CN110493025A - Method and device for fault root cause diagnosis based on multi-layer directed graph - Google Patents

Abstract

Embodiment of the invention discloses a kind of based on the failure root of multilayer digraph because of the method and device of diagnosis, this method determines the call relation of each service node according to original service data and attribute information jointly, it can be comprehensively in view of the service node newly increased in practice or the call relation newly increased, ensure that can be added to each service node in multilayer Directed Graph Model when establishing multilayer Directed Graph Model according to call relation, accurately quickly to search the root for generating abnormal traffic data based on multilayer Directed Graph Model because node is laid a good foundation.It is generated by the service node in multilayer Directed Graph Model in this present embodiment according to practical business node, the comprehensive of node avoids method to emerging failure progress root because of the case where inquiring, simultaneously, analysis to data is not only to be based on call relation, but the multilayer Directed Graph Model based on creation analyzes data comprehensively.

Description

Method and device for fault root cause diagnosis based on multi-layer directed graph

technical field

Embodiments of the present invention relate to the technical field of computer software, in particular to a method and device for root cause diagnosis of faults based on multi-layer directed graphs.

Background technique

With the popularity of cloud computing and container cloud, a large number of IT application systems are gradually deployed in virtualized and containerized environments. With the continuous enrichment of various business scenarios and the blowout growth of business volume, it brings huge challenges to the maintainability of the system and applications. Especially in the telecommunications industry, operators themselves have built a lot of application systems to provide consumers with various special services, and some system functions involve sub-functions of multiple business systems, requiring multi-system collaboration to work properly. The evolution of architecture has intensified the complexity of such business systems, and put forward higher requirements for operation and maintenance fault location and resolution capabilities.

The current fault diagnosis methods include three types. The first is the fault diagnosis based on the emergency plan library such as alarm, the second is the fault diagnosis based on the alarm and other plan library, and the third is the fault diagnosis and repair method based on the decision tree model. Among them, fault diagnosis based on alarms and other contingency plans: most operation and maintenance departments usually compile fault handling manuals based on fault phenomena and processing records, and some equipment suppliers will also provide similar simple fault location capabilities to achieve preliminary fault diagnosis. positioning and resolution. In addition to historical fault experience, it also includes other dimensions such as QoE (Quality of Experience) for fault diagnosis. Once a fault occurs, the diagnostic result is generated by collecting the key information of the alarm and finding the corresponding diagnostic manual for retrieval. Therefore, the alarm-based method can easily and quickly complete daily fault location and repair, but once faced with unknown faults that do not match the known alarm information, there is nothing to do. Fault diagnosis method based on offline indicator analysis tools: Offline indicator analysis tools include business indicators and system operation indicators. The former mainly reflects business volume indicators through business storage data, and the latter mainly imports external data such as logs into the database for analysis. System operation index analysis, system performance, success rate, failure distribution and other information are analyzed to judge the health of the system operation. The database-based method is convenient for extracting key system indicators and effectively monitoring the running status of each link of the program, but relatively speaking, the time extension is relatively large, which will have a certain impact on the timeliness of system monitoring. Fault diagnosis and repair method based on decision tree model: most system designs adopt multi-layer system topology architecture, based on the principle of layered call, establish a tree-shaped topology map, and based on this tree-shaped topology, establish a business-oriented and system fault-oriented decision tree. Once a fault occurs, the diagnostic results are generated by collecting key fault information and finding the corresponding decision tree for retrieval. Therefore, the method based on the decision tree can easily and quickly complete the daily fault location and repair, but once faced with the non-tree structure call relationship, it is powerless.

