CN113326161A

CN113326161A - Root cause analysis method

Info

Publication number: CN113326161A
Application number: CN202110610565.1A
Authority: CN
Inventors: 张广意; 刘超; 冯经宇; 李华桂; 伍健君
Original assignee: WeBank Co Ltd
Current assignee: WeBank Co Ltd
Priority date: 2021-06-01
Filing date: 2021-06-01
Publication date: 2021-08-31
Anticipated expiration: 2041-06-01
Also published as: CN113326161B; WO2022252512A1

Abstract

The embodiment of the application provides a root cause analysis method, a root cause analysis device, electronic equipment and a computer storage medium; the method comprises the following steps: acquiring a dependency relationship among the data nodes and events on the data nodes; determining the weight of the event on the first data node according to the dependency relationship among the data nodes and/or the precedence relationship of the occurrence time of the event on the data nodes; determining root relation among events on each data node according to the dependency relation among the data nodes, the events on each data node and the weight of the events on each data node; and under the condition that the events on each data node comprise target events, determining the root of the target events according to the root relation among the events on each data node.

Description

Root cause analysis method

Technical Field

The present application relates to information technology in financial technology (Fintech) and relates to, but is not limited to, a root cause analysis method.

Background

With the development of computer technology, more and more technologies are applied in the financial field, and the traditional financial industry is gradually changing to financial technology, but higher requirements are also put forward on the technologies due to the requirements of the financial industry on safety and real-time performance.

At present, with the expansion of services and the increase of architecture resources, more and more resources need to be monitored, a very large number of events (such as alarm events) often occur in this mode, and the events are complicated and redundant, which may cause great inconvenience to operation and maintenance personnel when handling the events. However, there is usually a relationship between events in an actual scenario. For example, a crash of a host may cause an alarm of an application on the host, and further cause an alarm of a service, so when an operation and maintenance person receives an alarm message, there is a high possibility that a bottom alarm may be submerged by an upper alarm, because events are usually ordered and sent according to time, and the operation and maintenance person may spend more time to process the events later, which may ultimately affect the recovery timeliness of the service.

In the related art, the root cause of an event can be determined by a root cause analysis method, which still mainly depends on the experience of an operation and maintenance engineer and a development engineer. Such a root cause analysis method is less accurate and requires a high expenditure of time and labor costs.

Disclosure of Invention

The embodiment of the application provides a root cause analysis method, which can solve the problem that the accuracy of the root cause analysis method in the related technology is low.

The technical scheme of the embodiment of the application is realized as follows:

the embodiment of the application provides a root cause analysis method, which comprises the following steps:

acquiring a dependency relationship among data nodes and an event on each data node;

determining the weight of an event on a first data node according to the dependency relationship among the data nodes and/or the precedence relationship of the occurrence time of the event on the data nodes, wherein the first data node represents any one data node in the data nodes;

determining root cause relations among the events on the data nodes according to the dependency relations among the data nodes, the events on the data nodes and the weights of the events on the data nodes;

and under the condition that the events on the data nodes comprise target events, determining the root cause of the target events according to the root cause relationship among the events on the data nodes.

In some embodiments of the present application, determining the weight of the event on the first data node according to the precedence relationship between the occurrence times of the events on the data nodes includes:

when a current occurrence event on a first data node is detected, the initial weight of the first data node is used as the weight of the current occurrence event.

It is understood that, since the initial weight of the first data node can be directly used as the weight of the current occurrence, the initial weight can be easily determined as the weight of the current occurrence.

when a current occurrence event on a first data node is detected and a first historical occurrence event exists in the first data node, increasing the value of the weight of the first historical occurrence event.

It is understood that, by increasing the value of the weight of the first historical occurred event, it is beneficial to make the weight of the first historical occurred event higher than the weight of the current occurred event, so that the magnitude relationship of the weights of the first historical occurred event and the current occurred event can more accurately reflect the association relationship between the first historical occurred event and the current occurred event.

In some embodiments of the present application, determining a weight of an event on the first data node according to a dependency relationship between the data nodes includes:

when a current occurrence event on a first data node is detected and at least one second historical occurrence event exists in a depended node of the first data node, increasing the value of the weight of the current occurrence event; the increment of the weight value of the current occurrence event is larger than or equal to the weight sum of the at least one second historical occurrence event; the depended-on node of the first data node represents a data node that depends on the first data node.

It can be understood that, since the value of the weight of the currently occurring event can be increased, and the increased amount of the value of the weight of the currently occurring event is greater than or equal to the sum of the weights of the at least one second historical occurring event, the weight of the currently occurring event on the first data node can be made greater than the weights of the events of the depended nodes, and thus, the magnitude relationship between the weight of the currently occurring event on the first data node and the event weight of the depended node can reflect the dependency relationship between the currently occurring event and the event of the depended node more accurately.

when a current occurrence event on a first data node is detected, and at least one third history occurred event exists in an ith level dependent node of the first data node, increasing the weight value of each third history occurred event in the at least one third history occurred event, wherein the increase of the weight value of each third history occurred event is greater than or equal to the highest weight of each event on the first data node; wherein i represents an integer greater than or equal to 1, the first data node depends on a level 1 dependent node of the first data node, and when i is greater than 1, an i-1 th level dependent node of the first data node depends on an i-th level dependent node of the first data node.

It is to be understood that, since the weights of the third history occurred events of the i-th level dependent node of the first data node may be increased, and the value of the weight of each third history occurred event may be increased by an amount greater than or equal to the highest weight of the events on the first data node, the weight of the occurred event of the i-th level dependent node of the first data node may be made greater than the weight of the events of the first data node, so that the magnitude relationship between the weight of the third history occurred event and the weight of the occurred event of the first data node may reflect the dependency relationship between the event of the first data node and the event of the dependent node more accurately.

when it is determined that the deleted event exists on the first data node and the at least one third history occurred event exists on the ith level dependent node of the first data node, reducing the weight value of each third history occurred event in the at least one third history occurred event, wherein the reduction of the weight value of each third history occurred event is equal to the weight of the deleted event.

It is understood that, when there is a deleted event on the first data node, since the weight of the third history occurred events of the ith-level dependent node of the first data node can be reduced, and the reduction amount of the value of the weight of each third history occurred event is equal to the weight of the deleted event, the association relationship between the event of the first data node and the event of the dependent node can be reflected more accurately.

In some embodiments of the present application, the determining a root cause relationship between events on the data nodes according to the dependency relationship between the data nodes, the event on the data nodes, and the weight of the event on the data nodes includes:

setting an initial value of the hierarchy of each data node to 0, and determining a 1 st-hierarchy valid data node in each data node, wherein an event occurs in the 1 st-hierarchy valid data node;

when j is an integer which is greater than or equal to 1, searching for a depended node of the effective data node of the jth level; when an event occurs in the depended-on node of the effective data node of the jth hierarchy and the hierarchy of the depended-on node of the effective data node of the jth hierarchy is 0, updating the hierarchy of the depended-on node of the effective data node of the jth hierarchy to j + 1; when an event does not exist in a depended-on node of the valid data node of the j level, or when a depended-on node does not exist in the valid data node of the j +1 level, determining a dependency relationship link, wherein the dependency relationship link is used for representing the level dependency relationship of the valid data nodes of all levels;

determining root relation among events on each data node according to the dependency relation link and the events on each data node; the root cause relationship comprises a weight magnitude relationship of each event of the valid data nodes of the same level.

