CN114416560A - Program crash analysis aggregation method and system - Google Patents

Abstract

The present application discloses a program crash analysis and aggregation method, comprising: receiving program crash information of a user equipment; filtering the program crash information of the user equipment, and distributing the filtered program crash information; parsing the filtered program crash information to obtain tag; storing the filtered program crash information and the tag in a database for query, reading and/or aggregate analysis. In this application, the whole closed-loop process is realized through the above steps, which ensures the security of data, especially the security of program-sensitive data, and eliminates the hidden danger of "system unavailability" of external platforms; moreover, problems can be efficiently and accurately located and solved. Generate analysis reports.

Description

Program crash analysis aggregation method and system

technical field

The present application relates to the field of data processing, and in particular, to a program crash analysis and aggregation method, apparatus, computer device, and computer-readable storage medium.

Background technique

With the rapid development of Internet technology, more and more application software can be installed on the device. The differences of various platforms make users often experience online crashes when using the application software, and analyze them with the help of external platforms.

The existing program crash analysis aggregation platform has the following shortcomings: (1) poor data security; (2) vulnerable to the hidden danger of "system unavailability" from external platforms; (3) problem location and aggregation are inefficient and inaccurate.

SUMMARY OF THE INVENTION

In view of this, the purpose of the embodiments of the present application is to provide a program crash analysis aggregation method, apparatus, computer equipment, computer-readable storage medium, and program crash analysis aggregation system, which can solve the above problems.

An aspect of the embodiments of the present application provides a program crash analysis and aggregation method, including:

Receive program crash information from the user's device;

Filter the program crash information of the user equipment, and distribute the filtered program crash information;

Parse the filtered program crash information to get the label;

The filtered program crash information and the tag are stored in a database for query, reading and/or aggregate analysis.

Optionally, the filtering of the program crash information of the user equipment includes:

Filter the program crash information of the user equipment according to a plurality of preset fields;

Wherein, the multiple fields include basic fields and extended fields;

The extended field includes crash type, stack information, crash description, crash page, and device running state information at the time of crash.

Optionally, the label includes a first label and a second label, and the filtered program crash information includes stack information and crash description;

The parsed and filtered program crash information to obtain tags, including:

passing the stack information to the parsing layer, and parsing the stack information through the parsing layer to obtain the parsed stack information;

Generate a first label according to the parsed stack information;

generating a second tag according to the crash description;

writing the first tag and the second tag to the database;

Wherein, both the first tag and the second tag are associated with the program crash information in the database.

Optionally, generating the first label according to the parsed stack information includes:

Delete invalid information in the parsed stack information to obtain valid stack information associated with the program itself; wherein, the invalid information includes at least one or more of the following: information associated with the operating system, numbers; and

According to the valid stack information associated with the program itself, the first tag is obtained by calculation through a hash algorithm.

Optionally, the user equipment is an iOS device; the stack information is parsed by the parsing layer to obtain the parsed stack information, including:

Through the identifier and offset of the symbol table in the stack information, and the symbol table file for building the IPA, query the target function name;

Wherein, the offset is the difference between the address where the crash occurs and the preset reference address;

The function corresponding to the target function name is used to call the crashed object.

Optionally, the user equipment is an Android device; the stack information is parsed by the parsing layer to obtain the parsed stack information, including:

Through the obfuscation data in the stack information and the mapping file for building the APK, query the data before obfuscation;

Wherein, the obfuscated data is the class name when the program is running;

The pre-obfuscation data includes a target function name, and the function corresponding to the target function name is used to call the crashed object.

Optionally, also include:

Based on the first tag and the second tag, the program crash information of the preset period in the database is aggregated to obtain multiple aggregated data; each piece of data in the same aggregated data has the same first tag and/or the same second label;

generating an analysis result based on the plurality of aggregated data, the analysis result including one or more issues that caused the program to crash; and

The analysis report is sent to one or more target groups associated with the one or more questions.

Another aspect of the embodiments of the present application provides a program crash analysis and aggregation apparatus, including:

The receiving module is used to receive the program crash information of the user equipment;

a distribution module, used for filtering the program crash information of the user equipment, and distributing the filtered program crash information;

Parsing module, used to parse the filtered program crash information to get tags;

A storage module, configured to store the filtered program crash information and the tag in a database for query, reading and/or aggregate analysis.

Another aspect of the embodiments of the present application provides a computer device, the computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, when the processor executes the computer program Steps for implementing the program crash analysis aggregation method as described above.

Another aspect of the embodiments of the present application provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and the computer program can be executed by at least one processor, so that the at least one The processor performs the steps of the program crash analysis aggregation method as described above.

Another aspect of the embodiments of the present application provides a program crash analysis and aggregation system, including:

The data transport layer is used to receive the program crash information of the user equipment;

The data consumption layer is used to receive and filter the program crash information of the user equipment, and distribute the filtered program crash information;

The data cleaning layer is used to parse the filtered program crash information to get the tags;

The storage layer is used to store the filtered program crash information and the tag for query, reading and/or aggregate analysis.

Optionally, the data consumption layer is further used for:

Filter the program crash information of the user equipment according to a plurality of preset fields;

Wherein, the multiple fields include basic fields and extended fields;

The extended field includes crash type, stack information, crash description, crash page, and device running state information at the time of crash.

