Katyusha's blog

1
package rca
2

3
import (
4
  "fmt"
5
  "time"
6

7
  "github.com/os2026/ebpf-rca/internal/collector"
8
  "github.com/os2026/ebpf-rca/internal/detector"
9
  "github.com/os2026/ebpf-rca/internal/schema"
10
)
11

12
// 单次平均耗时超过该值(微秒)判为"高耗时型"，否则为"高频型"。
13
const syscallHighLatUs = 1000.0
14

15
// BuildSyscallReport 将一次系统调用热点信号转换为结构化诊断报告。
16
func BuildSyscallReport(sig detector.SyscallSignal) schema.AnomalyReport {
17
  s := sig.Sample
18
  root, suggestion, confidence := classifySyscall(s)
19

20
  evidence := []schema.Evidence{
21
    {Type: "metric", Name: "syscall", Value: s.Syscall, Desc: "热点系统调用名"},
22
    {Type: "metric", Name: "calls_per_sec", Value: round2(s.CallsPerSec), Desc: "每秒调用次数"},
23
    {Type: "metric", Name: "avg_lat_us", Value: round2(s.AvgLatUs), Desc: "单次平均耗时(微秒)"},
24
    {Type: "metric", Name: "max_lat_us", Value: round2(s.MaxLatUs), Desc: "单次最大耗时(微秒)"},
25
    {Type: "metric", Name: "total_ms_per_sec", Value: round2(s.TotalMsPerSec),
26
      Desc: "每秒累计占用时间(毫秒)，反映累计耗时占比"},
27
  }
28

29
  return schema.AnomalyReport{
30
    AnomalyType: "系统调用热点",
31
    RelatedObject: schema.RelatedObject{
32
      Pid:  s.Pid,
33
      Comm: s.Comm,
34
    },
35
    KeyMetrics: map[string]interface{}{
36
      "syscall":          s.Syscall,
37
      "calls_per_sec":    round2(s.CallsPerSec),
38
      "avg_lat_us":       round2(s.AvgLatUs),
39
      "total_ms_per_sec": round2(s.TotalMsPerSec),
40
    },
41
    TimeWindow: schema.TimeWindow{
42
      Start: sig.WindowStart.UTC().Format(time.RFC3339),
43
      End:   sig.WindowEnd.UTC().Format(time.RFC3339),
44
    },
45
    SuspectedRootCause: root,
46
    Confidence:         confidence,
47
    EvidenceChain:      evidence,
48
    Suggestion:         suggestion,
49
  }
50
}
51

52
func classifySyscall(s collector.SyscallSample) (root, suggestion string, confidence float64) {
53
  if s.AvgLatUs >= syscallHighLatUs {
54
    return fmt.Sprintf("高耗时系统调用热点：%s 单次平均 %.0fµs，疑似阻塞型调用(如 fsync/慢 I/O/锁等待)",
55
        s.Syscall, s.AvgLatUs),
56
      fmt.Sprintf("排查 %s 的阻塞来源，合并/异步化该调用，降低同步等待", s.Syscall),
57
      0.88
58
  }
59
  return fmt.Sprintf("高频系统调用热点：%s 达 %.0f 次/秒，疑似忙轮询或调用未做批处理",
60
      s.Syscall, s.CallsPerSec),
61
    fmt.Sprintf("减少 %s 调用频次：改用事件通知(epoll)/批量读写/缓存，避免忙轮询", s.Syscall),
62
    0.85
63
}