Katyusha's blog

1
package rca
2

3
import (
4
  "time"
5

6
  "github.com/os2026/ebpf-rca/internal/collector"
7
  "github.com/os2026/ebpf-rca/internal/detector"
8
  "github.com/os2026/ebpf-rca/internal/schema"
9
)
10

11
const memAvailFloor = 15.0
12

13
// BuildMemReport 将一次内存抖动信号转换为结构化诊断报告。
14
func BuildMemReport(sig detector.MemSignal) schema.AnomalyReport {
15
  snap := sig.Snapshot
16
  c := sig.Culprit
17
  root, suggestion, confidence := classifyMem(c)
18

19
  evidence := []schema.Evidence{
20
    {Type: "metric", Name: "mem_available_pct", Value: round2(snap.MemAvailablePct),
21
      Threshold: memAvailFloor, Desc: "可用内存占比持续低于阈值"},
22
    {Type: "event", Name: "kswapd_wakes", Value: snap.KswapdWakes,
23
      Desc: "窗口内 kswapd 后台回收唤醒次数"},
24
    {Type: "event", Name: "direct_reclaim_count", Value: c.DirectReclaimCount,
25
      Desc: "肇事进程窗口内直接回收次数(分配时被迫回收)"},
26
    {Type: "metric", Name: "direct_reclaim_ms", Value: round2(c.DirectReclaimMs),
27
      Desc: "肇事进程直接回收累计耗时"},
28
    {Type: "metric", Name: "major_fault", Value: c.MajFlt, Desc: "窗口内 major page fault 增量"},
29
    {Type: "metric", Name: "minor_fault", Value: c.MinFlt, Desc: "窗口内 minor page fault 增量"},
30
  }
31

32
  return schema.AnomalyReport{
33
    AnomalyType: "内存抖动",
34
    RelatedObject: schema.RelatedObject{
35
      Pid:  c.Pid,
36
      Comm: c.Comm,
37
    },
38
    KeyMetrics: map[string]interface{}{
39
      "mem_available_pct":    round2(snap.MemAvailablePct),
40
      "kswapd_wakes":         snap.KswapdWakes,
41
      "direct_reclaim_count": c.DirectReclaimCount,
42
      "major_fault":          c.MajFlt,
43
    },
44
    TimeWindow: schema.TimeWindow{
45
      Start: sig.WindowStart.UTC().Format(time.RFC3339),
46
      End:   sig.WindowEnd.UTC().Format(time.RFC3339),
47
    },
48
    SuspectedRootCause: root,
49
    Confidence:         confidence,
50
    EvidenceChain:      evidence,
51
    Suggestion:         suggestion,
52
  }
53
}
54

55
func classifyMem(c collector.MemProc) (root, suggestion string, confidence float64) {
56
  if c.DirectReclaimCount > 0 {
57
    return "业务进程持续申请内存触发直接回收(direct reclaim)，导致回收压力上升与内存抖动",
58
      "排查该进程的内存申请/泄漏；限制其内存(cgroup memory.high)，或扩容内存、降低工作集",
59
      0.9
60
  }
61
  if c.MajFlt > 0 {
62
    return "可用内存偏低且 major fault 升高，疑似工作集超出物理内存导致换入/回源磁盘",
63
      "评估扩容内存或减少常驻内存；检查是否缓存与业务内存竞争",
64
      0.75
65
  }
66
  return "系统可用内存持续偏低，存在 OOM 风险（未定位到单一肇事进程）",
67
    "检查整体内存分配与缓存占用，必要时调整 vm.* 参数或扩容内存",
68
    0.6
69
}