However, in virtualized and containerized environments based on big data platforms, DCOS platforms, module systems, and microservice systems, existing solutions are not enough to support rapid response and efficient analysis and resolution of cluster node failures or abnormalities. The ability requirements are mainly manifested in the following aspects: (1) The usage scenarios are narrow and cannot handle unknown scenarios. For example, the fault diagnosis and repair method based on the alarm and contingency plan library in Scheme 1 mainly relies on the experience accumulation of known fault information, and this method has great requirements for fault scenarios. The same fault phenomenon may have different processing methods in different fault scenarios, which is beyond the processing range of the simple plan library. Especially in the face of unknown fault information, existing manuals and other means have completely failed, requiring manual step-by-step troubleshooting, locating faults, and repairing problems, resulting in low O&M efficiency. (2) The timeliness of the indicators is poor, and the information cannot be fed back in time. The improvement of fault location capabilities in existing solutions is limited to strengthening the collection of fault information, and the final location and repair of faults still depend on the judgment and execution of operation and maintenance personnel. Through the massive monitoring index data, the source of fault information has been greatly expanded, but the collection delay of the index is also high, resulting in insufficient automatic processing and analysis capabilities of these data, and the information points and root causes of the problem cannot be displayed in a timely manner. (3) Massive historical data is required, which is not suitable for agile mode. Existing solutions mainly use training decision trees to improve analysis capabilities, but training decision trees requires a large amount of historical data. Due to the business characteristics of our system, new problems account for a large proportion, and sufficient effective training data cannot be provided, resulting in the decision tree model The accuracy is not high, and the ability to analyze the root cause of the fault is insufficient to provide effective support.

In the process of implementing the embodiments of the present invention, the inventors found that the existing methods for finding the root cause of faults have poor environmental adaptability, and cannot perform root cause inquiries on new faults, and the existing methods for finding the root cause of faults only According to the call relationship search of business nodes, the analysis of data is relatively simple, and the data analysis ability is weak.

Contents of the invention

The technical problem to be solved by the present invention is how to solve the problem that the existing method for finding the root cause of a fault has poor environmental adaptability and cannot perform root cause query on a new fault, and the existing method for finding the root cause of a fault is only based on the service node Invoking relationship search, data analysis is relatively simple, and data analysis ability is weak.

In view of the above technical problems, embodiments of the present invention provide a method for root cause diagnosis of faults based on multi-layer directed graphs, including:

Obtain the original service data generated at each service node of the preset service, and determine the calling relationship of each service node according to the original service data and the pre-stored attribute information of each service node;

Establishing a multi-layer directed graph model of each service node according to the calling relationship of each service node determined by the original service data and the attribute information and the pre-divided layers of each service node;

Acquiring abnormal business data in the original business data, determining at least one root cause node that causes the business business to generate the abnormal business data according to the multi-layer directed graph model, and determining from the root cause nodes that cause the Set the target root cause node of the business exception.

Embodiments of the present invention provide a device for root cause diagnosis of faults based on a multi-layer directed graph, including:

An acquisition module, configured to acquire original service data generated at each service node of a preset service, and determine the calling relationship of each service node according to the original service data and pre-stored attribute information of each service node;

Establishing a module for establishing a multi-layer directed graph model of each service node according to the calling relationship of each service node determined by the original service data and the attribute information and the pre-divided layer to which each service node belongs;

A root cause determination module, configured to obtain abnormal business data in the original business data, determine at least one root cause node that causes the business business to generate the abnormal business data according to the multi-layer directed graph model, and determine from the root cause The node determines the target root cause node that causes the preset service exception.

This embodiment provides an electronic device, including:

at least one processor, at least one memory, a communication interface, and a bus; wherein,

The processor, the memory, and the communication interface complete mutual communication through the bus;

The communication interface is used for information transmission between the electronic device and the communication device of the terminal device;

The memory stores program instructions that can be executed by the processor, and the processor can execute the above-mentioned method by calling the program instructions.

This embodiment provides a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer, The computer is made to execute the method described above.

Embodiments of the present invention provide a method and device for root cause diagnosis of faults based on a multi-layer directed graph. The method jointly determines the call relationship of each service node according to the original service data and attribute information, and can fully take into account the actual new The added business nodes or newly added call relationships ensure that each business node can be added to the multi-layer directed graph model when building a multi-layer directed graph model based on the call relationship, which is based on the multi-layer directed graph model. Accurately and quickly find the root cause nodes that generate abnormal business data to lay the foundation. Since the service nodes in the multi-layer directed graph model in this embodiment are generated according to the actual service nodes, the comprehensiveness of the nodes avoids the situation that it is impossible to query the root causes of new faults. At the same time, the analysis of data is not only It is based on the call relationship, but based on the created multi-layer directed graph model to conduct a comprehensive analysis of the data.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

Fig. 1 is a schematic flow diagram of a method for root cause diagnosis of a fault based on a multilayer directed graph provided by an embodiment of the present invention;

Fig. 2 is a schematic diagram of the architecture of the fault root cause diagnosis of a multi-layer directed graph provided by another embodiment of the present invention;

