崩溃信息中提取出所述目标进程的调用信息，包括：
从所述系统崩溃信息中，提取出所述目标进程调用的目标对象的类名、所述目标对象的方法名以及所述目标对象对应的持锁信息。
一种可能的实施方案中，所述处理器31执行的指令中，所述操作系统发生的崩溃包括内核崩溃；
所述获取多条在操作系统发生崩溃后生成的系统崩溃信息，包括：
获取所述操作系统在因内核崩溃重启之前的内核运行日志信息；
基于所述内核运行日志信息，生成所述系统崩溃信息。
一种可能的实施方案中，所述处理器31执行的指令中，所述基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征，包括：
在所述系统崩溃信息为基于所述内核运行日志信息生成的情况下，确定所述系统崩溃信息中指示的崩溃类型信息；
确定与所述崩溃类型信息匹配的正则表达式；
利用所述正则表达式，从所述系统崩溃信息中提取崩溃原因信息；
从所述系统崩溃信息中提取出发生所述内核崩溃时的待执行指令信息以及发生异常的内存地址信息；
将所述崩溃类型信息、所述崩溃原因信息、所述待执行指令信息以及所述内存地址信息作为所述崩溃特征。
一种可能的实施方案中，所述处理器31执行的指令中，所述基于所述崩溃特征，生成所述系统崩溃信息对应的特征标识，包括：
确定所述崩溃特征的信息摘要值，并将所述信息摘要值作为所述系统崩溃信息对应的特征标识。
本公开实施例还提供一种计算机可读存储介质，该计算机可读存储介质上存储有计算机程序，该计算机程序被处理器运行时执行上述方法实施例中所述的崩溃聚类方法的步骤。其中，该存储介质可以是易失性或非易失的计算机可读取存储介质。
本公开实施例还提供一种计算机程序产品，该计算机程序产品承载有程序代码，所述程序代码包括的指令可用于执行上述方法实施例中所述的崩溃聚类方法的步骤，具体可参见上述方法实施例，在此不再赘述。
其中，上述计算机程序产品可以具体通过硬件、软件或其结合的方式实现。在一个可选实施例中，所述计算机程序产品具体体现为计算机存储介质，在另一个可选实施例中，计算机程序产品具体体现为软件产品，例如软件开发包(Software Development Kit，SDK)等等。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述装置的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。在本公开所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，又例如，多个单元或组件可以结合或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些通信接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本公开各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个处理器可执行的非易失的计算机可读取存储介质中。基于这样的理解，本公开的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本公开各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各
种可以存储程序代码的介质。
最后应说明的是：以上所述实施例，仅为本公开的具体实施方式，用以说明本公开的技术方案，而非对其限制，本公开的保护范围并不局限于此，尽管参照前述实施例对本公开进行了详细的说明，本领域的普通技术人员应当理解：任何熟悉本技术领域的技术人员在本公开揭露的技术范围内，其依然可以对前述实施例所记载的技术方案进行修改或可轻易想到变化，或者对其中部分技术特征进行等同替换；而这些修改、变化或者替换，并不使相应技术方案的本质脱离本公开实施例技术方案的精神和范围，都应涵盖在本公开的保护范围之内。因此，本公开的保护范围应所述以权利要求的保护范围为准。
Claims (11)
- 一种崩溃聚类方法，包括：获取多条在操作系统发生崩溃后生成的系统崩溃信息；针对所述系统崩溃信息，基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征；基于所述崩溃特征，生成所述系统崩溃信息对应的特征标识；基于所述特征标识，对多条所述系统崩溃信息进行聚类，得到至少一种崩溃原因对应的系统崩溃信息组。
- 根据权利要求1所述的方法，其中，所述操作系统发生的崩溃包括线程崩溃；所述获取多条在操作系统发生崩溃后生成的系统崩溃信息，包括：获取所述操作系统中发生崩溃的线程对应的调用栈信息；基于所述调用栈信息，生成所述系统崩溃信息。
- 根据权利要求2所述的方法，其中，所述基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征，包括：在所述系统崩溃信息为基于所述调用栈信息生成的情况下，从所述系统崩溃信息中提取出崩溃进程的目标标识信息、所述系统崩溃信息的摘要信息以及所述目标进程的调用信息，作为所述崩溃特征。
- 根据权利要求3所述的方法，其中，从所述系统崩溃信息中提取出所述目标进程的调用信息，包括：从所述系统崩溃信息中，提取出所述目标进程调用的目标对象的类名、所述目标对象的方法名以及所述目标对象对应的持锁信息。
- 根据权利要求1所述的方法，其中，所述操作系统发生的崩溃包括内核崩溃；所述获取多条在操作系统发生崩溃后生成的系统崩溃信息，包括：获取所述操作系统在因内核崩溃重启之前的内核运行日志信息；基于所述内核运行日志信息，生成所述系统崩溃信息。
