CN110493025B - A method and device for fault root cause diagnosis based on multi-layer directed graph - Google Patents

Abstract

The embodiment of the present invention discloses a method and device for fault root cause diagnosis based on a multi-layer directed graph. The method jointly determines the calling relationship of each service node according to the original service data and attribute information, and can fully consider the actual new The added business node or the newly added calling relationship ensures that each business node can be added to the multi-layer directed graph model when the multi-layer directed graph model is established according to the calling relationship, which is based on the multi-layer directed graph model. It lays a foundation for accurately and quickly finding the root cause nodes that generate abnormal business data. Since the service nodes in the multi-layer directed graph model in this embodiment are generated according to actual service nodes, the comprehensiveness of the nodes avoids the need to perform root cause query for newly-occurring faults. At the same time, the analysis of data not only It is based on the calling relationship, but comprehensively analyzes the data based on the created multi-layer directed graph model.

Description

A method and device for fault root cause diagnosis based on multi-layer directed graph

technical field

Embodiments of the present invention relate to the technical field of computer software, and in particular, to a method and device for root cause diagnosis of faults based on a multi-layer directed graph.

Background technique

With the popularity of cloud computing and container cloud, a large number of IT application systems are gradually deployed in virtualized and containerized environments. With the continuous enrichment of various business scenarios and the explosive growth of business volume, it brings huge challenges to the ease of maintenance of systems and applications. Especially in the telecommunications industry, operators themselves have built a lot of application systems to provide various special services for consumers, and some system functions involve sub-functions of multiple business systems, requiring multi-system collaboration to work properly. The evolution of the architecture has exacerbated the complexity of such business systems, and has put forward higher requirements on the ability to locate and solve O&M faults.

The current fault diagnosis methods include three types. Scheme one is based on fault diagnosis in the form of alarms and other plan libraries, scheme two is based on fault diagnosis in the form of alarms and other plan libraries, and scheme three is fault diagnosis and repair methods based on decision tree models. Among them, fault diagnosis in the form of alarms and other plans: most operation and maintenance departments usually compile fault handling manuals according to fault symptoms and processing records, and some equipment suppliers will also provide similar simple fault location capabilities to achieve preliminary fault diagnosis. location and solution. In addition to historical fault experience, it also includes other dimensions such as QoE (Quality of User Experience) for fault diagnosis. Once a fault occurs, generate diagnostic results by collecting key alarm information and retrieving the corresponding diagnostic manual. Therefore, the alarm-based method can easily and quickly complete the daily fault location and repair, but it is powerless when faced with unknown faults that do not match the known alarm information. Fault diagnosis method based on offline indicator analysis tool: The offline indicator analysis tool includes business indicators and system operation indicators. The former mainly reflects business volume indicators through business inbound data, and the latter mainly imports external data such as logs into the database for analysis. System operation index analysis, analyze system performance, success rate, failure distribution and other information to judge the health of system operation. The database-based method is easy to extract key indicators of the system and effectively monitor the running status of each link of the program, but the time extension is relatively large, which will have a certain impact on the timeliness of system monitoring. Fault diagnosis and repair method based on decision tree model: Most system designs adopt a multi-layer system topology structure, based on the principle of hierarchical invocation, to establish a tree-shaped topology diagram, and based on this tree-shaped topology, a business and system fault-oriented network is established. decision tree. Once a fault occurs, the diagnosis result is generated by collecting the key information of the fault and finding the corresponding decision tree for retrieval. Therefore, the method based on the decision tree can complete the daily fault location and repair simply and quickly, but it is powerless once faced with the non-tree structure calling relationship.