Optionally, the label includes a first label and a second label, and the filtered program crash information includes stack information and crash description;

The data cleaning layer is also used for:

passing the stack information to the parsing layer, and parsing the stack information through the parsing layer to obtain the parsed stack information;

Generate a first label according to the parsed stack information;

generating a second tag according to the crash description;

writing the first tag and the second tag to the storage layer;

Wherein, both the first tag and the second tag are associated with the program crash information at the storage layer.

Optionally, generating the first label according to the parsed stack information includes:

Delete invalid information in the parsed stack information to obtain valid stack information associated with the program itself; wherein, the invalid information includes at least one or more of the following: information associated with the operating system, numbers; and

According to the valid stack information associated with the program itself, the first tag is obtained by calculation through a hash algorithm.

Optionally, the user equipment is an iOS device; the stack information is parsed by the parsing layer to obtain the parsed stack information, including:

Through the identifier and offset of the symbol table in the stack information, and the symbol table file for building the IPA, query the target function name;

Wherein, the offset is the difference between the address where the crash occurs and the preset reference address;

The function corresponding to the target function name is used to call the crashed object.

Optionally, the user equipment is an Android device; the stack information is parsed by the parsing layer to obtain the parsed stack information, including:

Through the obfuscation data in the stack information and the mapping file for building the APK, query the data before obfuscation;

Wherein, the obfuscated data is the class name when the program is running;

The pre-obfuscation data includes a target function name, and the function corresponding to the target function name is used to call the crashed object.

Optionally, also includes an automatic diagnostic system for:

Based on the first tag and the second tag, the program crash information of the preset period in the storage layer is aggregated to obtain multiple aggregated data; each piece of data in the same aggregated data has the same first tag and/or the same 's secondary label; and

generating an analysis result based on the plurality of aggregated data, the analysis result including one or more issues that caused the program to crash; and

The analysis report is sent to one or more target groups associated with the one or more questions.

The program crash analysis aggregation method, apparatus, device, computer-readable storage medium, and program crash analysis aggregation system provided by this application include the following advantages:

(1) The entire closed-loop process is realized, which ensures the security of data, especially the security of program-sensitive data;

(2) Based on the closed-loop whole process, it no longer relies on the data management of the external platform, and eliminates the hidden danger of "system unavailability" of the external platform;

(3) Obtain tags by parsing the filtered program crash information, and store the tags in the database. Therefore, each piece of data in the database can be aggregated by tags, so that problems can be efficiently and accurately located and analyzed. Report.

Description of drawings

FIG. 1 schematically shows an architecture diagram of a program crash analysis and aggregation system according to Embodiment 1 of the present application;

Fig. 2 schematically shows the workflow of the automatic diagnosis system;

FIG. 3 schematically shows a flowchart of a program crash analysis and aggregation system according to Embodiment 2 of the present application;

Fig. 4 schematically shows the sub-flow chart of step S302 in Fig. 3;

Fig. 5 schematically shows the sub-flow chart of step S304 in Fig. 3;

Fig. 6 schematically shows a sub-flow chart of step S502 in Fig. 5;

Fig. 7 schematically shows a sub-flow chart of step S500 in Fig. 5;

Fig. 8 schematically shows another sub-flow chart of step S500 in Fig. 5;

FIG. 9 schematically shows a flowchart of new steps of the program crash analysis and aggregation method according to Embodiment 2 of the present application;

FIG. 10 schematically shows a block diagram of a program crash analysis and aggregation apparatus according to Embodiment 3 of the present application;

FIG. 11 schematically shows a schematic diagram of a hardware architecture of a computer device suitable for implementing a program crash analysis and aggregation method according to Embodiment 4 of the present application.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present application more clearly understood, the present application will be described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of this application.

It should be noted that the descriptions involving "first", "second", etc. in the embodiments of the present application are only for description purposes, and should not be understood as indicating or implying their relative importance or implicitly indicating the indicated technical features quantity. Thus, a feature delimited with "first", "second" may expressly or implicitly include at least one of that feature. In addition, the technical solutions between the various embodiments can be combined with each other, but must be based on the realization by those of ordinary skill in the art. When the combination of technical solutions is contradictory or cannot be realized, it should be considered that the combination of such technical solutions does not exist. , is not within the scope of protection claimed in this application.

In the description of the present application, it should be understood that the numerical labels before the steps do not identify the sequence of executing the steps, but are only used to facilitate the description of the present application and to distinguish each step, and therefore should not be construed as a limitation on the present application.

The applicant understands that:

The online crash problem generally relies on third-party platforms, such as Bugly, firbase..., and has the following problems:

1). Permissions cannot be converged. After some employees leave their jobs, they still have permission to view sensitive APP data.

2). The maintenance intensity gradually becomes lower, and the situation of "unable to resolve normally" will gradually appear.

3). Unable to customize the demand, the data of the three-party platform is too closed, and it is impossible to expand the business with normal consumption.

4). It is impossible to isolate the business, and the crash is a general market problem, and it is impossible to divide different problems into different businesses.

The purpose of this application is to provide a program crash analysis aggregation solution, which lies in the closed-loop process, the realization of stack analysis and aggregation, and the realization of the derivative product system. For the program crash analysis aggregation scheme, reference may be made to the following embodiments.

Example 1

As shown in FIG. 1 , an embodiment of the present application provides a program crash analysis and aggregation system, including:

(1) The data transmission layer 2 is used to receive program crash information of the user equipment.

