Server running state monitoring method and system and medium

Abstract

The invention relates to the technical field of computers, in particular to a server running state monitoring method and system and a medium. The method comprises the steps of obtaining time sequence operation and maintenance data of a system service; the method comprises the following steps: mapping an unstructured log text into a low-dimensional dense text vector by adopting an embedded learning method, splicing the text vector and a standardized numerical vector of a structured index to obtain a unified high-dimensional feature vector, and forming a cross-time vector database; constructing an AI model used for time sequence prediction, anomaly detection and cascade reasoning of classification decision based on a multi-model fusion architecture; training the AI model based on the vector database; and inputting the real-time feature vector into the trained AI model, and outputting to obtain a decision result of the system service operation state. Uniform expression of cross-modal features is effectively realized, cascade model architecture design is cooperated, the dynamic adjustment capability of the model and the accuracy of composite fault detection are improved, and rapid decision-making of fault types is realized.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a server operation status monitoring method, system and medium. Background Art

[0002] In the field of software engineering, the operational status of computer system servers has always been a difficult problem to track and monitor in real time. How to efficiently monitor system operational status is a constant concern for every IT software engineer. Although numerous system monitoring tools exist on the market, most are limited to rigidly detecting preset indicators and fail to fully capture the true operational status of the system. Furthermore, with the rapid development of information technology, modern software systems are becoming increasingly complex, involving a surge in the number of components and services. Traditional monitoring methods are no longer sufficient. Therefore, exploring more intelligent and flexible operational status monitoring methods has become crucial.

[0003] To this end, data-driven intelligent operation and maintenance methods have emerged. At present, the existing technology is committed to studying the use of artificial intelligence algorithms such as machine learning to automatically learn and summarize rules from massive operation and maintenance data, and to automatically process and predict faults for data of different modalities, so as to achieve intelligent management and maintenance of large-scale system services. For example, Chinese patent CN118656741A, an intelligent operation and maintenance method based on time series data, combines the contrast representation learning method of the dual-branch self-attention network with a multimodal fault detection model based on the isolation forest algorithm to achieve automatic processing and fault prediction of data of different modalities on the basis of unlabeled training data, reduce the cluster's dependence on manual operation and maintenance, improve the efficiency and accuracy of fault handling, and at the same time, by combining offline and online detection, it can adapt to the dynamic nature of software services and achieve real-time fault detection. However, the existing technology still has the following technical problems:

[0004] 1. Existing technologies usually use a separate processing method for heterogeneous data preprocessing of performance data and log data (for example, in this patent, performance data is divided into database / system data and differential features are constructed for log data), which makes it difficult to achieve deep correlation of multimodal data.

[0005] 2. Existing technologies have technical defects in their static and single-minded architecture for intelligent operation and maintenance decision-making models. For example, the patent uses a fixed combination of dual-branch contrastive learning (performance data) and isolation forest (log data), lacking dynamic adjustment capabilities. Its multimodal model is simply integrated (such as splicing with Alibaba's large language model in step S4), resulting in a split detection of sudden anomalies (such as CPU spikes) and periodic failures (such as database connection leaks). It displays failure modes through unsupervised clustering, resulting in a delayed response defect. Summary of the Invention

[0006] In response to the above technical problems, the present invention proposes a server operation status monitoring method, system and medium, aiming to effectively realize the unified expression of cross-modal features, so that the AI ​​model can capture the multi-dimensional correlation of the system status, coordinate the hierarchical cascade architecture design of the AI ​​model, improve the dynamic adjustment capability of the model and the accuracy of compound fault detection, and realize rapid decision-making on the fault type.

[0007] In a first aspect, the present application provides a method for monitoring the operation status of a server, comprising the following steps:

[0008] Obtain historical time-series operation and maintenance data of system services and collect time-series operation and maintenance data in real time. The time-series operation and maintenance data includes unstructured log text and structured indicators;

[0009] Embedding learning method is used to map unstructured log text into low-dimensional dense text vectors;

[0010] The text vector and the standardized numerical vector of the structured index are concatenated to obtain a unified high-dimensional feature vector, which is recorded as the historical feature vector and the real-time feature vector respectively.

