CN117909166A - Method, device, equipment and storage medium for monitoring abnormality of micro-service application - Google Patents

Abstract

The invention relates to the field of micro-service application, and discloses an anomaly monitoring method, device and equipment for micro-service application and a storage medium. The method comprises the following steps: registering and starting an observability agent in a micro-service application starting stage, and monitoring the micro-service application; collecting operation indexes of the micro-service application according to the observability agent, and generating an operation log according to the operation indexes; generating a visual view of a business link of the micro-service application according to the running log; and carrying out anomaly monitoring and anomaly analysis on the business links of the micro-service application according to the visual view. The invention provides an anomaly monitoring method of a micro-service application, which is characterized in that an observable agent is injected into the micro-service application, and the agent actively detects the internal execution flow of an application code during running, so that the limitation of external monitoring is broken through, the deep observation of the internal behavior of the application is realized, the generation cause of a service problem is rapidly judged, and the accurate positioning of the root cause of the problem is realized.

Description

Method, device, equipment and storage medium for monitoring abnormality of micro-service application

Technical Field

The present invention relates to the field of micro service application technologies, and in particular, to a method, an apparatus, a device, and a storage medium for monitoring anomalies in a micro service application.

Background

Micro services (or micro services architecture) is a cloud native architecture approach that includes numerous loosely coupled and individually deployable small components or services in a single application. These services typically have their own technology stack, including databases and data management models; communicating with each other through a REST API, event stream and message broker combination; and organized by business capability, with service separation lines commonly referred to as bounded contexts. Micro services are characterized in that the code is easier to update, new features or functions can be directly added without updating the whole application, and different technical stacks and different programming languages can be used for different components. The components can be expanded independently of each other, thereby reducing waste and costs associated with having to expand the entire application, avoiding the excessive loads that may be faced by a single function.

However, the existing containerized micro-service architecture mostly depends on logs and external monitoring to realize observability of the system, but these means are difficult to go deep into the code logic inside the application, cannot clearly reflect the processing behavior inside each micro-service, and therefore, the capability of monitoring a service link end to end is lost, and the problem of insufficient observability of an application logic layer exists. Because the containerized application is based on micro-service splitting, tracking and monitoring support for the service link level is insufficient, the processing process of each micro-service cannot be clearly seen, so that abnormal positioning is difficult, and the problem investigation efficiency is affected.

Accordingly, the prior art is still in need of improvement and development.

Disclosure of Invention

The invention mainly aims to solve the problems that in the prior art, the micro-service architecture generally has insufficient observability of an application logic layer, so that abnormal positioning is difficult and the problem investigation efficiency is affected.

The first aspect of the present invention provides an anomaly monitoring method for a micro-service application, including: registering and starting an observability agent in a micro-service application starting stage, and monitoring the micro-service application; collecting operation indexes of the micro service application according to the observability agent, and generating an operation log according to the operation indexes; generating a visual view of a service link of the micro-service application according to the running log; and according to the visual view, carrying out anomaly monitoring and anomaly analysis on the service link of the micro service application.

Optionally, in a first implementation manner of the first aspect of the present invention, in a micro service application start stage, the step of registering and starting an observability agent at the same time, and monitoring the micro service application includes: embedding an initialization code of an observability agent in a start code of a micro-service application in advance, wherein the initialization code is executed simultaneously along with the start code of the micro-service application, and simultaneously registers and starts the observability agent; and acquiring a configuration file, and setting the monitoring range of the observability agent according to the configuration file.

Optionally, in a second implementation manner of the first aspect of the present invention, the step of collecting, according to the observability agent, an operation index of the micro service application, and generating an operation log according to the operation index includes: setting a hook function, embedding the hook function into a starting point and an ending point of a service link of the micro service application, and collecting operation indexes of the service link through the hook function; performing data processing on the operation indexes and generating an operation log; and uploading the running log to an observability agent background.

Optionally, in a third implementation manner of the first aspect of the present invention, the step of uploading the running log to the observability agent background includes: starting a log uploading module of an independent thread, and caching the running log through a memory queue; and asynchronously uploading the running log to the observability agent background in a preset mode through the log uploading module.

Optionally, in a fourth implementation manner of the first aspect of the present invention, the step of generating a visual view of a service link of the micro service application according to the running log includes: performing association analysis on the running logs and the feature fields of the micro-service application, and generating an analysis result by analyzing father-son relations among the running logs; and generating a visual view of the service link of the micro-service application according to the analysis result, wherein the visual view is an interactive monitoring view.

Optionally, in a fifth implementation manner of the first aspect of the present invention, the step of performing anomaly monitoring and anomaly analysis on the service link of the micro service application according to the visual view includes: presenting an abnormal service link through the visual view, and selecting the abnormal service link to automatically lock an abnormal code; and carrying out association analysis on the parameter information of the abnormal code and the operation log, determining the reason of the abnormality, and outputting an abnormality analysis report.