It can be seen that, in the embodiment of the present application, the effective data nodes of each hierarchy can be accurately determined by the dependency relationship between the effective data nodes from the effective data node of the level 1, so that the dependency relationship link is accurately determined, which is beneficial to accurately determining the root cause relationship between events on each data node. In addition, the root cause relationship among the events on each data node can intuitively represent the vertical arrangement sequence of the events among different levels and the horizontal arrangement sequence of the events among the same level, and operation and maintenance personnel can accurately analyze the root cause of the target event.

In some embodiments of the present application, the method further comprises:

determining nodes without events as invalid data nodes in all the data nodes; starting from the invalid data node, searching a depended node of the invalid data node; when the event occurs to the depended-on node of the invalid data node, taking the depended-on node of the invalid data node as the valid data node of the 1 st level.

It can be understood that, since the invalid data node has no meaning on the root cause relationship between events, when the depended-on node of the invalid data node is a valid data node, the depended-on node of the invalid data node is suitable for being used as a head node of the dependency link, and therefore, taking the depended-on node of the invalid data node as the valid data node of the level 1 is beneficial to accurately determining the head node of the dependency link, and thus, is beneficial to accurately determining the complete dependency link.

In some embodiments of the present application, the determining the valid data node of the level 1 among the data nodes includes:

screening effective data nodes without dependent nodes from the data nodes; and taking the valid data node without the dependency node as the valid data node of the 1 st level.

As can be understood, the valid data node without the dependency node is suitable to be used as the head node of the dependency link, and therefore, the valid data node without the dependency node is used as the valid data node of the level 1, which is beneficial to accurately determining the head node of the dependency link, and thus, is beneficial to accurately determining the complete dependency link.

In some embodiments of the present application, the method further comprises: when an event occurs in the depended-on node of the effective data node of the j-th hierarchy and the hierarchy of the depended-on node of the effective data node of the j-th hierarchy is not 0, increasing the value of the hierarchy of the depended-on node of the effective data node of the j-th hierarchy by 1.

It can be seen that, for the same data node existing in different dependency relationship links, a larger value of the hierarchy in the different dependency relationship links can be taken, which is beneficial to accurately and uniquely determining the hierarchy of the same data node in the different dependency relationship links.

The embodiment of the application provides a root cause analysis device, the device includes:

the acquisition module is used for acquiring the dependency relationship among the data nodes and the events on the data nodes;

the first processing module is used for determining the weight of the event on the first data node according to the dependency relationship among the data nodes and/or the precedence relationship of the occurrence time of the event on the data nodes; determining root cause relations among the events on the data nodes according to the dependency relations among the data nodes, the events on the data nodes and the weights of the events on the data nodes; the first data node represents any one of the data nodes;

and the second processing module is used for determining the root cause of the target event according to the root cause relationship among the events on the data nodes under the condition that the events on the data nodes comprise the target event.

An embodiment of the present application provides an electronic device, which includes:

a memory for storing executable instructions;

and the processor is used for realizing any one of the root cause analysis methods when executing the executable instructions stored in the memory.

An embodiment of the present application provides a computer-readable storage medium, which stores executable instructions and is configured to, when executed by a processor, implement any one of the root cause analysis methods described above.

In the embodiment of the application, firstly, the dependency relationship among the data nodes and the events on the data nodes are obtained; then, determining the weight of an event on a first data node according to the dependency relationship among the data nodes and/or the precedence relationship of the occurrence time of the event on the data nodes, wherein the first data node represents any one of the data nodes; determining root cause relations among the events on the data nodes according to the dependency relations among the data nodes, the events on the data nodes and the weights of the events on the data nodes; and finally, under the condition that the events on the data nodes comprise target events, determining the root of the target events according to the root relation among the events on the data nodes.

It can be seen that in the embodiment of the application, the root cause relationship between the events on the data nodes can be determined according to the objectively existing dependency relationship between the data nodes and the events on the data nodes, and the operation and maintenance engineers and the development engineers do not need to be relied on, so that the accuracy of the root cause analysis method is improved to a certain extent, and the time cost and the labor cost are reduced. Furthermore, in the embodiment of the application, priority ordering and relationship combing can be performed on the events of the data nodes according to the dependency relationship among the data nodes and the weight of the events on the data nodes.

Drawings

FIG. 1 is a flow chart of a root cause analysis method according to an embodiment of the present application;

FIG. 2 is a diagram of an exemplary system infrastructure in an embodiment of the present application;

FIG. 3 is a diagram of another exemplary system infrastructure derived from the embodiment of the present application in FIG. 2;

FIG. 4A is a first schematic diagram illustrating an association between a data structure of a data node and a data structure of an event in an embodiment of the present application;

FIG. 4B is a diagram illustrating a second example of association between a data structure of a data node and a data structure of an event according to the present disclosure;

FIG. 5 is a flow chart of determining a weight of an event on a data node in the case of event addition in an embodiment of the present application;

fig. 6 is a schematic diagram of an association relationship between a data structure including data nodes and a data structure including events in the case of event addition in the embodiment of the present application;

fig. 7 is a schematic diagram of another association relationship between a data structure including a data node and a data structure including an event in the case of event addition in the embodiment of the present application;

FIG. 8 is a schematic diagram of another association relationship between a data structure including data nodes and a data structure including events in the case of event addition in the embodiment of the present application;

FIG. 9 is a schematic diagram of another association relationship between a data structure including a data node and a data structure including an event in the case of event addition in the embodiment of the present application;

FIG. 10 is a flow chart of determining a weight of an event on a data node in the case of event deletion in an embodiment of the present application;

fig. 11 is a schematic diagram illustrating an association relationship between a data structure including a data node and a data structure including an event in the case of deleting an event in the embodiment of the present application;

FIG. 12 is a diagram of yet another exemplary system infrastructure derived in an embodiment of the present application;

fig. 13 is a first schematic diagram illustrating determining a link subscript corresponding to a data node of each hierarchy in an embodiment of the present application;

FIG. 14 is a second diagram illustrating the determination of link subscripts corresponding to data nodes of each tier in an embodiment of the present application;

FIG. 15 is a second diagram illustrating the determination of link subscripts corresponding to data nodes of each tier in the embodiment of the present application;

FIG. 16 is an exemplary tree diagram of events that may be ultimately derived in embodiments of the subject application;

FIG. 17 is a schematic structural view of a root cause analysis device according to an embodiment of the present application;

fig. 18 is a schematic structural diagram of an electronic device in an embodiment of the present application.

Detailed Description

The present application will be described in further detail below with reference to the accompanying drawings and examples. It should be understood that the examples provided herein are merely illustrative of the present application and are not intended to limit the present application. In addition, the following examples are provided as partial examples for implementing the present application, not all examples for implementing the present application, and the technical solutions described in the examples of the present application may be implemented in any combination without conflict.