However, in virtualized and containerized environments based on big data platforms, DCOS platforms, module systems, and microservice systems, the existing solutions are insufficient to support rapid response and efficient analysis and resolution for diagnosing and repairing cluster node failures or abnormalities. It is mainly manifested in the following aspects: (1) The usage scenarios are narrow and cannot handle unknown scenarios. For example, the fault diagnosis and repair method in the form of alarm and plan library in Scheme 1 mainly relies on the accumulation of experience on known fault information, and this method has great requirements on fault scenarios. The same fault phenomenon may have different processing methods in different fault scenarios, which is beyond the processing scope of the simple plan library. Especially in the face of unknown fault information, the existing manuals and other methods have completely failed, and manual troubleshooting is required to locate the fault and repair the problem, resulting in low operation and maintenance efficiency. (2) The timeliness of indicators is poor, and information cannot be fed back in time. The improvement of the fault location capability in the existing solutions is limited to strengthening the collection of fault information, and the final location and repair of the fault still depend on the judgment and execution of the operation and maintenance personnel. Through massive monitoring index data, the source of fault information is greatly expanded, but the delay in the collection of indicators is also high, resulting in insufficient automatic processing and analysis capabilities of these data, unable to display the information points and root causes of the problem in time. (3) It requires massive historical data and is not suitable for agile mode. The existing solution mainly uses the training decision tree to improve the analysis ability, but the training decision tree requires a large amount of historical data. Due to the business characteristics of the company's system, new problems account for a large proportion, and sufficient effective training data cannot be provided, resulting in the decision tree model. The accuracy is not high, the ability to analyze the root cause of the failure is insufficient, and it cannot provide effective support.

In the process of implementing the embodiments of the present invention, the inventor found that the existing method for finding the root cause of a fault has poor environmental adaptability, and cannot perform root cause query for a newly-occurring fault, and the existing method for finding the root cause of a fault only According to the calling relationship of business nodes, the analysis of data is relatively simple, and the data analysis ability is weak.

SUMMARY OF THE INVENTION

The technical problem to be solved by the present invention is how to solve the problem that the existing method for finding the root cause of a fault has poor environmental adaptability, and cannot perform root cause query for a new fault, and the existing method for finding the root cause of a fault is only based on service nodes. The problem that the calling relationship is searched, the data analysis is relatively simple, and the data analysis ability is weak.

In view of the above technical problems, embodiments of the present invention provide a method for diagnosing fault root causes based on a multi-layer directed graph, including:

acquiring original service data generated at each service node of the preset service, and determining the calling relationship of each service node according to the original service data and the pre-stored attribute information of each service node;

Establish a multi-layer directed graph model of each service node according to the calling relationship of each service node determined by the original service data and the attribute information and the layer to which each service node belongs to pre-divided;

Obtain abnormal business data in the original business data, determine at least one root cause node that causes the business business to generate the abnormal business data according to the multi-layer directed graph model, and determine from the root cause node Set the target root cause node of business exception.

An embodiment of the present invention provides a device for fault root cause diagnosis based on a multi-layer directed graph, including:

an acquisition module, configured to acquire original service data generated at each service node of the preset service, and determine the calling relationship of each service node according to the original service data and the pre-stored attribute information of each service node;

a building module for establishing a multi-layer directed graph model of each service node according to the calling relationship of each service node determined by the original service data and the attribute information and the layer to which each service node belongs to pre-divided;

The root cause determination module is used to obtain the abnormal service data in the original service data, and determine at least one root cause node that causes the service service to generate the abnormal service data according to the multi-layer directed graph model, and determine the root cause node from the root cause. A target root cause node that causes the preset service abnormality is determined in the nodes.

This embodiment provides an electronic device, including:

at least one processor, at least one memory, a communication interface, and a bus; wherein,

The processor, the memory, and the communication interface communicate with each other through the bus;

The communication interface is used for information transmission between the electronic device and the communication device of the terminal device;

The memory stores program instructions executable by the processor, the processor invoking the program instructions capable of performing the method described above.

This embodiment provides a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer, The computer is caused to perform the method described above.

The embodiments of the present invention provide a method and device for fault root cause diagnosis based on a multi-layer directed graph. The method jointly determines the calling relationship of each service node according to the original service data and attribute information, and can fully consider the actual new The added business node or the newly added calling relationship ensures that each business node can be added to the multi-layer directed graph model when the multi-layer directed graph model is established according to the calling relationship, which is based on the multi-layer directed graph model. It lays the foundation to accurately and quickly find the root cause nodes that generate abnormal business data. Since the service nodes in the multi-layer directed graph model in this embodiment are generated according to actual service nodes, the comprehensiveness of the nodes avoids the need to perform root cause query for newly-occurring faults. At the same time, the analysis of data not only It is based on the calling relationship, but comprehensively analyzes the data based on the created multi-layer directed graph model.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts.