Fig. 3 is a schematic flow chart of performing fault root cause query provided by another embodiment of the present invention;

Fig. 4 is the structural block diagram of the device of the fault root cause diagnosis based on multi-layer directed graph provided by another embodiment of the present invention;

Fig. 5 is a structural block diagram of an electronic device provided by another embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Fig. 1 is a schematic flow chart of the method for diagnosing the root cause of a fault based on a multi-layer directed graph provided in this embodiment, referring to Fig. 1, the method includes:

101: Obtain the original service data generated at each service node of the preset service, and determine the calling relationship of each service node according to the original service data and the pre-stored attribute information of each service node;

102: Establish a multi-layer directed graph model of each service node according to the calling relationship of each service node determined by the original service data and the attribute information and the pre-divided layer to which each service node belongs;

103: Obtain abnormal business data in the original business data, determine at least one root cause node that causes the business business to generate the abnormal business data according to the multi-layer directed graph model, and determine from the root cause nodes that cause the abnormal business data The target root cause node of the preset business exception.

The method provided in this embodiment is usually performed by a device that diagnoses and repairs whether a service is running normally, for example, a server, and this embodiment does not specifically limit it. This method is used to query the root cause of a certain faulty service. The service nodes are the nodes in the running process of the preset service, and the data collected at each service node is the original service data of the service. The attribute information is the attribute information of each service node defined in advance, and the attribute information reflects the calling relationship of each service node. Each service node can also be layered according to attribute information, for example, a node at the application layer, a node at the transport layer, and the like. When creating the multi-layer directed graph model of each business node, it is necessary to refer to the pre-divided layers of each business node. When searching for the root cause node that causes preset business exceptions through a multi-layer directed graph, search layer by layer according to the calling relationship of each business node. The target root cause node is usually obtained through calculation, and the specific calculation method can be set, which is not specifically limited in this embodiment.

This embodiment provides a method for diagnosing the root cause of a fault based on a multi-layer directed graph. The method jointly determines the calling relationship of each service node according to the original service data and attribute information, and can fully consider the newly added service nodes in practice. Or the newly added call relationship ensures that each business node can be added to the multi-layer directed graph model when the multi-layer directed graph model is established according to the call relationship, which is based on the multi-layer directed graph model. The root cause node of abnormal business data lays the foundation. Since the service nodes in the multi-layer directed graph model in this embodiment are generated according to the actual service nodes, the comprehensiveness of the nodes avoids the situation that it is impossible to query the root causes of new faults. At the same time, the analysis of data is not only It is based on the call relationship, but based on the created multi-layer directed graph model to conduct a comprehensive analysis of the data.

Further, on the basis of the above-mentioned embodiments, the acquisition of the original service data generated at each service node of the preset service, and the determination of each service node’s Call relationship, including:

Obtain the original service data generated at each service node of the preset service and the attribute information of each service node stored in the CMDB database, and obtain the original calling relationship between each service node according to the attribute information of each service node;

Analyzing the actual call relationship of each service node according to the original service data, adjusting the original call relationship according to the actual call relationship, and obtaining the call relationship of each service node determined by the original service data and the attribute information.

The CMDB database is a database that stores and manages various configuration information of devices in the enterprise IT architecture. For each service node of the preset service, firstly, according to the attribute information defined in the CMDB database, the calling relationship of each service node is obtained. However, since the business node of the preset business may be added in practice, and the newly added business node may not exist in the CMDB database, after determining the original call relationship, it is necessary to add the newly added node and other business nodes according to the original business data. The invocation relationship of the nodes is supplemented, and finally the actual invocation relationship of each service node determined by the original service data and the attribute information is obtained.

This embodiment provides a method for diagnosing the root cause of a fault based on a multi-layer directed graph. The method adjusts the original calling relationship obtained from the CMDB database to ensure that the final calling relationship includes all The call relationship provides a guarantee for the root cause query of new faults.