It should be noted that in the embodiments of the present application, the terms "comprises", "comprising" or any other variation thereof are intended to cover a non-exclusive inclusion, so that a method or apparatus including a series of elements includes not only the explicitly recited elements but also other elements not explicitly listed or inherent to the method or apparatus. Without further limitation, the use of the phrase "including a. -. said." does not exclude the presence of other elements (e.g., steps in a method or elements in a device, such as portions of circuitry, processors, programs, software, etc.) in the method or device in which the element is included.

For example, although the root cause analysis method provided in the embodiment of the present application includes a series of steps, the root cause analysis method provided in the embodiment of the present application is not limited to the described steps, and similarly, the root cause analysis device provided in the embodiment of the present application includes a series of modules, but the device provided in the embodiment of the present application is not limited to include the modules explicitly described, and may include modules that are required to acquire related information or perform processing based on the information.

In the related art, the root cause of an event may be determined by a root cause analysis method; the root cause analysis method in the related art is described below by taking an alarm event as an example. In order to recover the service quickly, in the face of hundreds of alarm events, the alarm events may be classified from the alarm event at the top layer, for example, the alarm events may be classified into host alarm events and service alarm events, the host alarm events may be classified according to the type of the host and the operating system, the type of the host may include a virtual machine and a physical machine, and the operating system of the host may include operating systems such as Linux and Windows; the alarm event may also be classified into a Central Processing Unit (CPU) alarm event, a memory alarm, a disk alarm event, and the like according to the index. After the alarm event is classified, a classification tag may be added to the alarm event. Therefore, when an alarm event occurs, operation and maintenance personnel can immediately determine the type of the alarm event, for example, when a physical machine alarm event, a virtual machine alarm event and an application alarm event occur simultaneously, the root cause of the alarm event can be positioned according to the dependency relationship among all alarm events. In the root cause positioning scheme of the alarm event, the type of the alarm event is marked through the label, so that the problem that the alarm event is submerged is favorably alleviated, and more concise and intuitive information can be provided.

However, in the related art, the root cause analysis scheme of the alarm event has the following disadvantages: firstly, the root cause analysis scheme of the alarm event mainly depends on the experience of operation and maintenance personnel, so that the accuracy of the root cause positioning scheme is reduced; secondly, the association relationship between alarm events can be obtained by querying data dependency information in a Configuration Management Database (CMDB), but the relationship of the label level of each alarm event obtained in the CMDB does not conform to the relationship of the actual alarm event; thirdly, similar alarm events are arranged only by means of time precedence relationship, and the dependency relationship of the similar alarm events is not easy to determine.

For example, when the virtual machine a and the virtual machine B run on the physical machine C, and the memory consumption suddenly increases due to an exception of the virtual machine a, the memory on the physical machine C also suddenly increases, which may cause the memory available for the virtual machine B to decrease or even cause the memory to overflow. In the above situation, the alarm event occurs in all of the virtual machine a, the virtual machine B, and the physical machine C, but if the virtual machines a and B are classified according to the virtual machine labels, the virtual machines a and B are put together, the physical machines are put in another type, and it may be directly determined from the dependency relationship that the physical machine is the root cause of the alarm event, however, in an actual situation, the virtual machine a is the root cause of the real alarm event.

In conclusion, the root cause analysis scheme of the alarm event in the related technology has the problem of low accuracy.

In view of the above technical problems, the technical solutions of the embodiments of the present application are provided. Embodiments of the application may be applied to terminals and/or servers where the terminals may be thin clients, thick clients, hand-held or laptop devices, microprocessor-based systems, programmable consumer electronics, network pcs, minicomputers, and the like. The server may be a small computer system, a mainframe computer system, a distributed cloud computing environment including any of the systems described above, and so forth.

An electronic device such as a server may include program modules for executing computer instructions. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. The computer system/server may be practiced in distributed cloud computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media including memory storage devices.

Fig. 1 is a flowchart of a root cause analysis method according to an embodiment of the present application, and as shown in fig. 1, the flowchart may include:

step 101: and acquiring the dependency relationship among the data nodes and the events on the data nodes.

In this embodiment of the present application, each data node may be a data node of a data system, the data system may include different types of data nodes such as a system process, a host, a database, a disk storage, and a load balancing, and a dependency relationship between the data nodes in the data system is known.

The dependency relationship between data nodes in the data system can be presented through a system basic architecture diagram, the system basic architecture diagram can comprise attribute data of each data node, and the attribute data of each data node can comprise unique identifications of other data nodes on which the data node depends, so that the dependency relationship of different data nodes can be declared.

For example, referring to fig. 2, a data system may include the following data nodes: the attribute data of each data node can be represented by contents in a rectangular box, for example, in fig. 2, in the attribute data of the user management system process, the unique identifier is user-system, the host machine on which the user management system process depends is host machine vm-linux-01, the database on which the user management system process depends is database mysql-01, and the user management system process depends on the password management system process, the unique identifier is password-system.

In fig. 2, the dependency relationship between different data nodes can be represented by a line with arrows, for example, a user management system process runs on a host vm-linux-01, a 100GB disk of the host vm-linux-01 is from a disk storage sas-01, data of the user management system process is placed on a database mysql-01, and the user management system process depends on a password management system process uniquely identified as password-system; in an actual scenario, when a user management system relates to password authentication, authentication needs to be performed by using a password management system process with a unique identifier of password-system, and the password management system process with the unique identifier of password-system depends on a host vm-linux-02 and load balancing nginx-01.

In this embodiment, a data structure of each data node may be defined, table 1 is a data structure table of the data node in this embodiment, and in table 1, fields of the data structure of the data node may include a unique Identity Document (ID) field, a Primitiveness Value (PV) field, a referencing set field of a dependent node, and a referencing set field of the present node, the unique ID field may also be referred to as a node ID field, the primitiveness value field may be referred to as a primitiveness value field, the referencing set field of the dependent node may be referred to as a rightrelated nodes field, the referencing set field of the dependent node may be referred to as a leftrelated nodes field, and the referencing set field of the present node may be referred to as an Events field. Wherein, the NodeId field represents the unique ID of the data node; the PriorityValue field indicates the initial weight of the data node, and the initial weight of the data node is used for reflecting the importance degree of the data node; in an actual scene, the importance degrees of different data nodes may be different, and thus different initial weights may be set for different data nodes, for example, a user management system process belongs to a process of production application, and a password management system process belongs to a process of test environment application, and thus, the importance degrees of the user management system process and the password management system process are different, and different initial weights may be set for the user management system process and the password management system; the Events field indicates an event occurring in the data node, and in the embodiment of the present application, the event occurring in the data node may be various abnormal Events such as an alarm event.

In some embodiments, the fields of the data structure of the data nodes may further include a link index field, where the link index field may be referred to as a ListIndex field, and the ListIndex field indicates that the link index is a hierarchy of the data nodes in the dependency link, where the dependency link represents a hierarchy dependency of each data node; for example, the initial value of the link subscript in the data structure of each data node may be set to 0, that is, the initial value of the hierarchy of each data node is set to 0; illustratively, the dependency links may be presented through a tree.