1 is a schematic flowchart of a method for root cause diagnosis of faults based on a multi-layer directed graph provided by an embodiment of the present invention;

2 is a schematic diagram of the architecture of fault root cause diagnosis of a multi-layer directed graph provided by another embodiment of the present invention;

3 is a schematic flowchart of a fault root cause query provided by another embodiment of the present invention;

4 is a structural block diagram of an apparatus for root cause diagnosis of faults based on a multi-layer directed graph provided by another embodiment of the present invention;

FIG. 5 is a structural block diagram of an electronic device provided by another embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments These are some embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

FIG. 1 is a schematic flowchart of a method for diagnosing fault root causes based on a multi-layer directed graph provided by the present embodiment. Referring to FIG. 1 , the method includes:

101: Acquire original service data generated at each service node of a preset service, and determine the calling relationship of each service node according to the original service data and pre-stored attribute information of each service node;

102: Build a multi-layer directed graph model of each service node according to the calling relationship of each service node determined by the original service data and the attribute information and the layer to which each service node belongs to pre-divided;

103: Acquire abnormal service data in the original service data, determine at least one root cause node that causes the service service to generate the abnormal service data according to the multi-layer directed graph model, and determine from the root cause node that the cause of the abnormal service data is generated. Describe the target root cause node of the preset service exception.

The method provided in this embodiment is usually executed by a device that performs fault diagnosis and repair on whether a service is running normally, for example, a server, which is not specifically limited in this embodiment. This method is used to query the root cause of a faulty service. The service node is a node in the running process of the preset service, and the data collected at each service node is the original service data of the service. The attribute information is pre-defined attribute information of each service node, and the attribute information reflects the calling relationship of each service node. Each service node can also be layered according to the attribute information, for example, nodes located at the application layer, nodes at the transport layer, and the like. When creating a multi-layer directed graph model of each service node, it is necessary to refer to the pre-divided layer of each service node. When searching for the root cause node that causes the preset business exception through the multi-layer directed graph, it is searched layer by layer according to the calling relationship of each business node. The target root cause node is usually obtained by calculation, and a specific calculation method can be set, which is not specifically limited in this embodiment.

This embodiment provides a fault root cause diagnosis method based on a multi-layer directed graph. The method jointly determines the calling relationship of each service node according to the original service data and attribute information, and can fully consider the newly added service nodes in practice. Or the newly added invocation relationship ensures that each business node can be added to the multi-layer directed graph model when the multi-layer directed graph model is established according to the invocation relationship. The root cause node of abnormal business data lays the foundation. Since the service nodes in the multi-layer directed graph model in this embodiment are generated according to actual service nodes, the comprehensiveness of the nodes avoids the need to perform root cause query for newly-occurring faults. At the same time, the analysis of data not only It is based on the calling relationship, but comprehensively analyzes the data based on the created multi-layer directed graph model.

Further, on the basis of the above-mentioned embodiment, the acquisition of the original service data generated at each service node of the preset service is performed, and the attribute information of each service node is determined according to the original service data and the pre-stored attribute information of each service node. Calling relationships, including:

Obtain the original service data generated at each service node of the preset service and the attribute information of each service node stored in the CMDB database, and obtain the original calling relationship between each service node according to the attribute information of each service node;

The actual calling relationship of each service node is analyzed according to the original service data, and the original calling relationship is adjusted according to the actual calling relationship to obtain the calling relationship of each service node determined by the original service data and the attribute information.

The CMDB database is a database that stores and manages various configuration information of equipment in the enterprise IT architecture. For each service node of the preset service, first, according to the attribute information defined in the CMDB database, the calling relationship of each service node is obtained. However, since the service node of the preset service may be added in practice, and the newly added service node may not exist in the CMDB database, after the original calling relationship is determined, the new node and other services need to be added according to the original service data. The calling relationship of the nodes is supplemented, and finally the actual calling relationship of each service node determined by the original service data and the attribute information is obtained.

This embodiment provides a method for diagnosing fault root causes based on a multi-layer directed graph. The method adjusts the original invocation relationship obtained according to the CMDB database to ensure that the finalized invocation relationship includes all the actual business operations. The calling relationship provides a guarantee that the root cause query can also be performed for new faults.