Optionally, in a sixth implementation manner of the first aspect of the present invention, the step of performing association analysis on parameter information of the exception code and the running log, and determining an reason for the exception includes: extracting an operation log corresponding to the abnormal code; analyzing the timestamp of the abnormality in the operation log, analyzing the service link calling sequence before and after the timestamp, and determining the abnormal service link.

The second aspect of the present invention provides an anomaly monitoring device for micro-service applications, comprising: the registration module is used for associating the observability agent in advance in the starting stage of the micro-service application, and the observability agent is associated and registered and started when the micro-service application is started, so that the micro-service application is monitored; the acquisition module is used for acquiring the running index of the micro-service application according to the observability agent and generating a running log according to the running index; the visualization module is used for generating a visual view of the service link of the micro-service application according to the running log; and the analysis module is used for carrying out anomaly monitoring and anomaly analysis on the business link of the micro-service application according to the visual view.

Optionally, in a first implementation manner of the second aspect of the present invention, the registration module includes: an initialization unit, configured to embed an initialization code of an observability agent in a start code of a micro service application in advance, where the initialization code is executed simultaneously along with the start code of the micro service application, and register and start the observability agent at the same time; the configuration unit is used for acquiring a configuration file, and setting the monitoring range of the observability agent according to the configuration file.

Optionally, in a second implementation manner of the second aspect of the present invention, the acquisition module includes: the function setting unit is used for setting a hook function, embedding the hook function into a starting point and an ending point of a service link of the micro service application, and collecting operation indexes of the service link through the hook function; the data processing unit is used for carrying out data processing on the operation indexes and generating an operation log; and the log uploading unit is used for uploading the running log to the observability agent background.

Optionally, in a third implementation manner of the second aspect of the present invention, the log uploading unit includes: the cache subunit is used for starting a log uploading module of the independent thread and caching the running log through the memory queue; and the uploading subunit is used for asynchronously uploading the running log to the observability agent background in a preset mode through the log uploading module.

Optionally, in a fourth implementation manner of the second aspect of the present invention, the visualization module includes: the relation analysis unit is used for carrying out association analysis on the running logs and the feature fields of the micro-service application, and generating an analysis result by analyzing father-son relations among the running logs; and the view generation unit is used for generating a visual view of the service link of the micro service application according to the analysis result, wherein the visual view is an interactive monitoring view.

Optionally, in a fifth implementation manner of the second aspect of the present invention, the analysis module includes: the abnormal locking unit is used for presenting an abnormal service link through the visual view and selecting the abnormal service link to automatically lock an abnormal code; and the association analysis unit is used for carrying out association analysis on the parameter information of the abnormal code and the operation log, determining the reason of the abnormality and outputting an abnormality analysis report.

Optionally, in a sixth implementation manner of the second aspect of the present invention, the association analysis unit includes: an extraction subunit, configured to extract a running log corresponding to the abnormal code; and the analysis subunit is used for analyzing the timestamp of the abnormality in the operation log, analyzing the service link calling sequence before and after the timestamp and determining the abnormal service link.

A third aspect of the present invention provides an anomaly monitoring device for a micro-service application, comprising: a memory and at least one processor, the memory having computer readable instructions stored therein, the memory and the at least one processor being interconnected by a line; the at least one processor invokes the computer-readable instructions in the memory to cause the anomaly monitoring device of the micro-service application to perform the steps of the anomaly monitoring method of the micro-service application as described above.

A fourth aspect of the present invention provides a computer-readable storage medium having stored therein computer-readable instructions which, when run on a computer, cause the computer to perform the steps of the anomaly monitoring method of a microservice application as described above.

The beneficial effects are that: in the technical scheme of the invention, in the micro-service application starting stage, an observable agent is registered and started, and the micro-service application is monitored; collecting operation indexes of the micro service application according to the observability agent, and generating an operation log according to the operation indexes; generating a visual view of a service link of the micro-service application according to the running log; and according to the visual view, carrying out anomaly monitoring and anomaly analysis on the service link of the micro service application. The invention provides an anomaly monitoring method for a basic micro service application, which actively detects the internal execution flow of an application code when an observability agent runs, thereby breaking through the limitation of external monitoring, realizing the deep observation of the internal behavior of the application, rapidly judging the generation cause of a service problem and realizing the accurate positioning of the root cause of the problem.

Drawings

FIG. 1 is a first flowchart of an anomaly monitoring method for a micro-service application according to an embodiment of the present invention;

FIG. 2 is a second flowchart of an anomaly monitoring method for a micro-service application according to an embodiment of the present invention;

FIG. 3 is a third flowchart of an anomaly monitoring method for a micro-service application according to an embodiment of the present invention;

FIG. 4 is a fourth flowchart of an anomaly monitoring method for a micro-service application according to an embodiment of the present invention;

FIG. 5 is a fifth flowchart of an anomaly monitoring method for a micro-service application according to an embodiment of the present invention;

FIG. 6 is a sixth flowchart of an anomaly monitoring method for a micro-service application according to an embodiment of the present invention;

FIG. 7 is a seventh flowchart of an anomaly monitoring method for a micro-service application according to an embodiment of the present invention;

FIG. 8 is a schematic diagram of a configuration of an anomaly monitoring device for micro-service applications according to an embodiment of the present invention;

FIG. 9 is a schematic diagram of another configuration of an anomaly monitoring device for micro-service applications according to an embodiment of the present invention;

Fig. 10 is a schematic structural diagram of an anomaly monitoring device for micro service application according to an embodiment of the present invention.