Further, on the basis of the above-mentioned embodiments, the establishment of multiple service nodes of each service node according to the calling relationship of each service node determined by the original service data and the attribute information and the pre-divided layer to which each service node belongs Layer directed graph model, including:

Correcting the service nodes stored in the CMDB database according to the calling relationship of each service node determined by the original service data and the attribute information;

Obtain the service nodes of the i-th layer in the pre-divided and corrected CMDB database, and for the service node v _n of the i-th layer in the CMDB database, according to the calling relationship of each service node determined by the original service data and the attribute information Obtain the target service node that is reached by the service node v _n and can reach the service node v _n ;

Add the target service node corresponding to each service node of the i-th layer in the CMDB database to the i-th layer node set, then the point in the i-th layer node set is the i-th layer in the multi-layer directed graph model of nodes.

For example, if a new business node is added during the actual operation of the business, the business node needs to be added to the CMDB database, and the CMDB database should be updated in time. Each service node is pre-divided into layers in the CMDB database according to the attributes of each service node. For example, the service nodes belonging to the application layer are divided into the same layer, and the service nodes belonging to the transport layer are divided into the same layer.

In a multi-layer directed graph model, the i-th layer node set can be represented by the formula L _i ={R ₁ ∩A ₁ , R ₂ ∩A ₂ , . . . , R _n ∩A _n }. Among them, R _n represents the set of all nodes reachable from v _n , and A _n represents the set of all nodes that can reach v _n . There are n business nodes in the i-th layer in the CMDB database, namely v ₁ , v ₂ , ... v _n .

This embodiment provides a method for diagnosing the root cause of a fault based on a multi-layer directed graph. The method obtains the service nodes of each layer in the multi-layer directed graph model according to the layer to which each service node belongs in the CMDB database.

Further, on the basis of the above-mentioned embodiments, the acquisition of abnormal business data in the original business data determines at least one of the abnormal business data that causes the business business to generate the abnormal business data according to the multi-layer directed graph model. The root cause node is to determine the target root cause node that causes the preset service exception from the root cause nodes, including:

Judging whether the original business data generated at each business node is abnormal according to the preset threshold interval, and obtaining all abnormal abnormal business data in the original business data;

Each abnormal business data is mapped to the business node that generates the abnormal business data in the multi-layer directed graph model, and according to the calling relationship of each business node in the multi-layer directed graph model and each business node in the described multi-layer directed graph model In the multi-layer directed graph model, at least one root cause node that leads to the business operation is searched by the layer belonging to it;

Construct time series data <m, k, T, E _m×k >, take x _i (t) as independent variable, take E _{m×k -xi} (t) as dependent variable, construct function f[ _xi (t )]=E _m×k -xi (t), _{perturb the value x i (} t)～ _xi (tk) of each root node in all time series, and get the fluctuation value y of each root node [δ, f[ _xi (t)]], using the root cause node whose fluctuation value is less than the preset fluctuation value as the target root cause node;

Wherein, m is the number of business nodes in the multi-layer directed graph model, k is the number of time lags that each business node exists, T is the length of the time series, and E _{m × k} is the multi-layer directed graph The set of all business nodes in the model on all time lags, δ is a parameter related to the multi-layer directed graph model, the total number of root cause nodes is j, x _i (t) is the ith business node in The corresponding business data when the time series length is t.

Whether the business data is abnormal can be judged according to the set threshold range, or whether the business data is abnormal can be judged according to the result of the calculation after the business data is processed, which is not specifically limited in this embodiment. In the process of finding the root cause, it is only necessary to map abnormal business data into a multi-layer directed graph model.

When finding the root cause node, it is necessary to search according to the layer to which each service node belongs and the calling relationship between each service node. For example, if a group of nodes with a call relationship has an abnormal point at each layer, the business node at the bottom is usually the root cause node; if a group of business nodes with a call relationship does not have an abnormal business node at a certain layer , the service nodes above the layer and below the layer should be regarded as two independent parts for root cause investigation.

After finding the root cause node, sort the root cause nodes according to the calculated fluctuation value corresponding to each root cause node. Several large root cause nodes are used as target root cause nodes.

This embodiment provides a method for diagnosing the root cause of a fault based on a multi-layer directed graph. The method performs root cause query through a multi-layer directed graph model, analyzes data in multiple dimensions, and improves the accuracy of root cause search. Determining the target root cause node from the root cause nodes reduces the range of nodes to be considered when repairing the service, and improves the efficiency of repairing the service.

Further, on the basis of the above-mentioned embodiments, before acquiring the original service data generated at each service node of the preset service, it also includes:

Carry out KEI index evaluation for each business to determine whether the business is in a healthy state, if the business is not in a healthy state, then use this business as the preset business, and obtain the Raw business data.