The data transmission layer 2 can be implemented by the Kafka system or other message systems, and is used to receive program crash information from a large number of user terminals. Among them, the Kafka system is a distributed, partitioned, multi-copy, multi-subscriber, distributed log system based on zookeeper coordination (commonly used for web/nginx logs, access logs, message services, etc. The main application of the Kafka system is Scenarios include log collection systems and message systems.

As an example, the user equipment may be configured to report program crash information. Wherein, the user equipment may include mobile devices, tablet devices, laptop computers, smart devices (eg, smart watches, smart glasses), virtual reality headsets, gaming devices, set-top boxes, digital streaming devices, robots, in-vehicle terminals, smart TVs, E-book readers, MP4 (Moving Picture Experts Group Audio Layer IV) players, etc. The user equipment may run a Windows system, an Android (Android ^™ ) system, an iOS system, or the like. Users can install various application installation packages according to their needs, so as to obtain applications that implement various specific functions. The user equipment may be preset with a tracking program, and the tracking program may report program crash information.

Taking the reporting of program crash information from user equipment A as an example, a buried program can be implanted in user equipment A. Buried points, also known as event tracking (Event Tracking), can capture, process and send behaviors or events in the device. In the case of detecting that the program of the user equipment A crashes, the user equipment A may cache the crash information of the program into a local file. After the program is started again, the crash information is reported to the data transmission layer 2 . For example, it can be distributed to the Kafka system based on application performance management (Application Performance Management, APM) to execute according to the specified call chain.

(2) The data consumption layer 4 is used for receiving and filtering the program crash information of the user equipment, and distributing the filtered program crash information.

The data consumption layer 4 is responsible for the filtering and distribution of messages.

That is: obtain crash-related information from the data transmission layer 2, and pass the filtered "valid data" to the data cleaning layer 6.

As an optional embodiment, the data consumption layer 4 is further configured to: filter the program crash information of the user equipment according to a plurality of preset fields; wherein the plurality of fields include a basic field and an extension field; the extension Fields include crash type, stack information, crash description, crash page, and device operating state information at the time of the crash. The basic fields may include the following fields: crash occurrence time, device model, program version, system version, program release channel, and the like. The device running state information at the time of crash may include the following fields: crash memory information, CPU information, disk information, and the like. In this optional embodiment, by filtering out valid information that can be used for crash analysis, interference of invalid information and system load can be reduced.

(3) The data cleaning layer 6 is used to analyze the filtered program crash information to obtain the label.

The filtered program crash information includes stack information, crash description, and the like.

Wherein, the stack information is used to record and trace the function calling process, such as the function called when the program crashes. However, the stack information directly provided by the user equipment is not readable, so it needs to be parsed to obtain readable stack information. Further, the readable stack information is used to classify and label exceptions and problems. Therefore, each program crash information of the same type of problem can be determined through the label, which is convenient for query and management.

As an optional embodiment, the label includes a first label and a second label, and the filtered program crash information includes stack information and crash description;

The data cleaning layer 6 is also used for:

passing the stack information to the parsing layer, and parsing the stack information through the parsing layer to obtain the parsed stack information;

Generate a first label according to the parsed stack information;

generating a second tag according to the crash description;

writing the first tag and the second tag to the storage layer 8;

Wherein, both the first tag and the second tag are associated with the program crash information at the storage layer.

In the above-mentioned optional embodiment, the first label and the second label are configured for each piece of program crash information because of the following considerations: in some cases, the parsed stack information is empty, and a valid label cannot be set. Therefore, the first label is set. Two labels as a supplement. In addition, in the case where the first label and the second label are mutually authenticated, efficient polymerization is facilitated.

It should be noted that the first tag and the second tag may be hash values or values obtained based on other algorithms. The hash value is to map a longer piece of data (String) into a shorter piece of data through a hash algorithm (such as MD5, SHA-1), and this piece of small data is the hash value. The hash value is unique. For example, different crash descriptions have different corresponding hash values. The same crash description corresponds to the same hash value, so it can be used for subsequent classification and aggregation.

Different types of user equipment have different stack information, and several exemplary resolution methods are provided below.

As an optional embodiment, the user equipment is an iOS device; and parsing the stack information through the parsing layer to obtain the parsed stack information includes: using the identifier of the symbol table in the stack information and the Offset, and the symbol table file for constructing IPA, query the target function name; wherein, the offset is the difference between the address where the crash occurs and the preset reference address; wherein, the function corresponding to the target function name is used to call A crashed object appears.

After the iOS device builds the IPA (Apple program application file, iPhoneApplication), it will generate a side file dSYM symbol table file (each symbol table corresponds to a universal unique identification code uuid), which stores the function name + offset inside. After parsing the symbol table file, the mapping relationship information + uuid is stored in a database (such as MySQL).

When the stack information is obtained, the target function name is reversely checked from the MySQL database through the symbol table uuid+offset of the stack information (the address where the exception occurs - the base address calculation), that is, the feedback from the iOS device is quickly parsed. target function name.

As an optional embodiment, the user equipment is an Android device; and parsing the stack information through the parsing layer to obtain the parsed stack information includes: using the obfuscated data in the stack information and constructing an APK The mapping file, query the data before obfuscation; wherein, the obfuscated data is the class name when the program is running; wherein, the data before obfuscation includes the target function name, and the function corresponding to the target function name is used to call the crashed object.