Detailed Description

The embodiment of the invention provides an anomaly monitoring method, an anomaly monitoring device, anomaly monitoring equipment and an anomaly monitoring storage medium for a micro-service application, wherein an observable agent is registered and started in a micro-service application starting stage to monitor the micro-service application; collecting operation indexes of the micro service application according to the observability agent, and generating an operation log according to the operation indexes; generating a visual view of a service link of the micro-service application according to the running log; and according to the visual view, carrying out anomaly monitoring and anomaly analysis on the service link of the micro service application. The invention solves the problems that the abnormal positioning is difficult and the investigation efficiency is affected because the containerized application is based on micro-service splitting, the tracking and monitoring support of the service link level is insufficient, and the processing process of each micro-service can not be clearly seen.

The terms "first," "second," "third," "fourth" and the like in the description and in the claims and in the above drawings, if any, are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments described herein may be implemented in other sequences than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed or inherent to such process, method, article, or apparatus.

For easy understanding, the following describes a specific flow of an embodiment of the present invention, referring to fig. 1, and a first embodiment of an anomaly monitoring method for a micro service application in an embodiment of the present invention includes:

s101, registering and starting an observability agent in a micro-service application starting stage, and monitoring the micro-service application;

In this embodiment, observability refers to the ability to measure the current state of the system from system-generated output data (e.g., logs, metrics, and traces). The monitoring data of the micro-service application is collected, stored and presented through the observability agent by selecting a proper observability agent tool or platform, such as Prometheus, zipkin, jaeger, etc., the observability agent is integrated into the micro-service application by adding a dependency library, a configuration file or calling an API or a configuration file provided by the agent in the starting stage of the micro-service application, and then the monitoring endpoint or interceptor of the micro-service application is configured according to the requirement of the observability agent so that the agent can capture the monitoring data of the application. The observability agent automatically collects monitoring data, such as request amounts, response times, error rates, etc., for the micro-service application and stores the collected monitoring data in a designated storage medium, such as a database, a time series database, or a log file.

S102, acquiring operation indexes of the micro service application according to the observability agent, and generating an operation log according to the operation indexes;

in this embodiment, after a suitable observability agent tool or platform is selected according to requirements, operation indexes of the micro service application are collected and stored, the observability agent is integrated in the micro service application, and the operation indexes of the micro service application are collected according to requirements, wherein the operation indexes can include request amount, response time, error rate, CPU utilization rate, memory occupation and the like. The configured operation index is automatically collected through the observability agent, the observability agent can communicate with the micro-service application, operation index data is periodically obtained and recorded, the collected operation index data can be stored in a time sequence database arranged in the agent or sent to other storage media, such as ELASTICSEARCH, INFLUXDB, and the like, and an operation log is generated according to the collected operation index data through a log generation function of the observability agent, wherein the operation log can comprise a time stamp, request information, response information, error information and the like.

S103, generating a visual view of a service link of the micro service application according to the running log;

In this embodiment, for the collected running logs, a log parsing tool (such as Logstash, fluentd, ELK stack) or a custom code may be used to parse the running logs, extract key fields (such as request ID, timestamp, interface name, call link, etc.), and associate the running logs according to the key fields using a database query or a custom algorithm, combine related log records together to form a service link, and then convert the service link into a visual view using a data visualization tool (such as Graphviz, d3.Js, elastic search+ Kibana) or a custom code. The method comprises the steps of selecting proper chart types and interaction modes according to requirements, creating graphic elements (such as nodes and edges) to represent service links of the micro-service application, configuring data sources of charts, associating associated operation logs with the charts, realizing dynamic updating and interaction query, enabling query languages and visual interfaces to view and analyze the service links by users, and carrying out dynamic updating and interaction query according to the associated operation logs.

S104, according to the visual view, carrying out anomaly monitoring and anomaly analysis on the service link of the micro service application.

In this embodiment, firstly, an anomaly monitoring rule may be created according to a rule configuration function provided by a visualization tool, where the anomaly monitoring rule may be based on a key indicator (such as an error rate, a response time exceeding a threshold value, etc.) or a key event (such as a specific error code, specific anomaly information, etc.), the visualization tool may periodically check the operation condition of the service link according to the anomaly monitoring rule, and when the anomaly condition is found to be in accordance with the monitoring rule, the visualization tool may issue an alarm or trigger a corresponding action to perform feedback of the anomaly information. When an abnormal situation occurs, the method can use the context information provided by an abnormal monitoring rule to locate the position and reason of the occurrence of the problem, further track and analyze the detailed information of the abnormal situation by using the functions of log inquiry, index inquiry and the like, finally quickly determine the root cause of the abnormal problem according to the analysis result, feed back to a relevant team or developer to carry out quick problem tracking and locating so as to solve the abnormal problem, and continuously monitor whether the abnormal situation is improved after the abnormal problem is solved.