KEI (Key Performance Indicator) is used to evaluate whether the business is in a healthy state, and the method provided in this embodiment only performs root cause diagnosis on the business in an unhealthy state.

This embodiment provides a method for diagnosing the root cause of a fault based on a multi-layer directed graph. The method screens out services in an unhealthy state through the KEI index, and diagnoses the root cause of the services in an unhealthy state, avoiding the need for faults in a healthy state. Unnecessary diagnosis of the business.

Further, on the basis of the above embodiments, after determining the target root cause node that causes the preset service exception from the root cause nodes, it further includes:

Judging whether there is a fault handling plan for repairing the target root cause node, if yes, repairing the target root cause node according to the fault handling plan, and sending the first prompt message that the target root cause node has been repaired, otherwise, Sending the node information of the target root cause node and the second prompt information that the target root cause node has not been repaired.

After determining the target root cause node, it is necessary to repair the target root cause node to ensure the normal operation of the system. The first prompt information and the second prompt information may be information sent by email or short message, which is not specifically limited in this embodiment.

This embodiment provides a method for diagnosing the root cause of a fault based on a multi-layer directed graph. The method repairs the fault in time if the fault can be repaired in time, and sends a prompt message in time if the fault cannot be repaired. Inform the staff to take a repair plan to repair the fault to ensure the normal operation of the business.

As a more specific embodiment, Figure 2 is a schematic diagram of the root cause diagnosis of multi-layer directed graph faults provided by this embodiment, see Figure 2, which mainly involves CMDB database, application topology relationship management, and directed graph model conversion device, model library, indicator management device, fault root analysis device, fault automatic processing device, etc. Among them, the directed graph converter continues to analyze the existing asset data to generate a fault multi-layer directed graph model (FSDG), and the fault root cause diagnosis device uses the FSDG model to evaluate and calculate real-time KEI indicators, and finally dig out the root cause of the fault.

Among the parts shown in Figure 2, (1) the application production system processes the user's operations in real time, and when an exception occurs in business processing, there must be an abnormal point in the application production system. The application production system is connected with the application topology management system: when a call relationship is generated between application services, the topology management system obtains the call relationship data.

(2) Application topology relationship management mainly consists of six devices, including call data collection, data cleaning, rule conversion, call relationship analysis, call behavior analysis, and continuous learning of rules. The application topology relationship management analyzes the calling relationship between nodes in the system by calling data collection, provides data support for the subsequent directed graph, and submits it together with CMDB data to the model converter to produce a multi-layer directed graph model.

(3) The attribute of each CI item in the application system is saved in the CMDB database, and various relationships between CI items have been defined. Through the CMDB data, the FSDG hierarchical model in the multi-layer directed graph can be defined, and the model can be submitted to the model converter to produce the multi-layer directed graph model.

(4) The model converter processes and converts the input data, and converts it into corresponding codes according to the data attributes. By applying topological relationship data and CMDB data, the complex call relationship of the system is converted into a multi-layer directed graph model. The model converter is connected to the model library, and the data is encoded and converted and then submitted to the FSDG model library;

From the CMDB data, the node set V={v _i |v _i is the asset node managed in the CMDB};

By applying the topological relationship data, the branch set E={e _i,j |directed edge from node v _i pointing to node v _j };

In the multi-layer directed graph model, all service nodes in the i-th layer are represented by the set L _i ={R ₁ ∩A ₁ , R ₂ ∩A ₂ ,...,R _n ∩A _n }.

(5) The model library contains known system topology models, which can be classified according to business and system, and can be divided into CRM, channel, CBOSS models, etc. The topology levels and calling relationships of different systems are different. Connected with the fault root analysis device: After the model library inputs the information into the fault root analysis device, it will be used together with the index data of the index management device for the analysis module to analyze the fault root.

(6) The index management device manages index data such as business and system in the system, including index data of each node in the multi-layer directed graph model, including key indexes such as health. Connect with the fault root analysis device: push the indicators to the analysis device, and cooperate with the model in the index library to analyze the root cause of the fault.