After the Android device builds the APK (Android application package, Android application package), a by-product mapping file will be generated. The class name classname of the actual runtime of the installation package is the obfuscated data, for example: a.b.c.xx, x needs to pass the content in the mapping Perform reverse analysis. In this embodiment, the mapping file is parsed, and the mapping relationship obtained by the analysis is stored in a database (eg, MySQL).

When the stack information is obtained, for the obfuscated information, the pre-obfuscated data is extracted in the MySQL database to obtain the target function name by reverse checking, that is, the target function name fed back by the Android device can be quickly parsed.

As an optional embodiment, the generating the first label according to the parsed stack information includes: deleting invalid information in the parsed stack information to obtain valid stack information associated with the program itself; wherein the invalid The information includes at least one or more of the following: information and numbers associated with the operating system; and according to the valid stack information associated with the program itself, the first tag is obtained by calculating through a hash algorithm. Cleaning through the parsed stack information: (1) Filtering some binary offsets, as well as some numbers, system symbol table information and other floating noise data, can ensure that the first crash information corresponding to multiple program crash information caused by the same problem The tags (hash values) are the same, ensuring valid aggregation. (2) Clean up the information associated with the operating system, keep only the information associated with the program itself, and quickly troubleshoot the program itself.

It should be noted that, the data cleaning rules and parsing rules of the data cleaning layer 6 can be defined by configuration files. Moreover, various functions in the data cleaning layer 6 can be plug-in, so as to realize automatic customization and expansion of functions.

(4) The storage layer 8 is used to store the filtered program crash information and the tag for query, reading and/or aggregate analysis.

The storage layer 8 can be based on Elasticsearch, Clickhouse, Hive, MySQL, etc.

Among them, Elasticsearch is a search server based on Lucene, which provides a full-text search engine with distributed multi-user capabilities, based on a RESTful web interface. Starting from the requirements of OLAP scenarios, ClickHouse customized and developed a set of efficient columnar storage engine, and realized the functions of orderly data storage, primary key index, sparse index, data partition, master-standby replication and so on. Hive is a Hadoop-based data warehouse tool for data extraction, transformation, and loading. It is a mechanism for storing, querying, and analyzing large-scale data stored in Hadoop. MySQL is a relational database management system and one of RDBMS (Relational Database Management System: relational database management system) application software.

Each piece of data in the storage layer 8 includes: filtered program crash information, and tags (first tag, second tag).

Based on the label of each piece of data, each piece of data can be classified so that multiple pieces of data with the same label are aggregated.

The storage layer 8 can provide data services for third-party service platforms.

The third-party service platform can analyze the changing trend of crashes, and can query and locate certain types of problems.

In specific applications, the front-end page can display the changing trend of crashes, as well as query and locate a certain type of problem. The front-end page is also configured with multiple components, such as "Program Version", "System Version", "Device Model", "Network Type", "Crash Type", "Crash Page", "Process", "Thread", etc. components. Taking "system version" as an example, when the user triggers this component, each system version that has crashed will be listed, and the number and proportion of crashes of each system version will be analyzed and displayed. Moreover, the front-end page is further configured with a download component, through which the program crash information of the selected system version can be downloaded.

(5) Optionally, the system can also customize the automatic diagnosis system 10 .

The automatic diagnosis system 10 is configured to: perform classification and aggregation operations according to the label of each piece of data in the storage layer 8 .

As an example, the automatic diagnostic system 10 is used to:

Based on the first tag and the second tag, the program crash information of the preset period in the storage layer is aggregated to obtain multiple aggregated data; each piece of data in the same aggregated data has the same first tag and/or the same 's second label;

generating an analysis result based on the plurality of aggregated data, the analysis result including one or more issues that caused the program to crash; and

The analysis report is sent to one or more target groups associated with the one or more questions.

The automatic diagnosis system 10 can diagnose on-line or off-line. The online diagnosis refers to automatic detection and diagnosis based on real-time incremental data (eg, preset time period). The online diagnosis will not stop, the diagnosis range of the online diagnosis is large, and the content of the displayed information is also large. Offline diagnosis refers to automatic detection and diagnosis based on offline data. Through offline diagnosis, massive data can be processed asynchronously, which is suitable for full background analysis.

As shown in FIG. 2, the automatic diagnostic system 10 may be used to include:

When an abnormality occurs online, trigger the automatic diagnosis/analysis service;

The automatic diagnosis/analysis service pulls out a large amount of user data (full-link monitoring data, user logs or other data, where the full-link monitoring data may include program crash information) for abnormal time periods for automatic analysis, and obtains the analysis results;

An analysis report is generated based on the analysis result, and the analysis report is pushed to a target group, such as an instant messaging group.

Exemplarily, the analysis report may be as follows: "

Crash alert:

Application: XX device model

Version: 64700100

First trigger time: 2021-11-08 10:42:21

Current trigger time: 2021-11-0810:43:36

Sphere of influence:

In the last 5 minutes, a total of 166 users were affected, 75,067 users were activated, and the crash rate was 0.22%.

Problem location: (data in the last 5 minutes)

Sort by exception type

The proportion of the first type of abnormality: 90.70%;

The proportion of the second type of abnormality: 5.81%;

The proportion of the third type of abnormality: 1.16%;

Sort by crash info

The proportion of the first type of crash: 90.12%;

The proportion of the second type of crash: 5.81%;

…”.