By way of example, a monitoring dashboard is first created at Kibana, and key indicators (e.g., error rates, response times) and key events (e.g., specific error codes, specific anomaly information) are selected as the basis for the monitoring rules. The thresholds or conditions of the monitoring rules are configured to trigger an alarm or action of the abnormal situation. Kibana periodically check the operation of the traffic link according to the monitoring rules. When the abnormal condition meets the monitoring rule, kibana will send out an alarm or trigger corresponding actions, such as sending a notification, calling Webhook, and the like for feedback. When an abnormal situation occurs, the query and analysis functions provided by Kibana are used for further analysis of the abnormal situation, for example, the query language (such as ELASTICSEARCH QUERY DSL) and the visual interface of Kibana are used for locating the position and the reason of the occurrence of the problem, and the functions of Kibana such as log query and index query are used for further tracking and analyzing the detailed information of the abnormal situation. According to the analysis result, the root cause of the abnormal problem is determined, after the abnormal problem is solved, whether the abnormal situation is improved is monitored, meanwhile, a user can monitor and analyze the abnormal situation by using a Kibana monitoring instrument panel and a query function, and the abnormal problem is solved according to the analysis result.

Referring to fig. 2, a second embodiment of an anomaly monitoring method for a micro service application according to an embodiment of the present invention includes:

S201, embedding an initialization code of an observability agent into a start code of a micro-service application in advance, wherein the initialization code is executed simultaneously along with the start code of the micro-service application, and simultaneously registering and starting the observability agent;

S202, acquiring a configuration file, and setting a monitoring range of the observability agent according to the configuration file.

In this embodiment, the initialization code of the observability agent is embedded in the start code of the micro service application in advance, and the initialization code is executed when the micro service application is started, and registers and starts the observability agent, which may be implemented by adding a corresponding initialization method in an entry class or a configuration class of the application, where the initialization method may be implemented by calling an API or a configuration related parameter provided by the agent, so that when the micro service application is started, the initialization code of the observability agent is executed, thereby ensuring normal registration and start of the agent. In the initialization code, a registration method provided by the observability agent is called, and the agent is registered to the micro-service application, so that the micro-service application starts to be monitored. And then acquiring a configuration file, setting a monitoring range of the observability agent according to the configuration file, analyzing the configuration file, and acquiring the monitoring range configuration of the observability agent. According to the format and structure of the configuration file, the configuration file is analyzed by using a corresponding analysis method or library, and the monitoring range configuration of the agent is defined and obtained, such as interfaces, services, indexes and the like needing to be monitored, and the monitoring range of the observability agent can be adjusted by calling an API or a method provided by the observability agent according to actual requirements. Wherein, setting the monitoring range of the agent can comprise adding monitoring indexes, defining monitoring rules, setting alarm thresholds and the like.

By way of example, an Observer may be used as an observability agent, and a Spring Boot framework may be used to develop micro-service applications. Firstly, embedding an initialization code of an Observer in a starting class of a micro-service application in advance, adding an initialization method initObserver in the starting class, and calling the initialization method provided by the Observer, such as Observer. Then, in the main () method of the startup class, a initObserver () method is called to ensure that the initialization code of the oxaser is executed simultaneously with the startup code of the application. In initObserver () method, calling the registration method provided by the oxaser, registering the oxaser into the micro-service application, and calling the starting method provided by the oxaser at the same time, so that the oxaser starts to monitor the micro-service application.

Acquiring a configuration file, setting a monitoring range of an overlay according to the configuration file, firstly acquiring the configuration file in a micro-service application, analyzing the configuration file by using a configuration file reading mechanism of a Spring Boot, such as reading application. In initObserver () method, calling an API or a method provided by the oxaser, and setting a monitoring range of the oxaser according to the obtained monitoring range configuration, where setting the monitoring range of the oxaser may include adding a monitoring index, defining a monitoring rule, setting an alarm threshold, and the like. Through the steps, the initialization code of the oxaser is embedded in the starting code of the micro-service application, and the monitoring range of the oxaser is set according to the configuration file. Thus, when the micro-service application is started, the Observer can automatically register and start, and monitor the application according to the monitoring range specified in the configuration file.

Referring to fig. 3, a third embodiment of an anomaly monitoring method for a micro service application according to an embodiment of the present invention includes:

S301, setting a hook function, embedding the hook function into a starting point and an ending point of a service link of the micro service application, and collecting operation indexes of the service link through the hook function;

S302, performing data processing on the operation indexes and generating an operation log;

S303, uploading the running log to an observability agent background.