In table 1, the LeftRelatedNodes field represents a set of depended-on nodes of the data node, and the depended-on nodes of the data node represent data nodes dependent on the data node, for example, referring to fig. 2, the depended-on nodes of the disk storage sas-01 are hosts vm-linux-01, and the depended-on nodes of the database mysql-01 are user management system processes; the RightRelatedNodes field represents a collection of dependent nodes of the data node, the dependent nodes of the data node are used for characterizing which data nodes the data node depends on, for example, referring to fig. 2, the dependent nodes of the password management system process uniquely identified as password-system comprise a host vm-linux-02 and a load balancing nginx-01; in practical application, the LeftRelatedNodes field and the RightRelatedNodes field can only record the address reference information of the depended node and the dependent node, and do not need to include detailed data structure information of the depended node and the dependent node, so that the space occupied by the data structure of the data node can be reduced.

It will be appreciated that by determining the dependent and depended nodes for each data node, the dependency relationship between the data nodes can be determined.

TABLE 1

In the embodiment of the application, when an event of a data node occurs, the corresponding event can be recorded through a data structure of the event. Table 2 is a data structure table of an event in the embodiment of the present application, in table 2, fields of a data structure of the event may include a unique ID field, an event weight field, a corresponding data node ID field, an occurrence time field, and a sub-event set field, where the unique ID field may be referred to as an EventId field, the event weight field may be referred to as a PriorityValue field, the corresponding data node ID field may be referred to as a mapnodid field, the occurrence time field may be referred to as a StartTime field, and the sub-event set field may be referred to as a ChildrenEvents field, where the EventId field represents the unique ID of the event, the PriorityValue field represents a weight of the event, and the weight of the event may be changed due to the influence of other events; the MapNodeId field indicates a data node where the event is located, the StartTime field indicates an occurrence time point of the event, and the ChildrenEvents field indicates an event of a dependent node of the node where the event is located, that is, other events which may be caused by the event.

TABLE 2

In the embodiment of the present application, the data structures of the data nodes correspond to the data nodes one to one, and therefore, a new system basic architecture diagram can be obtained by re-describing the data nodes of the system basic architecture diagram according to the data structures. Referring to fig. 3, the data structure of each data node in fig. 3 may be presented according to the fields in table 1. In fig. 3, the dependency relationships between different data nodes may be represented by lines with arrows.

In this embodiment of the present application, the data structure of the data node in fig. 3 may be associated with the data structure of an event occurring on the data node to obtain an association diagram of the data structure of the data node and the data structure of the event, and referring to fig. 4A, a memory overflow alarm event and a user management system process survivability exception alarm event exist on a process node of a user management system. Referring to fig. 4B, there is an alarm event that memory usage is too high on the host vm-linux-01 node.

Step 102: determining the weight of the event on the first data node according to the dependency relationship among the data nodes and/or the precedence relationship of the occurrence time of the event on the data nodes; determining root relation among events on each data node according to the dependency relation among the data nodes, the events on each data node and the weight of the events on each data node; the first data node represents any one of the data nodes.

In some embodiments, the root cause relationship between events on each data node may be presented by an event tree, where the level of each data node in the dependency link may be taken as the tree level of the event on the corresponding data node in the event tree, that is, after determining the link index in the data structure of the data node, the value of the link index may be taken as the tree level of the event on the corresponding data node in the event tree.

In some embodiments, the tree level of the event in the event tree relationship graph may be presented in the data structure of the event, for example, in table 2, the field of the data structure of the event may further include a tree level (TreeIndex) field, and the tree level field represents the tree level of the event in the event tree relationship graph.

In some embodiments, the relationship between events on each data node can be determined according to a ChildrenEvents field in the data structure of the event and the tree hierarchy of the event in the event tree relationship graph, so as to determine the event tree relationship graph; the event tree relation graph is used for representing root relation among events on each data node.

In some embodiments, root cause relationships between events on data nodes may also be exposed; illustratively, the event tree relationship diagram can be shown; therefore, event handlers can more intuitively and effectively acquire root cause relationships among events, and the event handlers can perform root cause analysis on the events.

In the embodiment of the application, the dependency relationship between events on data nodes between adjacent hierarchies in a dependency relationship link can be determined according to the dependency relationship between the data nodes and the events on the data nodes; the priority order of the events on the data nodes in the same hierarchy in the dependency relationship link can be determined according to the events on the data nodes and the weight of the events on the data nodes, and further, the root relationship between the events on the data nodes can be determined according to the dependency relationship between the events on the data nodes in adjacent hierarchies in the dependency relationship link and the priority order of the events on the data nodes in the same hierarchy in the dependency relationship link, so that the purpose of root cause analysis is achieved.

Step 103: and under the condition that the events on each data node comprise target events, determining the root of the target events according to the root relation among the events on each data node.

In the embodiment of the application, under the condition of obtaining the event tree relation diagram, the root of the target event is determined according to the event tree relation diagram.

In practical applications, the steps 101 to 103 may be implemented based on a Processor of an electronic Device, where the Processor may be at least one of an Application Specific Integrated Circuit (ASIC), a Digital Signal Processor (DSP), a Digital Signal Processing Device (DSPD), a Programmable Logic Device (PLD), a Field Programmable Gate Array (FPGA), a CPU, a controller, a microcontroller, and a microprocessor. It is understood that the electronic device implementing the above-described processor function may be other electronic devices, and the embodiments of the present application are not limited thereto.

In the embodiment of the application, the weight of the event on the first data node can be determined according to the condition of event addition and the condition of event deletion; the following description will be made separately.

1) Event addition.

In some embodiments, determining the implementation manner of the weight of the event on each data node according to the precedence relationship of the occurrence time of the event on each data node may include:

and when the current occurrence event on the first data node is detected, taking the initial weight of the first data node as the weight of the current occurrence event.

In some embodiments, referring to fig. 5, when an event occurring at a first data node is detected, a data structure of the current event occurring may be established by referring to the above-mentioned content, and the data node of the current event occurring may be matched, that is, the first data node is determined; then, the weight of the current event on the first data node can be determined, and the weight of the current event on the first data node is the initial weight of the first data node.

In some embodiments, referring to fig. 6, when an alarm event with too high memory usage occurs to the host vm-linux-01, the alarm event may be matched to the host vm-linux-01, and the alarm event may be added to the reference set field of the node in the data structure of the host vm-linux-01. The initial weight PV (vm-linux-01) of the host vm-linux-01 is taken as the weight PV (vm-linux-01-alarm-01) of the alarm event with too high memory usage, and the initial weight PV (vm-linux-01) of the host vm-linux-01 is exemplarily 1.

In some embodiments, when a currently occurring event on the first data node is detected and there is a first historically occurring event for the first data node, the value of the weight of the first historically occurring event is increased.

In this embodiment of the application, the first history occurred event represents an event that has occurred before the current event occurred on the first data node, and the first history occurred event may be one event or multiple events.