In the above-mentioned embodiment, the analysis report can be sent to the corresponding target group according to the located problem, so as to realize business isolation. The crashes are all large-scale problems, and different problems can be divided into different groups.

In an exemplary embodiment, based on the storage layer 8, the business side alarm system, the stack analysis platform, and the like can also be customized. Among them, the stack analysis platform is used for stack analysis, ANR (Application Not Responding, application not responding) analysis, stall analysis, memory analysis, disk analysis, operating system analysis, and the like. On Android, the application is not responsive for a while, and the system displays a dialog to the user, which is called the ANR dialog. The user can choose to keep the program running or quit.

It should be noted that the above-mentioned layers are implemented by servers, such as rack servers, blade servers, tower servers or cabinet servers (including independent servers or server clusters composed of multiple servers).

In addition, the above-mentioned layers are connected through one or more networks. The one or more networks may include various network devices, such as routers, switches, multiplexers, hubs, modems, bridges, repeaters, firewalls, proxy devices and/or the like. One or more networks may also include physical links such as coaxial cable links, twisted pair cable links, fiber optic links, combinations thereof and/or the like, and may include wireless links such as cellular links , satellite links, Wi-Fi links and/or the like.

The data transmission layer 2 , the data consumption layer 4 , the data cleaning layer 6 , the storage layer 8 , and the automatic diagnosis system 10 are described in detail above.

The program crash analysis and aggregation system provided by the embodiments of the present application includes the following advantages:

(1) Through the internal chain of data transmission layer 2, data consumption layer 4, data cleaning layer 6, and storage layer 8, the closed-loop whole process is realized, thereby ensuring the security of data, especially the security of program-sensitive data;

(2) Due to the above closed-loop process, the data management of the external platform is no longer relied on, and the hidden danger of "system unavailability" of the external platform is eliminated;

(3) The data cleaning layer 6 updates the analysis rules in real time, and ensures the cleaning and effective analysis of the stack data through the data cleaning layer 6;

(4) The data processing function can be expanded through the customized automatic diagnosis system and the monitoring/alarm of the customized rules of the business line;

(5) It can be aggregated by tags, the degree of aggregation is high and accurate, and the problem can be located efficiently and accurately and an analysis report can be generated;

(6) According to the identified problems, the analysis report can be sent to the corresponding target group, so as to realize business isolation.

Embodiment 2

This embodiment provides a program crash analysis and aggregation method, and for details, refer to Embodiment 1.

FIG. 3 schematically shows a flowchart of a program crash analysis and aggregation method according to Embodiment 2 of the present application.

As shown in FIG. 3, the program crash analysis and aggregation method may include steps S300-S306, wherein:

Step S300, receiving program crash information of the user equipment.

Step S302, filtering the program crash information of the user equipment, and distributing the filtered program crash information.

Step S304, parsing the filtered program crash information to obtain a label.

Step S306: Store the filtered program crash information and the tag in a database for query, reading and/or aggregate analysis.

The program crash analysis and aggregation method provided by the embodiment of the present application includes the following advantages:

(1) The whole closed-loop process is realized through the above steps, which ensures the security of data, especially the security of program-sensitive data;

(2) Due to the above closed-loop process, the data management of the external platform is no longer relied on, and the hidden danger of "system unavailability" of the external platform is eliminated;

(3) Obtain tags by parsing the filtered program crash information, and store the tags in the database. Therefore, each piece of data in the database can be aggregated by tags, so as to efficiently and accurately locate the problem and generate an analysis report ;

(4) The data processing function can be expanded through the customized automatic diagnosis system and the monitoring/alarm of the customized rules of the business line.

As an optional embodiment, as shown in FIG. 4 , step S302 may be implemented by the following steps:

Step S400, filtering the program crash information of the user equipment according to a plurality of preset fields;

Wherein, the multiple fields include basic fields and extended fields;

The extended field includes crash type, stack information, crash description, crash page, and device running state information at the time of crash.

The basic fields may include the following fields: crash occurrence time, device model, program version, system version, program release channel, and the like. The device running state information at the time of crash may include the following fields: crash memory information, CPU information, disk information, and the like. In this optional embodiment, by filtering out valid information that can be used for crash analysis, the interference of invalid information and the system load can be reduced.

As an optional embodiment, the label includes a first label and a second label, and the filtered program crash information includes stack information and crash description;

As shown in Figure 5, step S304 can be implemented as follows:

Step S500, passing the stack information to the parsing layer, and parsing the stack information through the parsing layer to obtain the parsed stack information;

Step S502, generating a first label according to the parsed stack information;

Step S504, generating a second label according to the crash description;

Step S506, writing the first label and the second label into the database;

Wherein, both the first tag and the second tag are associated with the program crash information in the database.

In the above-mentioned optional embodiment, the configuration of the first label and the second label for each piece of program crash information is based on the following considerations: in some cases, the parsed stack information is empty, and a valid label cannot be set. Therefore, the first label is set. Two labels as a supplement. In addition, in the case where the first label and the second label are mutually authenticated, efficient polymerization is facilitated.

As an optional embodiment, as shown in FIG. 6 , step S502 may be implemented by the following steps:

Step S600, delete invalid information in the parsed stack information, and obtain valid stack information associated with the program itself; wherein, the invalid information includes at least one or more of the following: information and numbers associated with the operating system; and

Step S602, according to the valid stack information associated with the program itself, calculate and obtain the first tag through a hash algorithm.