In this embodiment, the hook function is a part of a message processing mechanism, by setting "hooks", all messages and events can be filtered at the system level, the messages which cannot be accessed under normal conditions are accessed, the nature of the hooks is a program for processing the system messages, the system call is used to suspend the hook function into the system to collect the messages or events, by setting the hook function at the starting point and the ending point of the service link of the micro service application, that is, the starting and ending positions of the service logic, mechanisms such as an AOP cut plane, an interceptor and the like provided by Spring Boot can be used, the hook function is inserted before and after the method is executed, the operation index is started to be collected at the starting point of the service link, for example, an API or a method provided by promethaus is called, and the operation index is stopped to be collected by calling the API or the method provided by promethaus at the ending point of the service link. And then, the collected operation index data is transmitted to a data processing module or method, in the data processing module or method, operations such as data cleaning, calculation, aggregation and the like are carried out according to requirements so as to generate a required operation log, wherein the operation log can comprise a time stamp, request information, response information, error information and the like, can be defined and formatted according to service requirements, calls an API (application program interface) or method provided by Prometaus, and uploads the generated operation log to the Prometaus, and the Prometaus stores the operation log in a built-in time sequence database for subsequent query and analysis. Through the steps, the hook function is set, the hook function is embedded into the starting point and the ending point of the service link of the micro service application, the operation index of the service link is collected through the hook function, the operation index is subjected to data processing, an operation log is finally generated, and the operation log is uploaded to Prometheus. In this way, the user can use the query language and the visual interface of Prometaheus to view and analyze the running index of the micro service application and the generated running log, and of course, other methods can be selected according to the actual requirements to set the hook function to achieve the same or similar effects besides the above embodiment.

Referring to fig. 4, a fourth embodiment of an anomaly monitoring method for a micro service application according to an embodiment of the present invention includes:

S401, starting a log uploading module of an independent thread, and caching the running log through a memory queue;

S402, asynchronously uploading the running log to the observability agent background through the log uploading module in a preset mode.

In this embodiment, a log uploading module of an independent Thread is started, running logs are cached through a memory queue and asynchronously uploaded to an observability agent according to a preset mode, and firstly, an independent Thread is created in a micro-service application and used for processing log uploading tasks, for example, threads are created and managed by using a Thread class or ExecutorService framework in Java. The method comprises the steps of using a memory queue to buffer running logs, creating a memory queue in a log uploading module for buffering the running logs, enabling the memory queue to be realized by using BlockingQueue in Java, such as LinkedBlockingQueue, adding the running logs to the memory queue, in a hook function of a service link, adding the generated running logs to the memory queue by calling an adding method of the memory queue, asynchronously uploading the running logs to an observability agent, starting a cycle in the log uploading module, continuously acquiring the running logs from the memory queue, and asynchronously uploading the acquired running logs to an agent background in a preset mode by using an API or a method provided by the observability agent.

For example, a logstack may be used as an observability agent, a Spring Boot framework is used to develop a micro-service application, an independent Thread is created in the micro-service application to process a log uploading task, threads are created and managed by using a Thread class or ExecutorService framework in Java, a memory queue is created in a log uploading module to cache the running log, the memory queue may be implemented by using LinkedBlockingQueue in Java, then in a hook function of a service link, the generated running log is added to the memory queue by calling a push () method of the memory queue, a loop is started in the log uploading module, the running log is continuously obtained from the memory queue, the running log is asynchronously uploaded to a logstack background in a preset manner by adding the running log to the memory queue in a hook function of the service link, and then the running log is asynchronously uploaded to the logstack from the memory queue, so that the running log can be uploaded to the log background in an asynchronous manner or the running log can be uploaded to the log background in a preset manner, or the running log can be uploaded to the log background in a preset manner every time, and the running log can be uploaded to a real-time table in a batch manner, for example, a real-time can be obtained, and the running log can be uploaded to the log in a real-time stage in a preset manner.

Referring to fig. 5, a fifth embodiment of an anomaly monitoring method for a micro service application according to an embodiment of the present invention includes:

s501, performing association analysis on the running logs and the feature fields of the micro-service application, and generating an analysis result by analyzing father-son relations among the running logs;

s502, generating a visual view of the service link of the micro service application according to the analysis result, wherein the visual view is an interactive monitoring view.

In this embodiment, a log logger may be set in the micro service application to ensure that the log includes specific feature fields, such as a request ID, a service name, a timestamp, etc., and these log data are stored in a centralized manner, and the feature fields related to the micro service application in the running log are determined according to the service requirement and the log content. Using log data, a parent-child relationship between log entries is established by parsing and analyzing characteristic fields therein, for example, by associating together logs of different services by request IDs, forming an overall link for business operations, or determining parent-child relationships between running logs based on specific identification fields or context information. The log analysis tool or the custom algorithm can be used for associating and organizing the running logs to construct a father-son relationship tree or graph, the data analysis tool, the machine learning algorithm and the like can be used for carrying out clustering, anomaly detection, performance evaluation and other analysis on the running logs to generate analysis results, and association analysis and statistical calculation are carried out according to the father-son relationship and the values of the characteristic fields.

One of the log-by-log association algorithms that can be implemented is as follows:

Input:

L: log collection to be correlated

Ln: nth log

F: feature field sets, e.g. f= { request ID, traceID, spanID }

Fk: kth feature field

Fei: characteristic value set of ith log Li

And (3) outputting:

r: associated log chain table

The algorithm flow is as follows: 1) Traversing L, and extracting fei, namely extracting a characteristic value subset of each log; 2) Comparing the feature value sets fei and fej of any two logs; 3) If fei and fej have a common characteristic value, then there is an association; 4) Adding the two logs into a linked list data structure of R to represent the calling relationship; 5) And finally returning R as a global association view.