[0011] Store historical feature vectors and real-time feature vectors together to form a vector database across time periods;

[0012] Building an AI model based on a multi-model fusion architecture, which is used for cascade reasoning of time series prediction, anomaly detection, and classification decisions;

[0013] Train the AI ​​model based on the vector database to obtain a trained AI model;

[0014] The real-time feature vector is input into the trained AI model, and the real-time analysis and prediction results of the system service operation status are output.

[0015] In some embodiments, the AI ​​model built based on the multi-model fusion architecture includes:

[0016] Time series forecasting model, used to predict resource usage trends based on historical feature vectors as a dynamic baseline for anomaly detection;

[0017] An anomaly detection model is used to identify the deviation between the input real-time feature vector and the dynamic baseline output by the time series prediction model to output an anomaly feature vector;

[0018] The classification decision model is used to determine the fault type based on the abnormal feature vector output by the anomaly detection model.

[0019] In some embodiments, predicting resource usage trends based on historical feature vectors to serve as a dynamic baseline for anomaly detection includes:

[0020] Based on historical feature vectors, the Prophet algorithm is used to decompose the periodicity, trend and holiday effects of the time series, predict and generate a dynamic baseline for the future time window, and pass it to the anomaly detection model.

[0021] In some embodiments, the time series prediction model includes a Transformer module, a TCN module, a feature fusion layer and a fully connected network, wherein the input of the Transformer module is a historical feature vector, the output of the Transformer module is a long-term semantic coding vector, the input of the TCN module is a real-time feature vector, the output of the TCN module is a short-term event coding vector, the input of the feature fusion layer is the long-term semantic coding vector output by the Transformer module and the short-term event coding vector output by the TCN module, the feature fusion layer is used to perform spatiotemporal alignment on the two types of input vectors and dynamically allocate weights through a gated attention mechanism to output a fused feature vector, the input of the fully connected network is the fused feature vector, the output of the fully connected network is the dynamic baseline of the future time window, and the dynamic baseline of the future time window is passed to the anomaly detection model.

[0022] In some embodiments, identifying a deviation between an input real-time feature vector and a dynamic baseline output by a time series prediction model to output an abnormal feature vector includes:

[0023] Based on the real-time feature vector input and the dynamic baseline output by the time series prediction model, the reconstruction error is calculated using the encoding-decoding structure of AutoEncoder;

[0024] The real-time feature vector is scored for abnormality based on the reconstruction error to obtain the abnormal feature vector, which is then passed to the classification decision model.

[0025] In some embodiments, determining the fault type based on the abnormal feature vector output by the abnormality detection model includes:

[0026] Obtain a fault sample database;

[0027] Based on the fault sample database and the abnormal feature vectors output by the anomaly detection model, the XGBoost integrated learning mechanism is used to make decisions, output the probability distribution of fault types and the root cause location results, and feed back high-frequency fault types to the time series prediction model for optimization.

[0028] In some embodiments, the AI ​​model is trained based on the vector database to obtain a trained AI model, including:

[0029] Divide the feature vectors in the vector database into a training set and a test set in proportion, with the test set's time sequence being closer than the training set's;

[0030] Train the AI ​​model based on the training set to obtain a trained AI model;

[0031] The trained AI model is verified and optimized based on the test set to obtain the final AI model.

[0032] In some embodiments, the AI ​​model is trained based on the training set to obtain a trained AI model, including:

[0033] Based on high-frequency fault types and time series distribution, an incremental learning method is used to construct a dynamic training set;

[0034] The AI ​​model is iteratively trained based on a dynamic training set, generating an optimized new model version for each iteration, and retaining several historical model versions for rapid version rollback when historical faults recur.