(7) The fault root analysis device is based on the big data STORM flow computing architecture, and through real-time data calculation, the time-consuming calculation of the fault root is shortened to the second level; according to the multi-layer directed graph model and node index data, it is judged whether there is an abnormality in the system, if If there is an exception, according to the multi-layer directed graph algorithm, the root node is calculated, that is, the root cause of the system failure is analyzed. Connect with the fault automatic processing device: When the root cause of the fault is analyzed, the root cause of the fault is sent to the processing device for troubleshooting.

Fig. 3 is a schematic flow chart of performing fault root cause query provided by this embodiment, referring to Fig. 3, the process includes:

Use the KEI model to evaluate the index data at the top level of the FSDG model. If the evaluation result is in a healthy state, the system will not perform subsequent analysis; if the evaluation result is in an unhealthy state, it will trigger the FSDG fault root cause analysis process and calculate the fault source.

The FSDG fault node set is processed by the naive causal mining algorithm, and the fault causal mining object FCS is constructed. FCS is all time series data generated by each element in the system, and is formally expressed as a quadruple <m, k, T, E _{m× k} >, m is the number of elements in FSDG, k is the number of time lags for each element, T represents the length of the time series, and E _m×k represents the set of all elements in the system on all time lags. The FSDG diagram may have multiple links composed of service nodes that need to be diagnosed for the root cause of the fault. C1...Cn represents the FSDG diagram corresponding to each link split for the associated links composed of different service nodes.

In the calculation process of wave words, target= _xi (t), variables=E _{m×k -xi} (t), with target as dependent variable and variables as independent variable, GEP-based function fitting is performed to obtain the function fx _i (t); perturb each element in the independent variable set variable of fx _i (t) in turn. Since the time lag of the system is k, the values x _i (t)~x _j (tk) in all time series of each element x _j are disturbed; based on the disturbance, the fluctuation value of each element δfx _i (t)( x _i , δ) and then make a causal judgment according to the magnitude of the fluctuation, and the smaller fluctuation value is the root cause of the fault.

(8) The fault automatic processing device is used to automatically process the root cause of the fault. If there is a corresponding fault processing plan, the device will automatically execute according to the plan, repair the system in time, and notify the relevant person in charge of the system.

In view of the shortcomings of existing solutions that are limited to known fault analysis root causes, unable to flexibly deal with newly discovered faults, and unable to provide real-time computing capabilities, the method of fault root cause diagnosis based on multi-layer directed graphs provided in this embodiment is based on Storm flow Computing technology, using the method of combining fault directed graph algorithm FSDG and naive causality mining algorithm NCM, provides real-time, efficient and flexible fault root analysis capabilities. On the other hand, in view of the shortcomings of the current IT operation and maintenance system modeling method that it is difficult to provide massive data for training, the method provided in this embodiment proposes a fast modeling method based on CMDB data and the application topology relationship management module to generate the FSDG model, Improve the convenience of model establishment to avoid large model errors caused by insufficient training data.

The method for diagnosing the root cause of a fault based on a multi-layer directed graph provided in this embodiment is not limited to locating known faults, and can automatically perform root cause analysis for new faults according to the model. The ability to analyze fault data has been strengthened, and through real-time calculation of data, the impact of data backlog caused by information explosion has been avoided. The ability to automatically handle faults has been improved, and automatic processing devices have been introduced to realize closed-loop management of faults from automatic discovery, location to final processing.

Fig. 4 is a structural block diagram of a device for root cause diagnosis of a fault based on a multi-layer directed graph provided in this embodiment. Referring to Fig. 4, the device includes an acquisition module 401, an establishment module 402 and a root cause determination module 403, wherein,

The obtaining module 401 is used to obtain the original service data generated at each service node of the preset service, and determine the calling relationship of each service node according to the original service data and the pre-stored attribute information of each service node;

A building module 402, configured to establish a multi-layer directed graph model of each service node according to the calling relationship of each service node determined by the original service data and the attribute information and the pre-divided layer to which each service node belongs;

The root cause determination module 403 is configured to obtain abnormal business data in the original business data, determine at least one root cause node that causes the business business to generate the abnormal business data according to the multi-layer directed graph model, and start from the root The target root cause node that causes the preset service exception is determined in the cause node.

The device for diagnosing the root cause of a fault based on a multi-layer directed graph provided in this embodiment is applicable to the method for diagnosing a root cause of a fault based on a multi-layer directed graph provided in the above embodiment, and details are not repeated here.