Finally, a visual tool such as Grafana, kibana is used for generating a visual view of the service link of the micro-service application according to the analysis result, the visual view can display the service link and related indexes of the micro-service application in the form of a chart, a topological graph, a time sequence graph and the like, so that the visual view can display the dependency relationship among the micro-services and the whole flow of the service link, the visual view is designed into an interactive monitoring view, the interactivity is integrated, a user can check and analyze the running state and the performance index of the micro-service application through interactive operation, and the interactive monitoring view can support the functions of zooming, filtering, sequencing, highlighting and the like, so that the user can better understand and analyze the running condition of the service link.

Referring to fig. 6, a sixth embodiment of an anomaly monitoring method for a micro service application according to an embodiment of the present invention includes:

s601, displaying an abnormal service link through the visual view, and selecting the abnormal service link to automatically lock an abnormal code;

S602, carrying out association analysis on the parameter information of the abnormal code and the operation log, determining an abnormal reason, and outputting an abnormal analysis report.

In this embodiment, in the interactive monitoring view, an abnormal service link may be identified in the visual view according to the relationship between the analysis result and the service link, where different colors, shapes, labels, or other manners may be used to highlight the abnormal service link, and in the interactive monitoring view, a function of selecting the abnormal service link, such as clicking or dragging, is provided, when a user selects the abnormal service link, an abnormal code related to the service link is automatically locked, according to the locked abnormal code, parameter information and related operation logs thereof are acquired by using a log analysis tool, a database query, or other manners, and parameter information and operation logs of the abnormal code are associated. And finally, carrying out deep analysis on the parameter information and the operation log of the abnormal code based on the result of the association analysis. For example, the method such as data mining or machine learning may be used to find the cause of the abnormality, such as erroneous input, insufficient resources, network failure, etc., and generate an abnormality analysis report based on the result of the abnormality analysis. The anomaly analysis report may include, among other things, descriptions of the cause of the anomaly, scope of influence, solutions, etc., for reference and processing by a developer or an operation and maintenance person.

By way of example, grafana may be used as an observability agent and a Spring Boot framework may be used to develop micro-service applications. Creating an interactive monitoring view in Grafana, displaying a business link and related indexes of the micro-service application, identifying the abnormal business link in the visual view according to the relation between an analysis result and the business link, for example, using red to represent the abnormal link, providing a function of selecting the abnormal business link in the interactive monitoring view, for example, a user clicking the abnormal link to lock the abnormal code, automatically locking the abnormal code related to the business link when the user selects the abnormal business link, then acquiring parameter information and related operation log according to the locked abnormal code, correlating the parameter information and the operation log of the abnormal code, then performing in-depth analysis on the parameter information and the operation log of the abnormal code based on the result of the correlation analysis, and generating an abnormal analysis report, wherein the abnormal analysis report can comprise description, influence range, solution and the like of an abnormal cause, so that a developer or an operation and maintenance staff can refer and process the abnormal code, thereby facilitating quick response and solution of the developer or the operation and maintenance team, and providing useful information for future prevention.

Referring to fig. 7, a seventh embodiment of an anomaly monitoring method for a micro service application according to an embodiment of the present invention includes:

s701, extracting an operation log corresponding to the abnormal code;

S702, analyzing the timestamp of the abnormality in the operation log, analyzing the service link calling sequence before and after the timestamp, and determining the abnormal service link.

In this embodiment, an operation log corresponding to an abnormal code is extracted, for the code generating the abnormality, an abnormal occurrence identifier is usually thrown out, according to the abnormal code identifier, log filtering and extraction can be performed by using a log analysis tool, a custom script or the like, a log entry containing the abnormal code is screened from the operation log, a timestamp field in the log entry is analyzed, a timestamp generated by the operation log is obtained, and according to the timestamp, a service link calling sequence when the abnormality occurs is determined, for example, by analyzing information such as a request ID, a call stack and the like in the log, a service link calling sequence before and after the timestamp is determined. And judging the causal relationship before and after the problem occurs according to Context information such as code position parameters and the like by combining a log and a time axis, and finally determining other components or services in the abnormal service link according to the service link calling sequence and the position of the abnormal code.

By way of example, an elastic search can be used as a log storage and query tool, a Spring Boot framework can be used to develop a micro-service application, and a query language of the elastic search can be used to screen out log entries containing an exception code according to the identifier thrown by the exception code. The query operation can be executed by using tools such as a query API or Kibana of the elastic search, a log entry corresponding to the abnormal code is found in the extracted running log, a time stamp field in the log entry is analyzed, a time stamp of the running log for generating the abnormality is obtained, the log entries before and after the time stamp in the running log are queried according to the time stamp, the service link calling sequence is analyzed according to the request ID or other associated fields in the log, and the service link when the abnormality occurs is determined, so that a technician is helped to better locate and solve the abnormal problem in the micro-service application.