The increment of the value of the weight of the first historical occurred event can be set according to actual needs, and the increment of the value of the weight of the first historical occurred event can be larger than or equal to the weight of the current occurred event, for example, the increment of the value of the weight of the historical occurred event can be 1 or other integer larger than 1.

For example, referring to fig. 5, after determining the weight of the current occurrence event, it may be determined whether a first historical occurrence event exists on the first data node, and if so, the weight of the first historical occurrence event is increased by 1, and then it is determined whether a depended node exists on the first data node; if the first history occurred event does not exist on the first data node, whether the first data node has a depended node or not can be directly judged.

Illustratively, referring to fig. 7, when a survivability exception alarm event occurs for a user management system process, the survivability exception alarm event may be matched to the user management system process and added in the reference set field of the local node of the user management system process. The initial weight 1 of the user management system process is taken as the weight of the survivability abnormal alarm event. Since there is already one memory overflow alarm event on the user management system process, in order to distinguish the importance degree of the alarm event of the same data node, different weights may be set for the survivability abnormal alarm event and the memory overflow alarm event, because generally the alarm event that occurs first is more likely to be the root alarm time, the weight of the memory overflow alarm event should be higher than the weight of the memory activity abnormal alarm event, for example, referring to fig. 7, the value of the weight of the memory overflow alarm event is increased by 1, and the value of the weight of the memory overflow alarm event is changed to 2.

In some embodiments, the value of the weight of the currently occurring event may be increased when the currently occurring event on the first data node is detected and the depended node of the first data node has at least one second history of occurring events; the increment of the weight value of the current occurrence event is larger than or equal to the weight sum of at least one second historical occurrence event; the depended-on node of the first data node represents a data node that depends on the first data node.

Exemplarily, referring to fig. 5, it may be determined whether a depended node exists in the first data node, and if the depended node does not exist in the first data node, it may be determined whether a dependent node exists in the first data node; if the first data node has the depended node, continuously judging whether a second history occurred event exists on the depended node or not, and if the second history occurred event does not exist on the depended node, judging whether a dependent node exists on the first data node or not; and if the second history occurred events exist on the depended node, increasing the value of the weight of the current occurred event, and then judging whether the first data node has a dependent node or not.

Illustratively, referring to fig. 8, when a capacity usage rate too high alarm event occurs to disk storage sa-01, the capacity usage rate too high alarm event may be matched to disk storage sa-01 and added in an Events field of disk storage sa-01. The initial value of the weight of the capacity utilization too high alarm event may be set to the initial weight 1 of disk storage sas-01. Since disk storage sa-01 is depended on by host vm-linux-01, that is, disk storage sa-01 exists in a depended node, in this case, the weight sum of events on host vm-linux-01 can be counted, and in fig. 8, the weight sum of events on host vm-linux-01 is 2, so that the weight of an alarm event with too high capacity utilization is increased by 2, that is, the weight PV (sa-01-alarm-01) of an alarm event with too high capacity utilization is equal to the sum of the initial weight PV (sa-01) of disk storage sa-01 and PV (vm-linux-alarm-01), and PV (vm-linux-alarm-01) represents the weight sum of events on host vm-linux-01.

In some embodiments, when a currently occurring event on the first data node is detected and at least one third history occurred event exists in the ith level dependent node of the first data node, the value of the weight of each third history occurred event in the at least one third history occurred event is increased, and the increase of the value of the weight of each third history occurred event is greater than or equal to the highest weight of each event on the first data node; wherein i represents an integer greater than or equal to 1, the first data node depends on a level 1 dependent node of the first data node, and when i is greater than 1, an i-1 th level dependent node of the first data node depends on an i-th level dependent node of the first data node.

Referring to fig. 3, a level 1 dependent node of a user management system process comprises a host vm-linux-01, a database mysql-01 and a password management system process; because the host vm-linux-01 depends on the disk storage sas-01, the database mysql-01 depends on the disk storage sas-02, and the password management system process depends on the host vm-linux-02 and the load balancing nginx-01, the level 2 dependent node of the user management system process comprises the disk storage sas-01, the disk storage sas-02, the host vm-linux-02 and the load balancing nginx-01; since the host vm-linux-02 depends on the disk storage sas-02, the disk storage sas-02 is also a level 3 dependent node of the user management system process.

Exemplarily, referring to fig. 5, it may be determined whether there is a dependent node in the first data node, and if there is no dependent node in the first data node, the process is ended; if the first data node has a dependent node, judging whether the dependent node has a third history occurred event, and if the dependent node does not have the third history occurred event, ending the process; increasing the value of the weight of the dependent node if the dependent node has a third history of occurred events

Illustratively, referring to fig. 7, after changing the value of the weight of the memory overflow alarm event to 2, the weight of the memory overflow alarm event is the highest weight of each alarm event on the user management system process, in this case, since the host vm-linux-01 is the level 1 dependent node of the user management system process, the disk storage sas-01 is the level 2 dependent node of the user management system process, and there are already alarm events with too high memory usage on the host vm-linux-01 and alarm events with too high capacity usage on the disk storage sas-01, the weight of the alarm events with too high memory usage on the host vm-linux-01 and the weight of the alarm events with too high capacity usage on the disk storage sas-01 can be increased by 2, and the weight of the alarm events with too high memory usage on the host vm-linux-01 becomes 4, the weight of the capacity usage too high alarm event on disk storage sas-01 becomes 5.

For example, referring to fig. 9, when a memory overflow alarm event occurs in a user management system process, the memory overflow alarm event may be matched to the user management system process, and the memory overflow alarm event may be added to a reference set field of a local node of the user management system process. And taking the initial weight 1 of the user management system process as the weight of the memory overflow alarm event. Since the host vm-linux-01 is a level 1 dependent node of the user management system process, and an alarm event with too high memory usage already exists on the host vm-linux-01, the weight of the alarm event with too high memory usage on the host vm-linux-01 can be increased by 1, and the weight of the alarm event with too high memory usage on the host vm-linux-01 becomes 2, that is, the weight PV (vm-linux-01-alarm-01) of the alarm event with too high memory usage on the host vm-linux-01 is the sum of the initial weight PV (vm-linux-01) of the host vm-linux-01 and the weight PV (user-system-alarm-01) of the alarm event with too high memory usage.

2) Event deletion.

In some embodiments, when it is determined that there is a deleted event on the first data node and there is at least one third history occurred event on the ith level dependent node of the first data node, the value of the weight of each of the at least one third history occurred event is decreased, and the decrease of the value of the weight of each third history occurred event is equal to the weight of the deleted event.

In the embodiment of the application, after the event is added, the event can be deleted; illustratively, after an alarm event is added, if the alarm event is recovered (i.e., there is no alarm event), the corresponding event may be deleted in the reference set field of the local node of the data structure of the first data node. Then, for a deleted event on the first data node, the weight of the occurred event on the ith level dependent node of the first data node may be changed.