The above cleaning of the parsed stack information: (1) Filtering some binary offsets, as well as some floating noise data such as numbers and system symbol table information, can ensure that multiple program crash messages corresponding to the same problem cause crashes. A tag (hash value) is the same, ensuring valid aggregation. (2) Clean up the information associated with the operating system, keep only the information associated with the program itself, and quickly troubleshoot the program itself.

As an optional embodiment, the user equipment is an iOS device; as shown in FIG. 7 , step S500 can be implemented as follows:

Step S700, query the target function name through the identifier and offset of the symbol table in the stack information, and the symbol table file of the construction IPA;

Wherein, the offset is the difference between the address where the crash occurs and the preset reference address;

The function corresponding to the target function name is used to call the crashed object.

When the stack information is obtained, through the symbol table uuid+offset of the stack information (the address where the exception occurs - the base address calculation), the target function name can be reversely checked from the MySQL database, and the information fed back by the iOS device can be effectively parsed. target function name.

As an optional embodiment, the user equipment is an Android device; as shown in FIG. 8 , step S500 can be implemented as follows:

Step S800, query the data before obfuscation through the obfuscated data in the stack information and the mapping file for building the APK;

Wherein, the obfuscated data is the class name when the program is running;

The pre-obfuscation data includes a target function name, and the function corresponding to the target function name is used to call the crashed object.

Specifically, when the stack information is obtained, for the obfuscated information, the pre-obfuscated data is extracted from the MySQL database, and the target function name is obtained by reverse checking, and the target function name fed back by the Android device can be effectively parsed.

As an optional embodiment, as shown in FIG. 9 , the method may further include:

Step S900, based on the first label and the second label, aggregate the program crash information of the preset time period in the database to obtain a plurality of aggregated data; each piece of data in the same aggregated data has the same first label and/or or the same second label;

Step S902, generating an analysis result based on the plurality of aggregated data, the analysis result including one or more problems causing the program to crash; and

Step S904, sending the analysis report to one or more target groups associated with the one or more questions.

In the above-mentioned optional embodiment, the analysis report can be sent to the corresponding target group according to the located problem, so as to achieve business isolation, and the crashes are all large-scale problems, and different problems can be divided into different groups .

Embodiment 3

FIG. 10 schematically shows a block diagram of a program crash analysis and aggregation apparatus according to Embodiment 3 of the present application. The program crash analysis and aggregation apparatus may be divided into one or more program modules, and the one or more program modules are stored in a storage medium and executed by one or more processors to complete the embodiments of the present application. The program modules referred to in the embodiments of the present application refer to a series of computer program instruction segments capable of performing specific functions. The following description will specifically introduce the functions of each program module in this embodiment.

As shown in FIG. 10 , the program crash analysis and aggregation apparatus 1000 may include:

A receiving module 1010, configured to receive program crash information of the user equipment;

a distribution module 1020, configured to filter the program crash information of the user equipment, and distribute the filtered program crash information;

A parsing module 1030, configured to parse the filtered program crash information to obtain a label;

The storage module 1040 is configured to store the filtered program crash information and the tag in a database for query, reading and/or aggregate analysis.

As an optional embodiment, the distribution module 1020 is further configured to:

Filter the program crash information of the user equipment according to a plurality of preset fields;

Wherein, the multiple fields include basic fields and extended fields;

The extended field includes crash type, stack information, crash description, crash page, and device running state information at the time of crash.

As an optional embodiment, the label includes a first label and a second label, and the filtered program crash information includes stack information and crash description;

The parsing module 1030 is also used for:

passing the stack information to the parsing layer, and parsing the stack information through the parsing layer to obtain the parsed stack information;

Generate a first label according to the parsed stack information;

generating a second tag according to the crash description;

writing the first tag and the second tag to the database;

Wherein, both the first tag and the second tag are associated with the program crash information in the database.

As an optional embodiment, the parsing module 1030 is further configured to:

Delete invalid information in the parsed stack information to obtain valid stack information associated with the program itself; wherein, the invalid information includes at least one or more of the following: information associated with the operating system, numbers; and

According to the valid stack information associated with the program itself, the first tag is obtained by calculation through a hash algorithm.

As an optional embodiment, the user equipment is an iOS device; the parsing module 1030 is further configured to:

Through the identifier and offset of the symbol table in the stack information, and the symbol table file for building the IPA, query the target function name;

Wherein, the offset is the difference between the address where the crash occurs and the preset reference address;

The function corresponding to the target function name is used to call the crashed object.

As an optional embodiment, the user equipment is an Android device; the parsing module 1030 is further configured to:

Through the obfuscation data in the stack information and the mapping file for building the APK, query the data before obfuscation;

Wherein, the obfuscated data is the class name when the program is running;

The pre-obfuscation data includes a target function name, and the function corresponding to the target function name is used to call the crashed object.

As an optional embodiment, the device further includes an analysis module for:

Based on the first tag and the second tag, aggregating the program crash information of the preset time period in the database to obtain multiple aggregated data; each piece of data in the same aggregated data has the same first tag and/or the same second label;

generating an analysis result based on the plurality of aggregated data, the analysis result including one or more issues that caused the program to crash; and

The analysis report is sent to one or more target groups associated with the one or more questions.