[0035] In a second aspect, the present application provides a server operation status monitoring system, comprising:

[0036] A data acquisition module is used to obtain historical time-series operation and maintenance data of system services and collect time-series operation and maintenance data in real time. The time-series operation and maintenance data includes unstructured log text and structured indicators;

[0037] The cross-modal fusion module uses an embedding learning method to map unstructured log text into a low-dimensional dense text vector. It then concatenates the text vector with the standardized numerical vector of the structured indicator to obtain a unified high-dimensional feature vector, which is recorded as a historical feature vector and a real-time feature vector.

[0038] A database formation module is used to store historical feature vectors and real-time feature vectors together to form a vector database across time periods;

[0039] An AI model building module, which is used to build an AI model based on a multi-model fusion architecture. The AI ​​model is used for cascade reasoning of time series prediction, anomaly detection, and classification decisions;

[0040] The model training module is used to train the AI ​​model based on the vector database to obtain the trained AI model;

[0041] The real-time operation and maintenance decision module is used to input real-time feature vectors into the trained AI model and output real-time analysis and prediction results of the system service operation status.

[0042] In a third aspect, a computer-readable storage medium stores a computer program, which, when executed by a processor, implements the aforementioned method for monitoring the operation status of a server.

[0043] The beneficial technical effects of the present invention include at least:

[0044] 1. A server operation status monitoring method, system, and medium are used to design a joint feature generation mechanism for heterogeneous data sources. By embedding and fusing unstructured log text with structured indicators, this effectively achieves unified cross-modal feature expression, addressing the existing technology's flaw of separate analysis of text logs and numerical indicators. This enables the AI ​​model to capture multi-dimensional correlations between system status, helping to improve the detection accuracy of complex faults. The innovative design of the AI ​​model's "time series prediction-anomaly detection-classification decision" cascade reasoning enables full-process collaboration from trend prediction to accurate fault decision-making, improving the dynamic adjustment capabilities of the AI ​​model while enabling rapid decision-making on fault types.

[0045] 2. The existing technology usually adopts a separate processing method for heterogeneous data preprocessing of performance data and log data (such as dividing performance data into database / system data and constructing differential features for log data), which makes it difficult to achieve deep correlation of multimodal data. To this end, this application designs a joint feature generation mechanism for heterogeneous data sources, which combines embedding learning in natural language processing (NLP field) with time series prediction (TSA field), and maps unstructured log text and structured indicators to a unified vector space through vector space alignment technology, so that subsequent AI models can recognize cross-modal association patterns. For example, when "connection pool exhausted" appears in the semantic vector, if the normalized value of the number of active connections is detected to exceed the preset threshold at the same time, the abnormal confidence of "database connection pool exhaustion" is automatically enhanced, thereby breaking through the limitations of the existing technology of separate analysis of text logs and numerical indicators, and significantly improving the detection accuracy of complex faults;

[0046] 3. Existing technologies have static and single technical defects in the architecture of intelligent operation and maintenance decision-making models. For example, they use a fixed combination of dual-branch contrastive learning (performance data) and isolation forest (log data), lacking dynamic adjustment capabilities. Their multimodal models are only simply integrated (such as splicing with Alibaba's large language model in the S4 step), resulting in a split in the detection of sudden anomalies (such as CPU spikes) and periodic failures (such as database connection leaks). They display failure modes through unsupervised clustering, resulting in a delayed response defect. To this end, the present application creatively constructs a three-level linkage AI model architecture to achieve full-process collaboration from trend prediction to accurate fault decision-making. Specifically, first, dynamic baseline generation and trend prediction are performed through the time series prediction model to provide a dynamic baseline for anomaly detection. Then, the anomaly detection model identifies real-time deviations and anomaly markers based on the predicted baseline, overcoming the false alarm problem caused by static thresholds in the existing technology. Finally, the classification decision model distinguishes the fault type and locates the root cause based on the abnormal feature vector, avoiding the delayed response defect of the unsupervised clustering display fault mode in the existing technology, and realizing the full-link fault processing from "trend prediction → real-time anomaly detection → rapid fault decision", thereby greatly improving the dynamic adjustment capability of the model while achieving rapid decision-making on the fault type, significantly improving operation and maintenance efficiency and fault detection accuracy;