In some embodiments, referring to fig. 10, when there is a deleted event, an attempt may be made to match the deleted time with each data node, if there is no data node matched, the process is ended, and if there is a data node matched, it is determined whether there is a dependent node in the matched data node; taking the matched data node as the first data node as an example for explanation, if the first data node has no dependent node, the process is ended after the event is deleted in the first data node; if the first data node has the dependent node, judging whether the dependent node of the first data node has the occurred event, if the dependent node of the first data node has no the occurred event, deleting the event in the first data node and then ending the process; and if the dependent node of the first data node has the occurred event, reducing the weight value of the occurred event of the dependent node of the first data node, and then returning to the step of judging whether the first data node has the dependent node. It can be seen that by reducing the weight of the occurred event of the dependent node of the first data node, the value of the weight of the occurred event can no longer be in an increasing trend all the time.

Exemplarily, referring to fig. 11, an event connected to the user management system process by a dotted line is a recovered event, when the memory overflow alarm event of the user management system process is recovered, the memory overflow alarm event may be matched to the user management system process, and then the memory overflow alarm event is deleted in the reference set field of the node of the data structure of the user management system process; because the level 1 dependent node of the user management system process is the host vm-linux-01 and the level 2 dependent node of the user management system process is the disk storage sas-01, the weight of the alarm event with too high memory usage on the host vm-linux-01 can be reduced by 2, and the weight of the alarm event with too high capacity usage on the disk storage sas-01 can be reduced by 2, that is, the weight of the alarm event with too high memory usage on the host vm-linux-01 becomes 2, and the weight of the alarm event with too high capacity usage on the disk storage sas-01 becomes 3.

In summary, in the embodiment of the present application, the weight of the event on the data node can be dynamically changed according to the conditions of event addition and event deletion, that is, the weight of the event on the data node can be determined accurately in time, so that the relationship between the events of the data nodes can be determined accurately in time.

In some embodiments, determining an implementation manner of a root cause relationship between events on the data nodes according to the dependency relationship between the data nodes, the event on the data nodes, and the weight of the event on the data nodes may include:

setting the initial value of the hierarchy of each data node to be 0, and determining a 1 st hierarchy valid data node in each data node, wherein the 1 st hierarchy valid data node has an occurred event;

and determining root relation among the events on each data node according to the dependency relation link and the events on each data node.

In the embodiment of the application, the type of the data node can be determined by judging whether the data node has an occurred event or not; if the data node has an occurred event (the reference set field of the data node of the data structure of the data node is not empty), determining the data node as a valid data node; and if the data node does not have the occurred event (the reference set field of the data node of the data structure of the data node is empty), determining the data node as an invalid data node.

Since the embodiments of the present application are used to determine root relationships between events, and there is no event that has occurred in an invalid data node, the invalid data node has no meaning to the root relationships between events, and therefore, when determining the root relationships between events, there is no need to consider the invalid data node, and the value of the ListIndex field of the data structure of the invalid data node is always 0, that is, it indicates that the invalid data node does not exist in a dependency relationship link.

In some embodiments, valid data nodes for which no dependent node exists may be screened out from the data nodes; and taking the valid data node without the dependent node as the valid data node of the 1 st level.

In the embodiment of the application, whether the data node has a dependent node or not can be judged through a RightRelatednodes field of a data structure of the data node; if the RightRelatedNodes field of the data structure of the data node is empty, the data node is proved to have no dependent node; if the rightRelatedNodes field of the data structure of the data node is not empty, the data node is indicated to have a dependent node.

In this embodiment of the present application, when j is an integer greater than or equal to 1, whether a depended node exists in an effective data node of a jth hierarchy may be determined through a LeftRelatedNodes field of a data structure of the depended node of the effective data node of the jth hierarchy, and if the depended node does not exist in the effective data node of the jth hierarchy, a dependency link may be determined, where the dependency link includes a data node link formed from the effective data node of the jth hierarchy to the effective data node of the jth hierarchy.

If the depended node exists in the valid data node of the j level, but the depended node of the valid data node of the j level is an invalid node, a dependency link can be determined, wherein the dependency link comprises a data node link formed by the valid data node of the 1 st level to the valid data node of the j level.

In this embodiment of the present application, if the level of the depended-on node of the valid data node of the jth level is 0, it indicates that the depended-on node of the valid data node of the jth level does not exist in other dependency links at present, at this time, the level of the depended-on node of the valid data node of the jth level may be updated to j +1, that is, the valid data node of the jth +1 level may be determined, and thus, the dependency link may be determined gradually by continuously determining the valid data node of the next level.

It can be seen that, for the same dependency link, the values of the link subscripts used for representing the hierarchy in different data nodes are different, and the link subscripts corresponding to data nodes higher in the hierarchy of the same dependency link are higher.

In the embodiment of the application, after the dependency relationship link is determined, the hierarchy of each data node of the dependency relationship link may be used as the hierarchy of an event on the corresponding data node, and then, an event tree relationship graph representing the root relationship between events is determined by combining the dependency relationship of each data node in the dependency relationship link and the hierarchy of the event on each data node in the dependency relationship link.

It can be seen that, in the embodiment of the present application, the effective data nodes of each hierarchy can be accurately determined by the dependency relationship between the effective data nodes from the effective data node of the level 1, so that the dependency relationship link is accurately determined, which is beneficial to accurately determining the root cause relationship between events on each data node.

In some embodiments, among the data nodes, it may be determined that there is no node where an event has occurred as an invalid data node; searching a depended node of the invalid data node from the invalid data node; and when the event occurs to the depended-on node of the invalid data node, taking the depended-on node of the invalid data node as the valid data node of the 1 st level.

Here, as can be seen from the above description, when searching for a depended-on node of a valid data node of a j-th hierarchy, if the depended-on node of the valid data node of the j-th hierarchy is an invalid data node, the depended-on node of the invalid data node can be searched for from the invalid data node; in the embodiment of the application, each time an invalid data node is found, a depended node of the invalid data node can be found, and if the depended node of the invalid data node is a valid data node, the depended node of the invalid data node can be used as a valid data node of the level 1.

In some embodiments, the value of the hierarchy of the depended node of the valid data node of the jth hierarchy may be increased by 1 when an event has occurred in the depended node of the valid data node of the jth hierarchy and the hierarchy of the depended node of the valid data node of the jth hierarchy is not 0.

In this embodiment of the present application, if the depended-on node of the valid data node at the jth hierarchy is a valid data node, and the hierarchy of the depended-on node of the valid data node at the jth hierarchy is not 0, it indicates that the depended-on node of the valid data node at the jth hierarchy currently exists in other dependency links, at this time, the hierarchy of the depended-on node of the valid data node at the jth hierarchy may take a larger value of the hierarchies in different dependency links, that is, the hierarchy of the depended-on node of the valid data node at the jth hierarchy may be updated to j + 1. In practical implementation, 1 may be added to the link subscript corresponding to the depended node of the effective data node of the j-th hierarchy, which is beneficial to reducing the condition that the link subscripts corresponding to the data nodes collide.

In some embodiments, in the case that the root relationship between events on the data nodes is determined according to the dependency relationship between the data nodes, the events on the data nodes, and the weight of the events on the data nodes, the root relationship may reflect the weight magnitude relationship of the events of the valid data nodes of the same hierarchy.