This embodiment provides a device for diagnosing the root cause of a fault based on a multi-layer directed graph. The method jointly determines the calling relationship of each service node according to the original service data and attribute information, and can fully consider the newly added service nodes in practice. Or the newly added call relationship ensures that each business node can be added to the multi-layer directed graph model when the multi-layer directed graph model is established according to the call relationship, which is based on the multi-layer directed graph model. The root cause node of abnormal business data lays the foundation. Since the service nodes in the multi-layer directed graph model in this embodiment are generated according to the actual service nodes, the comprehensiveness of the nodes avoids the situation that it is impossible to query the root causes of new faults. At the same time, the analysis of data is not only It is based on the call relationship, but based on the created multi-layer directed graph model to conduct a comprehensive analysis of the data.

Fig. 5 is a block diagram showing the structure of the electronic device provided by this embodiment.

Referring to FIG. 5, the electronic device includes: a processor (processor) 501, a memory (memory) 502, a communication interface (Communications Interface) 503 and a bus 504;

in,

The processor 501, the memory 502, and the communication interface 503 complete mutual communication through the bus 504;

The communication interface 503 is used for information transmission between the electronic device and communication devices of other electronic devices;

The processor 501 is used to call the program instructions in the memory 502 to execute the methods provided by the above method embodiments, for example, including: obtaining the original service data generated at each service node of the preset service, according to the The original service data and the attribute information of each service node stored in advance determine the call relationship of each service node; according to the call relationship of each service node determined by the original service data and the attribute information and the pre-divided service nodes The affiliated layer establishes a multi-layer directed graph model of each business node; obtains abnormal business data in the original business data, and determines at least one of the abnormal business data that causes the business business to generate the abnormal business data according to the multi-layer directed graph model The root cause node is to determine the target root cause node that causes the preset service exception from the root cause nodes.

This embodiment provides a non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the methods provided in the above method embodiments, for example, including : Obtain the original service data generated at each service node of the preset service, determine the calling relationship of each service node according to the original service data and the pre-stored attribute information of each service node; The invocation relationship of each business node determined by the attribute information and the multi-layer directed graph model of each business node are established with the pre-divided layers of each business node; the abnormal business data in the original business data is obtained, and according to the multi-layer The directed graph model determines at least one root cause node that causes the business service to generate the abnormal service data, and determines the target root cause node that causes the preset service exception from the root cause nodes.

This embodiment discloses a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by the computer, the computer The methods provided by the above method embodiments can be executed, for example, including: obtaining the original service data generated at each service node of the preset service, and determining each The invocation relationship of service nodes; according to the invocation relationship of each service node determined by the original service data and the attribute information and the pre-divided layer of each service node, a multi-layer directed graph model of each service node is established; obtain all Abnormal business data in the original business data, determine at least one root cause node that causes the business business to generate the abnormal business data according to the multi-layer directed graph model, determine from the root cause node that causes the preset business The target root cause node for the exception.

Those of ordinary skill in the art can understand that all or part of the steps for realizing the above-mentioned method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

The above-described embodiments such as electronic equipment are only illustrative, and the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, It can be located in one place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without any creative efforts.

Through the above description of the implementations, those skilled in the art can clearly understand that each implementation can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic discs, optical discs, etc., including several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) execute the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, not to limit them; although the embodiments of the present invention have been described in detail with reference to the foregoing embodiments, those skilled in the art The skilled person should understand that: it is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the present invention The scope of the technical solution of each embodiment of the embodiment.

Claims (9)