Further, on the basis of the above-mentioned embodiments, the call relationship of each service node determined by the original service data and the attribute information and the multiplication of each service node are established with the pre-divided layer to which each service node belongs. Layered directed graph model, including:

Amend the service nodes stored in the CMDB database according to the calling relationship of each service node determined by the original service data and the attribute information;

Obtain the pre-divided service nodes of the i-th layer in the revised CMDB database, and to the service nodes v _n of the i-th layer in the CMDB database, according to the calling relationship of each service node determined by the original service data and the attribute information Obtain the target service node that is reached by the service node v _n and can reach the service node v _n ;

Add the target business node corresponding to each business node of the i-th layer in the CMDB database to the i-th layer node set, then the point in the i-th layer node set is the i-th layer in the multi-layer directed graph model. node.

For example, if a new service node is added when the service is actually running, the service node needs to be added to the CMDB database, and the CMDB database needs to be updated in time. Each service node is pre-divided into layers in the CMDB database according to the attributes of each service node. For example, the service nodes belonging to the application layer are divided into the same layer, and the service nodes belonging to the transport layer are divided into the same layer.

In the multi-layer directed graph model, the _i -th layer node set can be represented by the formula Li = {R ₁ ∩ A ₁ , R ₂ ∩ A ₂ , ..., R _n ∩ A _n }. Among them, R _n represents the set of all nodes reachable from v _n , and A _n represents the set of all nodes that can reach v _n . There are a total of n business nodes in the ith layer in the CMDB database, namely v ₁ , v ₂ , ... v _n .

This embodiment provides a method for diagnosing fault root causes based on a multi-layer directed graph. The method obtains the service nodes of each layer in the multi-layer directed graph model according to the layer to which each service node belongs in the CMDB database.

Further, on the basis of the above-mentioned embodiments, the abnormal business data in the original business data is acquired, and at least one element that causes the business business to generate the abnormal business data is determined according to the multi-layer directed graph model. The root cause node, which determines the target root cause node that causes the preset service exception from the root cause node, including:

Determine whether the original business data generated at each business node is abnormal according to the preset threshold interval, and obtain all abnormal abnormal business data in the original business data;

Each abnormal business data is mapped to the business node that generates the abnormal business data in the multi-layer directed graph model, according to the calling relationship of each business node in the multi-layer directed graph model and the Searching for at least one root cause node of the business service caused by the layer to which it belongs in the multi-layer directed graph model;

Construct time series data <m, k, T, E _m×k >, take x _i (t) as independent variable, take E _{m×k -xi} (t) as dependent variable, construct function f[x _i (t )]=E _m×k -xi (t), _{perturb the values x i (} t)～x _i (tk) on all time series of each root cause node, and obtain the fluctuation value y of each root cause node [δ,f[x _i (t)]], the root cause node whose fluctuation value is less than the preset fluctuation value is used as the target root cause node;

Among them, m is the number of business nodes in the multi-layer directed graph model, k is the number of time lags existing in each business node, T is the length of the time series, and E _m×k is the multi-layer directed graph The set of all business nodes in the model on all time delays, δ is a parameter related to the multi-layer directed graph model, the total number of root cause nodes is j, and x _i (t) is the ith business node in The corresponding business data when the time series length is t.

Judging whether the service data is abnormal service data can be judged according to the set threshold range, or whether the service data is abnormal according to the result of the calculation processing after the service data is processed, which is not specifically limited in this embodiment. In the process of root cause search, only the abnormal business data needs to be mapped into the multi-layer directed graph model.

When searching for the root cause node, it is necessary to search according to the layer to which each service node belongs and the calling relationship between each service node. For example, if a group of nodes with a calling relationship has an abnormal point at each layer, the business node at the bottom is usually the root cause node; if a group of business nodes with a calling relationship has no abnormal business node in a certain layer , the root cause search should be performed on the business nodes above and below the layer as two independent parts.

After finding the root cause node, sort the root cause nodes according to the calculated fluctuation value corresponding to each root cause node. The larger root cause nodes are used as target root cause nodes.

This embodiment provides a method for fault root cause diagnosis based on a multi-layer directed graph. The method performs root cause query through a multi-layer directed graph model and analyzes data in multiple dimensions, thereby improving the accuracy of root cause search. The target root cause node is determined from the root cause node, which narrows the range of nodes that need to be considered when repairing the business, and improves the efficiency of the repair business.

Further, on the basis of the foregoing embodiments, before the acquiring the original service data generated at each service node of the preset service, the method further includes:

Perform KEI index evaluation on each service to determine whether the service is in a healthy state, if the service is not in a healthy state, then use the service as the preset service, and obtain the information generated at each service node of the preset service. Raw business data.