In the embodiment of the application, the root relationship among the events on each data node can be determined according to the dependency relationship link, the events on each data node, and the weight of the events on each data node. The arrangement sequence of the effective data nodes of the same level can be determined according to the magnitude relation of the event weights, so that the root cause relation among the events on each data node can intuitively represent the vertical arrangement sequence of the events among different levels and the horizontal arrangement sequence of the events among the same level, and operation and maintenance personnel can accurately analyze the root cause of the target event.

Further, according to the embodiment of the application, a root relationship between events without ring dependency can be determined according to the weight magnitude relationship of each event of the valid data nodes at the same level and the inherent unidirectional dependency relationship between the data nodes.

The root cause relationship positioning scheme of the embodiment of the present application is further described below by an embodiment.

Tables 3 to 8 show data structures of 6 events, wherein the 6 events are respectively an alarm event that the usage rate of the capacity of the sa-02 storage of the disk is too high, an alarm event that the usage rate of the memory of the vm-linux-02 of the host is too high, an alarm event that the process of the password management system is abnormal, an alarm event that the slow query of the database mysql-01 is too much, an alarm event that the memory of the process of the user management system overflows, and an alarm event that the process of the user management system is abnormal in survivability. According to the content described above, the weights of the 6 events can be determined; in tables 3 to 8, the sub-event set of each event is initialized to null, and the tree level of each event is initialized to 0.

TABLE 3

TABLE 4

TABLE 5

TABLE 6

TABLE 7

TABLE 8

Referring to fig. 12, the event set of the user physical system process includes two events, the event set on the database mysql-01, the disk storage sas-02, the password management system process and the host vm-linux-02 includes one event; and no event exists on the host vm-linux-01, the disk storage sas-01 and the load balancing nginx-01, and the initial value of the link subscript corresponding to each data node is 0.

For the dependency relationship between the data nodes shown in fig. 12, the data nodes whose reference set fields of the dependent nodes are empty can be screened out from fig. 12, and the data nodes whose reference set fields of the dependent nodes are empty include a disk storage sas-01, a disk storage sas-02 and a load balancing nginx-01.

And screening out valid data nodes at the data nodes with null reference set fields of the dependent nodes, namely screening out the data nodes with null reference set fields of the dependent nodes, wherein the disk storage sas-01 and the load balancing nginx-01 are invalid data nodes, and the disk storage sas-02 is a valid data node.

After the disk storage sas-02 is taken as an effective data node of the level 1, the index of a link corresponding to the disk storage sas-02 is set to be 1. Then, starting from the disk storage sas-02, effective data nodes of each level are gradually searched according to the content described above, and after an effective data node of the j-th level is found, the link subscripts corresponding to the effective data node of the j-th level are set to be j, for example, referring to fig. 13, the depended nodes of the disk storage sas-02 are the database mysql-01 and the host vm-linux-02, so that the database mysql-01 and the host vm-linux-02 are both data nodes of the 2-th level, and the link subscripts corresponding to the database mysql-01 and the host vm-linux-02 can be both set to be 2.

Referring to fig. 14, starting from the database mysql-01 and the host vm-linux-02, the dependent nodes of the database mysql-01 and the host vm-linux-02 are searched, and based on the above description, the link index corresponding to the user management system process and the password management system process may be set to 3.

Referring to fig. 15, since the reference set field of the depended-on node of the user management system process is empty, it indicates that the depended-on node of the user management system process is an end point of the dependency link; and a user-system is also arranged in the reference set of the depended nodes of the password management system process, which indicates that the user management system process can be found from the password management system process, but the subscript of the link corresponding to the user management system process is not 0, indicates that the user management system process is in other links, at this time, the subscript value of the link corresponding to the user management system process can be increased by 1, and the subscript value of the link corresponding to the user management system process is changed into 4.

In conjunction with fig. 12-15, dependency links may be determined.

After the dependency relationship link is determined, the value of the link subscript corresponding to each data node can be assigned to the tree level field of the occurred event on the data node, and each event is associated through the sub-event set in the event data structure.

Referring to fig. 15, the tree level of the alarm event that the capacity utilization rate of the disk storage sas-02 is too high is equal to the link index 1 corresponding to the disk storage sas-02, the tree level of the database mysql-01 for slowly querying too many alarm events is equal to the link index 2 corresponding to the database mysql-01, and because the reference set field of the depended node corresponding to the disk storage sas-02 has the database mysql-01, the sub-event set of the alarm event that the capacity utilization rate of the disk storage sas-02 is too high can be added with the database mysql-01 for slowly querying too many alarm events.

In the embodiment of the present application, starting from the disk storage sas-02, the field values of the tree hierarchy and the sub-event set in the data structure of each data node in the dependency link may be gradually determined by referring to the contents described above, and tables 9 to 14 show the data structures of each event.

TABLE 9

Watch 10

TABLE 11

TABLE 12

Watch 13

TABLE 14

After the data structures of the events shown in tables 9 to 14 are determined, an event tree relation graph can be determined according to the tree hierarchy corresponding to each event; in the event tree-like relational graph, the sequence from top to bottom reflects the arrangement sequence of the tree levels of the events from small to large, the smaller the tree levels, the more likely the tree levels are the root events, in addition, in the same tree level, different event data can be sorted from left to right through the event weight size, and the events between different tree levels can be related through the sub-event set field in the data structure of the events.

Fig. 16 is an exemplary event tree relationship diagram finally obtained in the embodiment of the present application, and as shown in fig. 16, the weight of an alarm event that the usage rate of the capacity of the disk storage sas-02 is too high is highest, and the alarm event that the usage rate of the capacity of the disk storage sas-02 is too high may cause an alarm event that the usage rate of a memory of the host vm-linux-02 is too high and too many alarm events of slow query of the database mysql-01, thereby causing an abnormal alarm event of a process of the cryptographic management system, and finally causing memory overflow of a process of the user management system depending on the process of the cryptographic management system and using the database mysql-01, and causing an abnormal alarm event of viability of the process of the user management system.

On the basis of the root cause analysis method provided by the foregoing embodiment, the embodiment of the present application further provides a root cause analysis device; fig. 17 is a schematic diagram of an alternative configuration of a root cause analysis device according to an embodiment of the present application, and as shown in fig. 17, the root cause analysis device 170 may include:

the obtaining module 171 is configured to obtain a dependency relationship between data nodes and an event on each data node;

the first processing module 172 is configured to determine a weight of an event on the first data node according to the dependency relationship between the data nodes and/or the precedence relationship between the occurrence times of the events on the data nodes; determining root cause relations among the events on the data nodes according to the dependency relations among the data nodes, the events on the data nodes and the weights of the events on the data nodes; the first data node represents any one of the data nodes;

the second processing module 173 is configured to, when the events on the data nodes include a target event, determine a root cause of the target event according to a root cause relationship between the events on the data nodes.