1. A method for fault root cause diagnosis based on multilayer directed graph, characterized in that, comprising: Obtain the original service data generated at each service node of the preset service, and determine the calling relationship of each service node according to the original service data and the pre-stored attribute information of each service node; Establishing a multi-layer directed graph model of each service node according to the calling relationship of each service node determined by the original service data and the attribute information and the pre-divided layers of each service node; Acquiring abnormal business data in the original business data, determining at least one root cause node that causes the business business to generate the abnormal business data according to the multi-layer directed graph model, and determining from the root cause nodes that cause the Set the target root cause node of the business exception. 2. The method according to claim 1, characterized in that the acquisition of the original service data generated at each service node of the preset service is determined according to the original service data and the pre-stored attribute information of each service node The calling relationship of each business node, including: Obtain the original service data generated at each service node of the preset service and the attribute information of each service node stored in the CMDB database, and obtain the original calling relationship between each service node according to the attribute information of each service node; Analyzing the actual call relationship of each service node according to the original service data, adjusting the original call relationship according to the actual call relationship, and obtaining the call relationship of each service node determined by the original service data and the attribute information. 3. The method according to claim 2, characterized in that, establishing each service according to the call relationship of each service node determined by the original service data and the attribute information and the pre-divided layer to which each service node belongs A multi-layer directed graph model of nodes, including: Correcting the service nodes stored in the CMDB database according to the calling relationship of each service node determined by the original service data and the attribute information; Obtain the service nodes of the i-th layer in the pre-divided and corrected CMDB database, and for the service node v _n of the i-th layer in the CMDB database, according to the calling relationship of each service node determined by the original service data and the attribute information Obtain the target service node that is reached by the service node v _n and can reach the service node v _n ; Add the target service node corresponding to each service node of the i-th layer in the CMDB database to the i-th layer node set, then the point in the i-th layer node set is the i-th layer in the multi-layer directed graph model of nodes. 4. The method according to claim 3, wherein the acquisition of the abnormal business data in the original business data determines that the business business generates the abnormal business data according to the multi-layer directed graph model at least one root cause node, and determine the target root cause node that causes the preset business exception from the root cause nodes, including: Judging whether the original business data generated at each business node is abnormal according to the preset threshold interval, and obtaining all abnormal abnormal business data in the original business data; Each abnormal business data is mapped to the business node that generates the abnormal business data in the multi-layer directed graph model, and according to the calling relationship of each business node in the multi-layer directed graph model and each business node in the described multi-layer directed graph model In the multi-layer directed graph model, at least one root cause node that leads to the business operation is searched by the layer belonging to it; Construct time series data <m, k, T, E _m×k >, take x _i (t) as independent variable, take E _{m×k -xi} (t) as dependent variable, construct function f[ _xi (t )]=E _m×k -xi (t), _{perturb the value x i (} t)～ _xi (tk) of each root node in all time series, and get the fluctuation value y of each root node [δ, f[ _xi (t)]], using the root cause node whose fluctuation value is less than the preset fluctuation value as the target root cause node; Wherein, m is the number of business nodes in the multi-layer directed graph model, k is the number of time lags that each business node exists, T is the length of the time series, and E _{m × k} is the multi-layer directed graph The set of all business nodes in the model on all time lags, δ is a parameter related to the multi-layer directed graph model, the total number of root cause nodes is j, x _i (t) is the ith business node in The corresponding business data when the time series length is t. 5. The method according to claim 1, characterized in that, before the acquisition of the original service data generated at each service node of the preset service, further comprising: Carry out KEI index evaluation for each business to determine whether the business is in a healthy state, if the business is not in a healthy state, then use this business as the preset business, and obtain the Raw business data. 6. The method according to claim 1, characterized in that, after determining the target root cause node that causes the preset service exception from the root cause node, further comprising: Judging whether there is a fault handling plan for repairing the target root cause node, if yes, repairing the target root cause node according to the fault handling plan, and sending the first prompt message that the target root cause node has been repaired, otherwise, Sending the node information of the target root cause node and the second prompt information that the target root cause node has not been repaired. 7. A device for fault root cause diagnosis based on multilayer directed graph, characterized in that, comprising: An acquisition module, configured to acquire original service data generated at each service node of a preset service, and determine the calling relationship of each service node according to the original service data and pre-stored attribute information of each service node; Establishing a module for establishing a multi-layer directed graph model of each service node according to the calling relationship of each service node determined by the original service data and the attribute information and the pre-divided layer to which each service node belongs; A root cause determination module, configured to obtain abnormal business data in the original business data, determine at least one root cause node that causes the business business to generate the abnormal business data according to the multi-layer directed graph model, and determine from the root cause The node determines the target root cause node that causes the preset service exception. 8. An electronic device, characterized in that it comprises: at least one processor, at least one memory, a communication interface, and a bus; wherein, The processor, the memory, and the communication interface complete mutual communication through the bus; The communication interface is used for information transmission between the electronic device and communication devices of other electronic devices; The memory stores program instructions executable by the processor, and the processor can execute the method according to any one of claims 1 to 6 by invoking the program instructions. 9. A computer program product, characterized in that the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer , causing the computer to execute the method according to any one of claims 1 to 6.