KEI (Key Performance Indicator) is used to evaluate whether the business is in a healthy state, and the method provided in this embodiment only performs root cause diagnosis for the business in an unhealthy state.

This embodiment provides a method for diagnosing fault root causes based on a multi-layer directed graph. The method filters out services in an unhealthy state through the KEI index, and performs root cause diagnosis on the services in an unhealthy state, thereby avoiding the need for a healthy state. business conducts unnecessary diagnostics.

Further, based on the above embodiments, after the target root cause node that causes the preset service abnormality is determined from the root cause node, the method further includes:

Determine whether a fault handling plan for repairing the target root cause node is stored, if so, repair the target root cause node according to the fault handling plan, and send the first prompt message that the target root cause node has been repaired, otherwise, Send the node information of the target root cause node and the second prompt information that the target root cause node is not repaired.

After determining the target root cause node, it is necessary to repair the target root cause node to ensure the normal operation of the system. The first prompt information and the second prompt information may be information sent by email or by short message, which is not specifically limited in this embodiment.

This embodiment provides a method for diagnosing the root cause of a fault based on a multi-layer directed graph. The method repairs the fault in a timely manner when the fault can be repaired in time, and sends a prompt message in a timely manner when the fault cannot be repaired. Inform the staff to adopt a repair plan to repair the fault to ensure the normal operation of the business.

As a more specific embodiment, FIG. 2 is a schematic diagram of the architecture of fault root cause diagnosis of a multi-layer directed graph provided in this embodiment, referring to FIG. 2 , which mainly involves a CMDB database, application topology relationship management, and directed graph model conversion device, model library, indicator management device, fault root cause analysis device, fault automatic processing device, etc. Among them, the directed graph converter continues to analyze the existing asset data to generate a fault multi-layer directed graph model (FSDG). The fault root cause diagnosis device uses the FSDG model to evaluate and calculate the real-time KEI index, and finally mine the fault root cause.

In the parts shown in Figure 2, (1) the application production system processes the user's operation in real time. When an exception occurs in the business processing, the application production system must have an abnormal point. The application production system is connected with the application topology management system: when a calling relationship is generated between various application services, the topology management system obtains the calling relationship data.

(2) Application topology relationship management is mainly composed of six devices, including call data collection, data cleaning, rule conversion, call relationship analysis, call behavior analysis, and continuous rule learning. The application topology relationship management analyzes the calling relationship between each node in the system by calling data collection, provides data support for the subsequent directed graph, and submits it to the model converter together with the CMDB data to produce a multi-layer directed graph model.

(3) The attributes of each CI item in the application system are stored in the CMDB database, and various relationships between the CI items have been defined. Through the CMDB data, the FSDG hierarchical model in the multi-layer directed graph can be defined, and the model can be submitted to the model converter to produce the multi-layer directed graph model.

(4) The model converter processes and converts the input data, and converts it into corresponding codes according to the data attributes. By applying topological relational data and CMDB data, the complex calling relation of the system is transformed into a multi-layer directed graph model. The model converter is connected to the model library, and the data is encoded and converted and submitted to the FSDG model library;

From the CMDB data, the node set V = {v _i |v _i is the asset node managed in the CMDB};

By applying the topological relation data, the branch set E={e _{i, j} | the directed edge from node v _i to node v _j };

In the multi-layer directed graph model, all business nodes of the _i -th layer are represented by a set Li ={R ₁ ∩A ₁ , R ₂ ∩A ₂ ,...,R _n ∩A _n }.

(5) The model library contains known system topology models, which are classified according to business and system, and can be divided into CRM, channel, CBOSS model, etc. The topology level and calling relationship of different systems are different. Connected to the fault root cause analysis device: After the model library inputs the information into the fault root cause analysis device, together with the index data of the index management device, the analysis module can analyze the fault root cause.

(6) The indicator management device manages the business, system and other indicator data in the system, including the indicator data of each node in the multi-layer directed graph model, including key indicators such as health. Connect with the fault root cause analysis device: push the indicators to the analysis device, and cooperate with the model in the indicator library to analyze the fault root cause.