In some embodiments, the first processing module 172 is configured to determine the weight of the event on each data node according to the precedence relationship between the occurrence times of the events on each data node, and includes:

In some embodiments, the first processing module 172 is configured to determine, according to a precedence relationship between occurrence times of the events on the data nodes, a weight of the event on the first data node, where the weight includes:

In some embodiments, the first processing module 172, configured to determine a weight of the event on the first data node according to the dependency relationship between the data nodes, includes:

In some embodiments, the first processing module 172 is configured to determine a root relationship between events on the data nodes according to the dependency relationships between the data nodes, the events on the data nodes, and the weights of the events on the data nodes, and includes:

In some embodiments, the first processing module 172 is further configured to:

In some embodiments, the first processing module 172, configured to determine a valid data node of level 1 among the data nodes, includes:

In some embodiments, the first processing module 172 is further configured to increase the value of the level of the depended node of the valid data node of the jth hierarchy by 1 when an event occurs in the depended node of the valid data node of the jth hierarchy and the level of the depended node of the valid data node of the jth hierarchy is not 0.

In some embodiments, the second processing module 173 is further configured to expose root cause relationships between events on the data nodes.

In practical applications, the obtaining module 171, the first processing module 172, and the second processing module 173 may be implemented by a processor of an electronic device, and the processor may be at least one of an ASIC, a DSP, a DSPD, a PLD, an FPGA, a CPU, a controller, a microcontroller, and a microprocessor. It is understood that the electronic device implementing the above-described processor function may be other electronic devices, and the embodiments of the present application are not limited thereto.

It should be noted that the above description of the embodiment of the apparatus, similar to the above description of the embodiment of the method, has similar beneficial effects as the embodiment of the method. For technical details not disclosed in the embodiments of the apparatus of the present application, reference is made to the description of the embodiments of the method of the present application for understanding.

It should be noted that, in the embodiment of the present application, if the method described above is implemented in the form of a software functional module and sold or used as a standalone product, it may also be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application may be essentially implemented or portions thereof contributing to the prior art may be embodied in the form of a software product stored in a storage medium, and including several instructions for causing a computer device (which may be a terminal, a server, etc.) to execute all or part of the methods described in the embodiments of the present application. And the aforementioned storage medium includes: various media capable of storing program codes, such as a usb disk, a removable hard disk, a Read Only Memory (ROM), a magnetic disk, or an optical disk. Thus, embodiments of the present application are not limited to any specific combination of hardware and software.

Correspondingly, an embodiment of the present application further provides a computer program product, where the computer program product includes computer-executable instructions for implementing any one of the root cause analysis methods provided in the embodiment of the present application.

Accordingly, an embodiment of the present application further provides a computer storage medium, where computer-executable instructions are stored on the computer storage medium, and the computer-executable instructions are used to implement any root cause analysis method provided by the foregoing embodiment.

An embodiment of the present application further provides an electronic device, fig. 18 is an optional schematic structural diagram of the electronic device provided in the embodiment of the present application, and as shown in fig. 18, the electronic device 180 includes:

a memory 181 for storing executable instructions;

the processor 182, when executing the executable instructions stored in the memory 181, implements any of the above-described root cause analysis methods.

The processor 182 may be at least one of ASIC, DSP, DSPD, PLD, FPGA, CPU, controller, microcontroller, and microprocessor.

The computer-readable storage medium/Memory may be a Read Only Memory (ROM), a Programmable Read Only Memory (PROM), an Erasable Programmable Read Only Memory (EPROM), an Electrically Erasable Programmable Read Only Memory (EEPROM), a magnetic Random Access Memory (FRAM), a Flash Memory (Flash Memory), a magnetic surface Memory, an optical Disc, or a Compact Disc Read-Only Memory (CD-ROM), and the like; but may also be various terminals such as mobile phones, computers, tablet devices, personal digital assistants, etc., that include one or any combination of the above-mentioned memories.

Here, it should be noted that: the above description of the storage medium and device embodiments is similar to the description of the method embodiments above, with similar advantageous effects as the method embodiments. For technical details not disclosed in the embodiments of the storage medium and apparatus of the present application, reference is made to the description of the embodiments of the method of the present application for understanding.

It should be appreciated that reference throughout this specification to "some embodiments" means that a particular feature, structure, or characteristic described in connection with the embodiments is included in at least one embodiment of the present application. Thus, the appearances of the phrase "in some embodiments" appearing in various places throughout the specification are not necessarily all referring to the same embodiments. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. It should be understood that, in the various embodiments of the present application, the sequence numbers of the above-mentioned processes do not mean the execution sequence, and the execution sequence of each process should be determined by its function and inherent logic, and should not constitute any limitation to the implementation process of the embodiments of the present application. The above-mentioned serial numbers of the embodiments of the present application are merely for description and do not represent the merits of the embodiments.

It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

In the several embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. The above-described device embodiments are merely illustrative, for example, the division of the unit is only a logical functional division, and there may be other division ways in actual implementation, such as: multiple units or components may be combined, or may be integrated into another system, or some features may be omitted, or not implemented. In addition, the coupling, direct coupling or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection between the devices or units may be electrical, mechanical or other forms.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units; can be located in one place or distributed on a plurality of network units; some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiments of the present application.

In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be separately regarded as one unit, or two or more units may be integrated into one unit; the integrated unit can be realized in a form of hardware, or in a form of hardware plus a software functional unit.

Alternatively, the integrated units described above in the present application may be stored in a computer-readable storage medium if they are implemented in the form of software functional modules and sold or used as independent products. Based on such understanding, the technical solutions of the embodiments of the present application may be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for causing an automatic test line of a device to perform all or part of the methods described in the embodiments of the present application. And the aforementioned storage medium includes: a removable storage device, a ROM, a magnetic or optical disk, or other various media that can store program code.

The methods disclosed in the several method embodiments provided in the present application may be combined arbitrarily without conflict to obtain new method embodiments.

The features disclosed in the several method or apparatus embodiments provided in the present application may be combined arbitrarily, without conflict, to arrive at new method embodiments or apparatus embodiments.

The above description is only for the embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily conceive of changes or substitutions within the technical scope of the present application, and shall be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A method of root cause analysis, the method comprising:

2. The method according to claim 1, wherein determining the weight of the event on the first data node according to the precedence relationship of the occurrence times of the events on the data nodes comprises:

3. The method according to claim 1, wherein determining the weight of the event on the first data node according to the precedence relationship of the occurrence times of the events on the data nodes comprises:

4. The method of claim 1, wherein determining the weight of the event on the first data node based on the dependency relationship between the data nodes comprises:

5. The method of claim 1, wherein determining the weight of the event on the first data node based on the dependency relationship between the data nodes comprises:

6. The method of claim 5, wherein determining the weight of the event on the first data node based on the dependency relationship between the data nodes comprises:

7. The method according to any one of claims 1 to 6, wherein the determining the root cause relationship between the events on the data nodes according to the dependency relationship between the data nodes, the events on the data nodes, and the weights of the events on the data nodes comprises:

8. The method of claim 7, further comprising:

9. The method of claim 7, wherein determining the valid data node at level 1 among the data nodes comprises:

10. The method of claim 7, further comprising: when an event occurs in the depended-on node of the effective data node of the j-th hierarchy and the hierarchy of the depended-on node of the effective data node of the j-th hierarchy is not 0, increasing the value of the hierarchy of the depended-on node of the effective data node of the j-th hierarchy by 1.