Embodiment 4

FIG. 11 schematically shows a schematic diagram of a hardware architecture of a computer device suitable for implementing a program crash analysis and aggregation method according to Embodiment 4 of the present application. In this embodiment, the computer device 10000 is a device that can automatically perform numerical calculation and/or information processing according to pre-set or stored instructions, for example, a mobile device, a tablet device, a laptop computer, a smart device (such as , smart watches, smart glasses), virtual reality headsets, gaming devices, set-top boxes, digital streaming devices, robots, in-vehicle terminals, smart TVs, e-book readers, MP4 (Moving Picture Experts Group Audio Layer IV) players, etc. As shown in FIG. 11 , the computer device 10000 at least includes but is not limited to: a memory 10010 , a processor 10020 , and a network interface 10030 that can communicate with each other through a system bus. in:

The memory 10010 includes at least one type of computer-readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory, etc. (SRAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), programmable read only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 10010 may be an internal storage module of the computer device 10000 , such as a hard disk or memory of the computer device 10000 . In other embodiments, the memory 10010 may also be an external storage device of the computer device 10000, such as a pluggable hard disk, a Smart Media Card (SMC for short), a Secure Digital (Secure Digital) device equipped on the computer device 10000 Digital, referred to as SD) card, flash memory card (Flash Card) and so on. Of course, the memory 10010 may also include both an internal storage module of the computer device 10000 and an external storage device thereof. In this embodiment, the memory 10010 is generally used to store the operating system and various application software installed in the computer device 10000, such as program codes of a program crash analysis and aggregation method, and the like. In addition, the memory 10010 can also be used to temporarily store various types of data that have been output or will be output.

In some embodiments, the processor 10020 may be a central processing unit (Central Processing Unit, CPU for short), a controller, a microcontroller, a microprocessor, or other data processing chips. The processor 10020 is generally used to control the overall operation of the computer device 10000 , such as performing control and processing related to data interaction or communication with the computer device 10000 . In this embodiment, the processor 10020 is configured to execute program codes or process data stored in the memory 10010 .

The network interface 10030, which may include a wireless network interface or a wired network interface, is typically used to establish a communication link between the computer device 10000 and other computer devices. For example, the network interface 10030 is used to connect the computer device 10000 with an external terminal through a network, and establish a data transmission channel and a communication link between the computer device 10000 and the external terminal. The network can be an intranet (Intranet), the Internet (Internet), a Global System of Mobile communication (GSM for short), a Wideband Code Division Multiple Access (WCDMA for short), a 4G network , 5G network, Bluetooth (Bluetooth), Wi-Fi and other wireless or wired networks.

It should be noted that FIG. 11 only shows a computer device having components 10010-10030, but it should be understood that implementation of all shown components is not required, and more or fewer components may be implemented instead.

In this embodiment, the program crash analysis and aggregation method stored in the memory 10010 can also be divided into one or more program modules and executed by one or more processors (the processor 10020 in this embodiment) to Complete this application.

Embodiment 5

This embodiment also provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the program crash analysis and aggregation method in the second embodiment are implemented.

In this embodiment, the computer-readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory ( ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Programmable Read-Only Memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the computer-readable storage medium may be an internal storage unit of a computer device, such as a hard disk or memory of the computer device. In other embodiments, the computer-readable storage medium may also be an external storage device of a computer device, such as a plug-in hard disk equipped on the computer device, a Smart Media Card (SMC for short), a secure digital ( Secure Digital, referred to as SD) card, flash memory card (Flash Card) and so on. Of course, the computer-readable storage medium may also include both an internal storage unit of a computer device and an external storage device thereof. In this embodiment, the computer-readable storage medium is generally used to store the operating system and various application software installed on the computer device, for example, the program code of the program crash analysis and aggregation method in the embodiment. In addition, the computer-readable storage medium can also be used to temporarily store various types of data that have been output or will be output.

Obviously, those skilled in the art should understand that each module or each step of the above-mentioned embodiments of the present application may be implemented by a general-purpose computing device, and they may be centralized on a single computing device, or distributed in multiple computing devices. network, they can optionally be implemented with program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, can be different from the The illustrated or described steps are performed in sequence, either by fabricating them separately into individual integrated circuit modules, or by fabricating multiple modules or steps of them into a single integrated circuit module. As such, the embodiments of the present application are not limited to any specific combination of hardware and software.

The above are only the preferred embodiments of the present application, and are not intended to limit the scope of the patent of the present application. Any equivalent structure or equivalent process transformation made by using the contents of the description and drawings of the present application, or directly or indirectly applied in other related technical fields , are similarly included within the scope of patent protection of this application.

Claims (17)

1. A program crash analysis aggregation method, comprising:

receiving program crash information of user equipment;

filtering the program crash information of the user equipment, and distributing the filtered program crash information;

analyzing the filtered program crash information to obtain a label; and

and storing the filtered program crash information and the label into a database for query, reading and/or aggregation analysis.

2. The program crash analysis aggregation method as recited in claim 1,

the filtering program crash information of the user equipment comprises:

filtering program crash information of the user equipment according to a plurality of preset fields;

wherein the plurality of fields include a base field and an extension field;

the extension field comprises a crash type, stack information, a crash description, a crash page and equipment running state information during crash.