(7) The fault root cause analysis device is based on the big data STORM flow computing architecture, and through real-time data calculation, the calculation time of the fault root cause is shortened to the second level; according to the multi-layer directed graph model and node index data, it is judged whether there is an abnormality in the system. If there is an abnormality, according to the multi-layer directed graph algorithm, the root node is calculated, that is, the root cause of the system failure is analyzed. Connect with the automatic fault processing device: when the root cause of the fault is analyzed, the root cause of the fault is sent to the processing device for fault processing.

FIG. 3 is a schematic flowchart of a fault root cause query provided by the present embodiment. Referring to FIG. 3 , the process includes:

The KEI model is used to evaluate the index data at the highest level of the FSDG model. If the evaluation result is in a healthy state, the system does not perform subsequent analysis; if the evaluation result is in an unhealthy state, the FSDG fault root cause analysis process is triggered to calculate the fault source.

The FSDG fault node set is processed by the naive causal mining algorithm, and the fault causal mining object FCS is constructed. FCS is all the time series data generated by each element in the system, which is formally expressed as a quadruple <m, k, T, E _{m× k} >, m is the number of elements in the FSDG, k is the number of time lags in each element, T is the length of the time series, and E _m×k is the set of all elements in the system on all time lags. In the FSDG graph, there may be links composed of multiple service nodes, and the root cause of the fault needs to be diagnosed. C1...Cn represents the FSDG graph corresponding to each link split for the associated links composed of different service nodes.

In the process of wave calculation, target= _xi (t), variables=E _{m×k -xi} (t), take target as the dependent variable, and use variables as the independent variable to perform function fitting based on GEP, and obtain the function fx _i (t); perturb each element in the fx _i (t) independent variable set variable in turn. Since the time delay of the system is k, the values x _i (t) ~ x _j (tk) on all time series of each element x _j are perturbed; based on the perturbation, the fluctuation value of each element δfx _i (t) ( x _i ,δ) and then make a causal judgment according to the magnitude of the fluctuation, and the one with the smaller fluctuation value is the root cause of the fault.

(8) The fault automatic processing device is used to automatically process the root cause of the fault. If there is a corresponding fault processing plan, the device will automatically execute the plan according to the plan, repair the system in time, and notify the relevant responsible person of the system.

Aiming at the shortcomings of the existing solution that is limited to known fault analysis root causes, cannot flexibly respond to newly discovered faults, and cannot provide real-time computing capabilities, the method for fault root cause diagnosis based on multi-layer directed graphs provided in this embodiment is based on Storm flow. The computing technology adopts the method of combining the fault directed graph algorithm FSDG and the naive cause and effect mining algorithm NCM, which provides real-time, efficient and flexible fault root cause analysis capabilities. On the other hand, in view of the shortcoming that the current IT operation and maintenance system modeling method is difficult to provide massive data for training, the method provided in this embodiment proposes a rapid modeling method for generating an FSDG model based on CMDB data and an application topology relationship management module, The improved convenience of model building avoids large model errors caused by insufficient training data.

The method for diagnosing fault root causes based on a multi-layer directed graph provided in this embodiment is not limited to locating known faults, and can automatically perform root cause analysis for new faults according to the model. The ability to analyze fault data is strengthened, and the data backlog caused by information explosion is avoided through real-time data calculation. The automatic fault processing capability has been improved, and automatic processing devices have been introduced to realize the closed-loop management of faults from automatic discovery and location to final processing.

FIG. 4 is a structural block diagram of an apparatus for fault root cause diagnosis based on a multi-layer directed graph provided in this embodiment. Referring to FIG. 4 , the apparatus includes an acquisition module 401, a establishment module 402, and a root cause determination module 403, wherein,

The obtaining module 401 is configured to obtain the original service data generated at each service node of the preset service, and determine the calling relationship of each service node according to the original service data and the pre-stored attribute information of each service node;

The establishment module 402 is used for establishing the multi-layer directed graph model of each service node according to the calling relationship of each service node determined by the original service data and the attribute information and the layer to which each service node belongs to pre-divided;

The root cause determination module 403 is configured to obtain the abnormal service data in the original service data, and determine at least one root cause node that causes the service service to generate the abnormal service data according to the multi-layer directed graph model, starting from the root cause. The target root cause node that causes the preset service abnormality is determined in the cause node.

The apparatus for diagnosing fault root causes based on a multi-layer directed graph provided in this embodiment is applicable to the method for diagnosing fault root causes based on a multi-layer directed graph provided in the foregoing embodiment, and details are not described herein again.

