The invention relates to an online service abnormity monitoring method. The method comprises the following steps that a service reliability experience module, a simulation terminal user access monitoring module and a local service end security agent assistive monitoring and reporting module, respectively intensively and widely sample needed all-level information and relative history online service information of a network layer, an operating system layer, an online Web system and application layer, a database layer and a file system layer which are related to online services, and then, according to sampling results, expert knowledge base information and user feedback base information, determines whether an abnormal event is generated, transmits a determination result to an event management server, an expert feedback module and a user feedback module; and if an abnormal event is generated, a post hoc log analysis and remote local end linked module automatically analyzes every system log, and the event management server gives alarms or displays monitoring results according to analysis results. Compared with the prior art, the method and the system are comprehensive, and have the advantages of high accuracy, high adaptability and the like.