- 根据权利要求5所述的方法，其中，所述基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征，包括：在所述系统崩溃信息为基于所述内核运行日志信息生成的情况下，确定所述系统崩溃信息中指示的崩溃类型信息；确定与所述崩溃类型信息匹配的正则表达式；利用所述正则表达式，从所述系统崩溃信息中提取崩溃原因信息；从所述系统崩溃信息中提取出发生所述内核崩溃时的待执行指令信息以及发生异常的内存地址信息；将所述崩溃类型信息、所述崩溃原因信息、所述待执行指令信息以及所述内存地址信息作为所述崩溃特征。
- 根据权利要求1所述的方法，其中，所述基于所述崩溃特征，生成所述系统崩溃信息对应的特征标识，包括：确定所述崩溃特征的信息摘要值，并将所述信息摘要值作为所述系统崩溃信息对 应的特征标识。
- 一种崩溃聚类装置，包括：获取模块，用于获取多条在操作系统发生崩溃后生成的系统崩溃信息；提取模块，用于针对所述系统崩溃信息，基于所述系统崩溃信息的类型，从所述系统崩溃信息中提取崩溃特征；计算模块，用于基于所述崩溃特征，生成所述系统崩溃信息对应的特征标识；归类模块，用于基于所述特征标识，对多条所述系统崩溃信息进行聚类，得到至少一种崩溃原因对应的系统崩溃信息组。
- 一种电子设备，包括：处理器、存储器和总线，所述存储器存储有所述处理器可执行的机器可读指令，当电子设备运行时，所述处理器与所述存储器之间通过总线通信，所述机器可读指令被所述处理器执行时执行如权利要求1至7任一所述的崩溃聚类方法的步骤。
- 一种计算机可读存储介质，该计算机可读存储介质上存储有计算机程序，该计算机程序被处理器运行时执行如权利要求1至7任意一项所述的崩溃聚类方法的步骤。
- 一种计算机程序产品，该计算机程序产品承载有程序代码，所述程序代码包括的指令可用于执行如权利要求1至7任意一项所述的崩溃聚类方法的步骤。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210312150.0 | 2022-03-28 | ||
| CN202210312150.0A CN114722927A (zh) | 2022-03-28 | 2022-03-28 | 一种崩溃聚类方法、装置、电子设备以及存储介质 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2023185335A1 true WO2023185335A1 (zh) | 2023-10-05 |
Family
ID=82240403
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2023/078027 WO2023185335A1 (zh) | 2022-03-28 | 2023-02-24 | 一种崩溃聚类方法、装置、电子设备以及存储介质 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN114722927A (zh) |
| WO (1) | WO2023185335A1 (zh) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114722927A (zh) * | 2022-03-28 | 2022-07-08 | 北京字节跳动网络技术有限公司 | 一种崩溃聚类方法、装置、电子设备以及存储介质 |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110262918A (zh) * | 2019-06-19 | 2019-09-20 | 深圳市网心科技有限公司 | 进程崩溃分析方法及装置、分布式设备及存储介质 |
| CN110489345A (zh) * | 2019-08-08 | 2019-11-22 | 北京字节跳动网络技术有限公司 | 一种崩溃聚合方法、装置、介质和设备 |
| US10606683B1 (en) * | 2017-10-24 | 2020-03-31 | Electronic Arts Inc. | Crash clustering call stacks with game state data |
| CN111061583A (zh) * | 2019-11-15 | 2020-04-24 | 腾讯科技（深圳）有限公司 | 一种崩溃信息处理方法、装置、设备及介质 |
| CN112099982A (zh) * | 2020-09-08 | 2020-12-18 | 北京字节跳动网络技术有限公司 | 一种崩溃信息定位方法、装置、介质和电子设备 |
| CN114722927A (zh) * | 2022-03-28 | 2022-07-08 | 北京字节跳动网络技术有限公司 | 一种崩溃聚类方法、装置、电子设备以及存储介质 |
-
2022
- 2022-03-28 CN CN202210312150.0A patent/CN114722927A/zh active Pending
-
2023
- 2023-02-24 WO PCT/CN2023/078027 patent/WO2023185335A1/zh unknown