This embodiment provides a fault root cause diagnosis device based on a multi-layer directed graph. The method jointly determines the calling relationship of each service node according to the original service data and attribute information, and can fully consider the newly added service nodes in practice. Or the newly added invocation relationship ensures that each business node can be added to the multi-layer directed graph model when the multi-layer directed graph model is established according to the invocation relationship. The root cause node of abnormal business data lays the foundation. Since the service nodes in the multi-layer directed graph model in this embodiment are generated according to actual service nodes, the comprehensiveness of the nodes avoids the need to perform root cause query for newly-occurring faults. At the same time, the analysis of data not only It is based on the calling relationship, but comprehensively analyzes the data based on the created multi-layer directed graph model.

FIG. 5 is a block diagram showing the structure of the electronic device provided in this embodiment.

5, the electronic device includes: a processor (processor) 501, a memory (memory) 502, a communications interface (Communications Interface) 503 and a bus 504;

in,

The processor 501, the memory 502, and the communication interface 503 communicate with each other through the bus 504;

The communication interface 503 is used for information transmission between the electronic device and the communication devices of other electronic devices;

The processor 501 is configured to invoke the program instructions in the memory 502 to execute the methods provided by the above method embodiments, for example, including: acquiring the original service data generated at each service node of the preset service, according to the The original service data and the pre-stored attribute information of each service node determine the calling relationship of each service node; according to the calling relationship of each service node determined by the original service data and the attribute information and the pre-divided service nodes The affiliated layer establishes a multi-layer directed graph model of each business node; obtains abnormal business data in the original business data, and determines at least one of the abnormal business data that causes the business business to generate the abnormal business data according to the multi-layer directed graph model The root cause node, the target root cause node that causes the preset service exception is determined from the root cause nodes.

This embodiment provides a non-transitory computer-readable storage medium, where the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the methods provided by the foregoing method embodiments, for example, including : Obtain the original service data generated at each service node of the preset service, and determine the calling relationship of each service node according to the original service data and the pre-stored attribute information of each service node; The calling relationship of each service node determined by the attribute information and the multi-layer directed graph model of each service node is established with the pre-divided layer to which each service node belongs; the abnormal service data in the original service data is obtained, according to the multi-layer The directed graph model determines at least one root cause node that causes the service service to generate the abnormal service data, and determines a target root cause node that causes the preset service exception from the root cause nodes.

This embodiment discloses a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer, the computer program The methods provided by the above method embodiments can be implemented, for example, including: acquiring original service data generated at each service node of a preset service, and determining each service node according to the original service data and pre-stored attribute information of each service node. The calling relationship of business nodes; according to the calling relationship of each business node determined by the original business data and the attribute information and the layer to which each business node belongs to pre-divided, a multi-layer directed graph model of each business node is established; the abnormal service data in the original service data, determine at least one root cause node that causes the service service to generate the abnormal service data according to the multi-layer directed graph model, and determine from the root cause nodes that cause the preset service The target root cause node for the exception.

Those of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by program instructions related to hardware, the aforementioned program can be stored in a computer-readable storage medium, and when the program is executed, execute It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes.

The above-described electronic equipment and other embodiments are only illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, It can be located in one place, or it can be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.

From the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware. Based on this understanding, the above-mentioned technical solutions can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, but not to limit them; although the embodiments of the present invention have been described in detail with reference to the foregoing embodiments, ordinary The skilled person should understand that it is still possible to modify the technical solutions described in the foregoing embodiments, or to perform equivalent replacements on some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the present invention. The scope of the technical solutions of the embodiments of each embodiment.

Claims (8)

1. A method for diagnosing fault root causes based on a multilayer directed graph is characterized by comprising the following steps:

acquiring original service data generated at each service node of a preset service and attribute information of each service node stored in a CMDB database, and obtaining an original calling relationship between each service node according to the attribute information of each service node;

analyzing the actual calling relationship of each service node according to the original service data, and adjusting the original calling relationship according to the actual calling relationship to obtain the calling relationship of each service node determined by the original service data and the attribute information;

Establishing a multilayer directed graph model of each service node according to the calling relationship of each service node determined by the original service data and the attribute information and the layers of the service nodes divided in advance;

and acquiring abnormal service data in the original service data, determining at least one root cause node which causes the preset service to generate the abnormal service data according to the multilayer directed graph model, and determining a target root cause node which causes the preset service to be abnormal from the root cause nodes.

