Katyusha's blog

1
package rca
2

3
import (
4
  "fmt"
5
  "time"
6

7
  "github.com/os2026/ebpf-rca/internal/collector"
8
  "github.com/os2026/ebpf-rca/internal/detector"
9
  "github.com/os2026/ebpf-rca/internal/schema"
10
)
11

12
// 队列深度超过该值视为"设备队列拥堵"。
13
const queueCongestionDepth = 16
14

15
// BuildIOReport 将一次 I/O 延迟抖动信号转换为结构化诊断报告。
16
func BuildIOReport(sig detector.IOSignal) schema.AnomalyReport {
17
  s := sig.Sample
18
  root, suggestion, confidence := classifyIO(s)
19

20
  evidence := []schema.Evidence{
21
    {Type: "metric", Name: "p99_lat_ms", Value: round2(s.P99LatMs), Threshold: queueP99Threshold,
22
      Desc: "请求完成时延 P99"},
23
    {Type: "metric", Name: "avg_lat_ms", Value: round2(s.AvgLatMs), Desc: "平均完成时延"},
24
    {Type: "metric", Name: "max_lat_ms", Value: round2(s.MaxLatMs), Desc: "最大完成时延"},
25
    {Type: "metric", Name: "iops", Value: round2(s.IOPS), Desc: "每秒完成请求数"},
26
    {Type: "metric", Name: "throughput_mbps", Value: round2(s.ThroughputMBps), Desc: "吞吐(MB/s)"},
27
    {Type: "metric", Name: "queue_depth", Value: s.QueueDepth, Desc: "当前在途请求数(队列深度)"},
28
  }
29

30
  return schema.AnomalyReport{
31
    AnomalyType: "I/O延迟抖动",
32
    RelatedObject: schema.RelatedObject{
33
      Device: s.DevName,
34
    },
35
    KeyMetrics: map[string]interface{}{
36
      "p99_lat_ms":      round2(s.P99LatMs),
37
      "avg_lat_ms":      round2(s.AvgLatMs),
38
      "max_lat_ms":      round2(s.MaxLatMs),
39
      "iops":            round2(s.IOPS),
40
      "throughput_mbps": round2(s.ThroughputMBps),
41
      "queue_depth":     s.QueueDepth,
42
    },
43
    TimeWindow: schema.TimeWindow{
44
      Start: sig.WindowStart.UTC().Format(time.RFC3339),
45
      End:   sig.WindowEnd.UTC().Format(time.RFC3339),
46
    },
47
    SuspectedRootCause: root,
48
    Confidence:         confidence,
49
    EvidenceChain:      evidence,
50
    Suggestion:         suggestion,
51
  }
52
}
53

54
// queueP99Threshold 仅用于证据展示（实际触发阈值由 detector 控制）。
55
const queueP99Threshold = 20.0
56

57
func classifyIO(s collector.IOSample) (root, suggestion string, confidence float64) {
58
  if s.QueueDepth >= queueCongestionDepth {
59
    return fmt.Sprintf("随机读写压力导致设备队列拥堵（队列深度 %d，队列过深）", s.QueueDepth),
60
      "降低并发/队列深度(iodepth)，或评估更高 IOPS 的存储；排查是否随机小块写密集",
61
      0.9
62
  }
63
  return "I/O 时延抖动，疑似热点设备访问集中或页缓存失效导致回源磁盘",
64
    "排查热点文件/设备访问模式，增大缓存命中或顺序化访问；必要时分散负载到多设备",
65
    0.78
66
}