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US10606683B1 (en) * | 2017-10-24 | 2020-03-31 | Electronic Arts Inc. | Crash clustering call stacks with game state data |
| CN110262918A (zh) * | 2019-06-19 | 2019-09-20 | 深圳市网心科技有限公司 | 进程崩溃分析方法及装置、分布式设备及存储介质 |
| CN110489345A (zh) * | 2019-08-08 | 2019-11-22 | 北京字节跳动网络技术有限公司 | 一种崩溃聚合方法、装置、介质和设备 |
| CN111061583A (zh) * | 2019-11-15 | 2020-04-24 | 腾讯科技（深圳）有限公司 | 一种崩溃信息处理方法、装置、设备及介质 |
| CN112099982A (zh) * | 2020-09-08 | 2020-12-18 | 北京字节跳动网络技术有限公司 | 一种崩溃信息定位方法、装置、介质和电子设备 |
| CN114722927A (zh) * | 2022-03-28 | 2022-07-08 | 北京字节跳动网络技术有限公司 | 一种崩溃聚类方法、装置、电子设备以及存储介质 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114722927A (zh) | 2022-07-08 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9787706B1 (en) | Modular architecture for analysis database | |
| US10261853B1 (en) | Dynamic replication error retry and recovery | |
| US11093270B2 (en) | Fast-booting application image | |
| WO2022063284A1 (zh) | 数据同步方法、装置、设备及计算机可读介质 | |
| CN105723348A (zh) | 使用事务性存储器检测未授权存储器修改及访问 | |
| CN106371953B (zh) | 紧凑二进制事件日志生成方法及系统 | |
| US20160034582A1 (en) | Computing device and method for executing database operation command | |
| US20120102462A1 (en) | Parallel test execution | |
| WO2021072880A1 (zh) | 虚拟机内部快照异步创建方法、装置、系统及存储介质 | |
| EP2819015B1 (en) | Method, terminal, and server for synchronizing terminal mirror | |
| WO2022151776A1 (zh) | 一种云平台虚拟机回收方法及计算机设备 | |
| WO2023185335A1 (zh) | 一种崩溃聚类方法、装置、电子设备以及存储介质 | |
| CN115280283A (zh) | 在kubernets中运行pbs作业 | |
| WO2023011249A1 (zh) | Io多路复用方法、介质、设备和操作系统 | |
| CN107623581B (zh) | 服务列表生成方法、装置及系统，获取、上报方法及装置 | |
| WO2017157111A1 (zh) | 防止内存数据丢失的的方法、装置和系统 | |
| US11507292B2 (en) | System and method to utilize a composite block of data during compression of data blocks of fixed size | |
| WO2019169771A1 (zh) | 电子装置、访问指令信息获取方法及存储介质 | |
| CN109189652A (zh) | 一种封闭网络终端行为数据的采集方法及系统 | |
| CN113157426A (zh) | 一种任务调度方法、系统、设备及存储介质 | |
| US20200272441A1 (en) | Systems and methods for mapping software applications interdependencies | |
| US9659041B2 (en) | Model for capturing audit trail data with reduced probability of loss of critical data | |
| CN116339908A (zh) | 虚拟机启动方法、装置、计算机设备和存储介质 | |
| US8359602B2 (en) | Method and system for task switching with inline execution | |
| CN113656378A (zh) | 一种服务器管理方法、装置、介质 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 23777713 Country of ref document: EP Kind code of ref document: A1 |