2. The method according to claim 1, wherein the building of the multi-layer directed graph model of each service node according to the calling relationship of each service node determined by the original service data and the attribute information and the pre-partitioned layers to which each service node belongs includes:

correcting the service nodes stored in the CMDB database according to the calling relationship of each service node determined by the original service data and the attribute information;

obtaining the service node of the ith layer in the CMDB database after the correction divided in advance, and for the service node v of the ith layer in the CMDB database_nAcquiring the service node v according to the calling relationship of each service node determined by the original service data and the attribute information _nReaches and can reach the service node v_nThe target service node of (2);

and adding a target service node corresponding to each service node of the ith layer in the CMDB database into the node set of the ith layer, wherein the points in the node set of the ith layer are the nodes of the ith layer in the multilayer directed graph model.

3. The method according to claim 2, wherein the obtaining abnormal service data in the original service data, determining at least one root cause node causing the preset service to generate the abnormal service data according to the multilayer directed graph model, and determining a target root cause node causing the preset service to be abnormal from the root cause nodes comprises:

judging whether the original service data generated at each service node is abnormal according to a preset threshold interval, and acquiring all abnormal service data in the original service data;

mapping each abnormal service data to a service node which generates the abnormal service data in the multilayer directed graph model, and searching at least one root cause node which causes the preset service abnormality according to the calling relation of each service node in the multilayer directed graph model and the layer of the multilayer directed graph model to which each service node belongs;

Constructing time series data<m，k，T，E_m×k>In x of_i(t) is an independent variable, with E_m×k-x_i(t) is the amount of strain, the constructor f [ x ]_i(t)]＝E_m×k-x_i(t) for each factor node, the value x over all time series_i(t)～x_i(t-k) disturbing to obtain fluctuation values y [ delta, f [ x ] of each cause node_i(t)]]Taking the root cause node with the fluctuation value smaller than a preset fluctuation value as the target root cause node;

wherein m is the number of service nodes in the multilayer directed graph model, k is the number of time lags existing in each service node, T is the length of the time sequence, E_m×kThe set of all service nodes in the multilayer directed graph model on all time lags is represented by delta which is a parameter related to the multilayer directed graph model, the total number of root nodes is j, x_iAnd (t) is the service data corresponding to the ith service node when the time sequence length is t.

4. The method according to claim 1, wherein before the obtaining the original service data generated at each service node of the preset service, further comprising:

and performing KEI index evaluation on each service, judging whether the service is in a healthy state, if not, taking the service as the preset service, and acquiring original service data generated at each service node of the preset service.

5. The method according to claim 1, wherein after determining a target root cause node causing the preset traffic anomaly from the root cause nodes, the method further comprises:

and judging whether a fault processing plan for repairing the target root cause node is stored, if so, repairing the target root cause node according to the fault processing plan, and sending first prompt information for repairing the target root cause node, otherwise, sending node information of the target root cause node and second prompt information for not repairing the target root cause node.

6. An apparatus for fault root cause diagnosis based on a multilayer directed graph, comprising:

the acquisition module is used for acquiring original service data generated at each service node of a preset service and attribute information of each service node stored in the CMDB database, and acquiring an original calling relationship between each service node according to the attribute information of each service node; analyzing the actual calling relationship of each service node according to the original service data, and adjusting the original calling relationship according to the actual calling relationship to obtain the calling relationship of each service node determined by the original service data and the attribute information;

The establishing module is used for establishing a multilayer directed graph model of each service node according to the calling relationship of each service node determined by the original service data and the attribute information and the layers to which each service node is divided in advance;

and the root cause determining module is used for acquiring abnormal service data in the original service data, determining at least one root cause node which causes the preset service to generate the abnormal service data according to the multilayer directed graph model, and determining a target root cause node which causes the preset service to be abnormal from the root cause nodes.

7. An electronic device, comprising:

at least one processor, at least one memory, a communication interface, and a bus; wherein,

the processor, the memory and the communication interface complete mutual communication through the bus;

the communication interface is used for information transmission between the electronic equipment and communication equipment of other electronic equipment;

the memory stores program instructions executable by the processor, the processor invoking the program instructions to perform the method of any of claims 1-5.

8. A non-transitory computer-readable storage medium storing computer instructions that cause a computer to perform the method of any one of claims 1 to 5.

Images