3. The program crash analysis aggregation method of claim 1, wherein the tags comprise a first tag and a second tag, and wherein the filtered program crash information comprises stack information and a crash description;

the parsing the filtered program crash information to obtain a tag includes:

transmitting the stack information to an analysis layer, and analyzing the stack information through the analysis layer to obtain analyzed stack information;

generating a first label according to the analyzed stack information;

generating a second label according to the crash description;

writing the first tag and the second tag to the database;

wherein the first tag and the second tag are both associated with the program crash information at the database.

4. The program crash analysis aggregation method according to claim 3, wherein the generating a first tag according to the parsed stack information comprises:

deleting invalid information in the analyzed stack information to obtain valid stack information associated with the program; wherein the invalid information comprises at least one or more of: information, numbers associated with the operating system; and

and calculating the first label through a Hash algorithm according to the effective stack information associated with the program.

5. The program crash analysis aggregation method according to claim 3, wherein the user device is an iOS device; the analyzing the stack information through the analyzing layer to obtain analyzed stack information includes:

inquiring the name of the target function through the identifier and the offset of the symbol table in the stack information and the symbol table file of the IPA;

wherein the offset is the difference between the address where the crash occurs and a preset reference address;

and the function corresponding to the target function name is used for calling the object with the crash.

6. The program crash analysis and aggregation method according to claim 3, wherein the user equipment is an Android device; the analyzing the stack information through the analyzing layer to obtain analyzed stack information includes:

inquiring the data before confusion through the confusion data in the stack information and the mapping file for constructing the APK;

wherein the obfuscated data is a class name of the program when running;

and the data before confusion comprises a target function name, and a function corresponding to the target function name is used for calling the object with the crash.

7. The program crash analysis aggregation method according to any one of claims 3 to 6, further comprising:

aggregating the program crash information of the preset time period in the database based on the first label and the second label to obtain a plurality of aggregated data; each piece of data in the same aggregated data has the same first label and/or the same second label;

generating an analysis result based on the plurality of aggregated data, the analysis result including one or more problems that caused the program to crash; and

sending the analysis report into one or more target groups associated with the one or more issues.

8. A program crash analysis aggregation apparatus, comprising:

the receiving module is used for receiving program crash information of the user equipment;

the distribution module is used for filtering the program crash information of the user equipment and distributing the filtered program crash information;

the analysis module is used for analyzing the filtered program crash information to obtain a label;

and the storage module is used for storing the filtered program crash information and the label into a database for query, reading and/or aggregation analysis.

9. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor is configured to implement the steps of the program crash analysis aggregation method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, having stored thereon a computer program which is executable by at least one processor to cause the at least one processor to perform the steps of the program crash analysis aggregation method according to any one of claims 1 to 7.

11. A program crash analysis aggregation system, comprising:

the data transmission layer is used for receiving program crash information of the user equipment;

the data consumption layer is used for receiving and filtering the program crash information of the user equipment and distributing the filtered program crash information;

the data cleaning layer is used for analyzing the filtered program collapse information to obtain a label;

and the storage layer is used for storing the filtered program crash information and the label for inquiry, reading and/or aggregation analysis.

12. The program crash analysis aggregation system of claim 11, wherein the data consumption layer is further configured to:

filtering program crash information of the user equipment according to a plurality of preset fields;

wherein the plurality of fields include a base field and an extension field;

the extension field comprises a crash type, stack information, a crash description, a crash page and equipment running state information during crash.

13. The program crash analysis aggregation system of claim 11, wherein the tags comprise a first tag and a second tag, and wherein the filtered program crash information comprises stack information and a crash description;

the data cleaning layer is further configured to:

transmitting the stack information to an analysis layer, and analyzing the stack information through the analysis layer to obtain analyzed stack information;

generating a first label according to the analyzed stack information;

generating a second label according to the crash description;

writing the first tag and the second tag to the storage layer;

wherein the first tag and the second tag are both associated with the program crash information at the storage tier.

14. The program crash analysis and aggregation system of claim 13, wherein the generating a first tag from the parsed stack information comprises:

deleting invalid information in the analyzed stack information to obtain valid stack information associated with the program; wherein the invalid information comprises at least one or more of: information, numbers associated with the operating system; and

and calculating the first label through a Hash algorithm according to the effective stack information associated with the program.

15. The program crash analysis and aggregation system of claim 13, wherein the user device is an iOS device; the analyzing the stack information through the analyzing layer to obtain analyzed stack information includes:

inquiring the name of the target function through the identifier and the offset of the symbol table in the stack information and the symbol table file of the IPA;

wherein the offset is the difference between the address where the crash occurs and a preset reference address;

and the function corresponding to the target function name is used for calling the object with the crash.

16. The program crash analysis and aggregation system of claim 13, wherein the user device is an Android device; the analyzing the stack information through the analyzing layer to obtain analyzed stack information includes:

inquiring the data before confusion through the confusion data in the stack information and the mapping file for constructing the APK;

wherein the obfuscated data is a class name of the program when running;

and the data before confusion comprises a target function name, and a function corresponding to the target function name is used for calling the object with the crash.

17. The program crash analysis aggregation system of any one of claims 13-16, further comprising an automated diagnostic system to:

aggregating the program crash information of the storage layer in a preset time period based on the first label and the second label to obtain a plurality of aggregated data; each piece of data in the same aggregated data has the same first label and/or the same second label;

generating an analysis result based on the plurality of aggregated data, the analysis result including one or more problems that caused the program to crash; and

sending the analysis report into one or more target groups associated with the one or more issues.

Images