The foregoing describes a method for monitoring an anomaly of a micro service application in an embodiment of the present invention, and the following describes an anomaly monitoring device of a micro service application in an embodiment of the present invention, referring to fig. 8, an embodiment of the anomaly monitoring device of a micro service application in an embodiment of the present invention includes:

A registration module 50, configured to associate an observability agent in advance in a start stage of a micro service application, and when the micro service application is started, associate and register the observability agent and start the observability agent, so as to monitor the micro service application;

The collection module 60 is configured to collect operation indexes of the micro service application according to the observability agent, and generate an operation log according to the operation indexes;

A visualization module 70 for generating a visual view of the service link of the micro-service application according to the running log;

and the analysis module 80 is used for carrying out anomaly monitoring and anomaly analysis on the service link of the micro-service application according to the visual view.

In this embodiment, the agent actively detects the internal execution flow of the application code during running, so as to break through the limitation of external monitoring, realize deep observation of internal behavior of the application, quickly judge the cause of the service problem, and realize accurate positioning of the root cause of the problem.

Referring to fig. 9, another embodiment of an anomaly monitoring device for a micro service application according to an embodiment of the present invention includes:

A registration module 50, configured to associate an observability agent in advance in a start stage of a micro service application, and when the micro service application is started, associate and register the observability agent and start the observability agent, so as to monitor the micro service application;

The collection module 60 is configured to collect operation indexes of the micro service application according to the observability agent, and generate an operation log according to the operation indexes;

A visualization module 70 for generating a visual view of the service link of the micro-service application according to the running log;

and the analysis module 80 is used for carrying out anomaly monitoring and anomaly analysis on the service link of the micro-service application according to the visual view.

In this embodiment, the registration module 50 includes:

An initialization unit 501, configured to embed an initialization code of an observability agent in a start code of a micro service application in advance, where the initialization code is executed simultaneously along with the start code of the micro service application, and register and start the observability agent at the same time;

and the configuration unit 502 is configured to obtain a configuration file, and set a monitoring range of the observability agent according to the configuration file.

In this embodiment, the acquisition module 60 includes:

A function setting unit 601, configured to set a hook function, embed the hook function into a start point and an end point of a service link of the micro service application, and collect an operation index of the service link through the hook function;

the data processing unit 602 is configured to perform data processing on the operation index and generate an operation log;

and the log uploading unit 603 is configured to upload the running log to the observability agent background.

In this embodiment, the log uploading unit 603 includes:

The cache subunit 6031 is configured to start a log uploading module of an independent thread, and cache the running log through a memory queue;

And the uploading subunit 6032 is configured to asynchronously upload the running log to the observability agent background through the log uploading module according to a preset mode.

In this embodiment, the visualization module 70 includes:

A relationship analysis unit 701, configured to perform a relationship analysis on the running log and the feature field of the micro service application, and generate an analysis result by analyzing a parent-child relationship between the running logs;

And the view generating unit 702 is configured to generate a visual view of the service link of the micro service application according to the analysis result, where the visual view is an interactive monitoring view.

In this embodiment, the analysis module 80 includes:

An anomaly locking unit 801, configured to present an anomaly service link through the visual view, and select the anomaly code for automatically locking the anomaly service link;

And a correlation analysis unit 802, configured to perform correlation analysis on the parameter information of the anomaly code and the running log, determine an anomaly cause, and output an anomaly analysis report.

In this embodiment, the association analysis unit 802 includes:

An extraction subunit 8021, configured to extract a running log corresponding to the abnormal code;

the parsing subunit 8022 is configured to parse the timestamp of the occurrence of the anomaly in the running log, analyze the service link calling sequence before and after the timestamp, and determine an abnormal service link.

The invention provides an anomaly monitoring method of a micro-service application, which is characterized in that an observable agent is injected into the micro-service application, and the agent actively detects the internal execution flow of an application code during running, so that the limitation of external monitoring is broken through, the deep observation of the internal behavior of the application is realized, the generation cause of a service problem is rapidly judged, and the accurate positioning of the root cause of the problem is realized.

The foregoing detailed description of the abnormality monitoring device for the micro service application in the embodiment of the present invention from the point of view of the modularized functional entity is shown in fig. 8 and fig. 9, and the following detailed description of the abnormality monitoring device for the micro service application in the embodiment of the present invention from the point of view of hardware processing is shown.

fig. 10 is a schematic structural diagram of an anomaly monitoring device for a micro service application according to an embodiment of the present invention, where the anomaly monitoring device 10 for the micro service application may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 11 (e.g., one or more processors) and a memory 12, and one or more storage media 13 (e.g., one or more mass storage devices) storing application programs 133 or data 132. Wherein the memory 12 and the storage medium 13 may be transitory or persistent storage. The program stored in the storage medium 13 may include one or more modules (not shown), each of which may include a series of instruction operations in the anomaly monitoring device 10 for a micro-service application. Still further, the processor 11 may be configured to communicate with the storage medium 13 to execute a series of instruction operations in the storage medium 13 on the anomaly monitoring device 10 of the microservice application.

The microservice application anomaly monitoring device 10 may also include one or more power supplies 14, one or more wired or wireless network interfaces 15, one or more input output interfaces 16, and/or one or more operating systems 131, such as Windows Serve, mac OS X, unix, linux, freeBSD, and the like. It will be appreciated by those skilled in the art that the device structure shown in FIG. 10 is not limiting of the anomaly monitoring device 10 for micro-service applications and may include more or fewer components than shown, or may combine certain components, or a different arrangement of components.

The present invention also provides a computer readable storage medium, which may be a non-volatile computer readable storage medium, and may also be a volatile computer readable storage medium, in which instructions are stored that, when executed on a computer, cause the computer to perform the steps of the anomaly monitoring method for a micro-service application.

It will be clearly understood by those skilled in the art that, for convenience and brevity of description, the specific working process of the system or apparatus and unit described above may refer to the corresponding process in the foregoing method embodiment, which is not repeated herein.

The integrated units, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied essentially or in part or all of the technical solution or in part in the form of a software product stored in a storage medium, including instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a read-only memory (ROM), a random access memory (random access memory, RAM), a magnetic disk, or an optical disk, or other various media capable of storing program codes.

The above embodiments are only for illustrating the technical solution of the present invention, and not for limiting the same; although the invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (10)

1. The anomaly monitoring method for the micro service application is characterized by comprising the following steps of:

registering and starting an observability agent in a micro-service application starting stage, and monitoring the micro-service application;

Collecting operation indexes of the micro service application according to the observability agent, and generating an operation log according to the operation indexes;

Generating a visual view of a service link of the micro-service application according to the running log;

and according to the visual view, carrying out anomaly monitoring and anomaly analysis on the service link of the micro service application.

2. The method for monitoring the anomaly of the micro-service application according to claim 1, wherein the step of monitoring the micro-service application includes, in a micro-service application start-up phase, registering and starting up an observability agent at the same time:

Embedding an initialization code of an observability agent in a start code of a micro-service application in advance, wherein the initialization code is executed simultaneously along with the start code of the micro-service application, and simultaneously registers and starts the observability agent;

and acquiring a configuration file, and setting the monitoring range of the observability agent according to the configuration file.

3. The method for anomaly monitoring of a micro-service application according to claim 1, wherein the step of collecting the operation index of the micro-service application according to the observability agent and generating an operation log according to the operation index comprises:

Setting a hook function, embedding the hook function into a starting point and an ending point of a service link of the micro service application, and collecting operation indexes of the service link through the hook function;

Performing data processing on the operation indexes and generating an operation log;

And uploading the running log to an observability agent background.

4. The method of anomaly monitoring for a microservice application of claim 3 wherein the step of uploading the travel log to an observability agent background comprises:

starting a log uploading module of an independent thread, and caching the running log through a memory queue;

And asynchronously uploading the running log to the observability agent background in a preset mode through the log uploading module.

5. The method of anomaly monitoring for a micro-service application of claim 1, wherein the step of generating a visual view of a traffic link of the micro-service application from the running log comprises:

Performing association analysis on the running logs and the feature fields of the micro-service application, and generating an analysis result by analyzing father-son relations among the running logs;

and generating a visual view of the service link of the micro-service application according to the analysis result, wherein the visual view is an interactive monitoring view.

6. The anomaly monitoring method for a micro-service application according to claim 1, wherein the steps of anomaly monitoring and anomaly analysis for a traffic link of the micro-service application according to the visual view comprise:

presenting an abnormal service link through the visual view, and selecting the abnormal service link to automatically lock an abnormal code;

and carrying out association analysis on the parameter information of the abnormal code and the operation log, determining the reason of the abnormality, and outputting an abnormality analysis report.

7. The method for monitoring the anomaly of the micro-service application according to claim 6, wherein the step of performing the correlation analysis of the parameter information of the anomaly code and the operation log to determine the cause of the anomaly comprises:

extracting an operation log corresponding to the abnormal code;

Analyzing the timestamp of the abnormality in the operation log, analyzing the service link calling sequence before and after the timestamp, and determining the abnormal service link.

8. An anomaly monitoring device for a micro-service application, comprising:

the registration module is used for associating the observability agent in advance in the starting stage of the micro-service application, and the observability agent is associated and registered and started when the micro-service application is started, so that the micro-service application is monitored;

the acquisition module is used for acquiring the running index of the micro-service application according to the observability agent and generating a running log according to the running index;

The visualization module is used for generating a visual view of the service link of the micro-service application according to the running log;

And the analysis module is used for carrying out anomaly monitoring and anomaly analysis on the business link of the micro-service application according to the visual view.

9. An anomaly monitoring device for a microservice application, comprising a memory and at least one processor, the memory having computer readable instructions stored therein;

The at least one processor invoking the computer readable instructions in the memory to perform the steps of the anomaly monitoring method for a micro-service application of any one of claims 1-7.

10. A computer readable storage medium having computer readable instructions stored thereon, which when executed by a processor, implement the steps of the anomaly monitoring method for a micro-service application of any one of claims 1-7.