[0047] 4. Existing technologies (such as the combination of isolation forest and random forest) lack the ability to collaboratively analyze local and global cyclical features of time series. Traditional threshold setting relies on manual experience or static statistics (3-sigma principle). To this end, this application designs a Transformer-TCN hybrid model to achieve dynamic baseline generation and threshold adaptation for early warning indicators. Through the dual-path prediction baseline of TCN capturing sudden spikes and Transformer capturing cyclical trends, dynamic threshold adjustment is achieved. This "global + local" dual perspective is more suitable for the temporal and spatial characteristics of system loads.

[0048] 5. The existing technology usually only uses samples within 3 months and the weight index of old samples decreases, which easily causes the model to forget historical key patterns. For this reason, this application adopts an incremental learning strategy to collaboratively optimize the model, while reducing the computational overhead and avoiding the model degradation problem of the existing technology, thereby ensuring the fault detection accuracy of the model to a certain extent.

[0049] Other features and advantages of the present invention will be disclosed in detail in the following specific embodiments and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The present invention will be further described below with reference to the accompanying drawings:

[0051] Figure 1A flow chart of a method for monitoring server operating status provided by an embodiment of the present invention.

[0052] Figure 2 A schematic diagram of the structure of a server operation status monitoring system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The following is an explanation and description of the technical solutions of the embodiments of the present invention in conjunction with the drawings of the embodiments of the present invention. However, the following embodiments are only preferred embodiments of the present invention and are not exhaustive. Based on the embodiments in the implementation manner, other embodiments obtained by those skilled in the art without creative work are all within the scope of protection of the present invention.

[0054] In the following description, terms such as "inside", "outside", "up", "down", "left", "right", etc. that indicate directions or positional relationships are only used to facilitate the description of the embodiments and simplify the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operate in a specific direction. Therefore, they should not be understood as limiting the present invention.

[0055] Example 1:

[0056] See also Figure 1 , Figure 1 The present invention provides a flow chart of a method for monitoring the operation status of a server according to an embodiment of the present invention.

[0057] like Figure 1 As shown, the server operation status monitoring method may include at least the following steps:

[0058] Step 101: Obtain historical time series operation and maintenance data of system services and collect time series operation and maintenance data in real time. The time series operation and maintenance data includes unstructured log text and structured indicators.

[0059] Specifically, this embodiment can collect multi-dimensional time-series operation and maintenance data from a distributed service cluster of a computer system, which may include the following types of data:

[0060] 1. Metadata: timestamp, service unique identifier, instance identifier, environment tag, component type (system, microservice, middleware, database);

[0061] 2. Hardware / network metrics: CPU usage, memory, disk I / O operations per second, network latency, and QPS;

[0062] 3. Database: number of active database connections, slow SQL, lock status, and backup strategy;

[0063] 4. Redis: memory fragmentation rate, hit rate, and persistence status;

[0064] 5. Container metrics: Pod current status, current number of replicas, set number of replicas, number of container restarts, and persistent volume usage;

[0065] 6. System audit: number of logins, IP, operation role, and whether it is a sensitive operation.

[0066] Furthermore, the data source can be accurately identified through metadata labeling, such as adding environment labels (production / test / pre-release), component types (microservices / database / middleware), and timestamps to each service instance to ensure data traceability.

[0067] Step 102: Use an embedding learning method to map the unstructured log text into a low-dimensional dense text vector.

[0068] Specifically, in this embodiment, the embedding learning method is used to map unstructured log text into a low-dimensional dense text vector in the following manner:

[0069] The unstructured log text is decomposed into semantic units through the word segmentation model (such as "Database connection timeout" is decomposed into "Database", "connection", and "timeout"). After filtering out common stop words (such as "failed" and "error"), a hierarchical embedding model based on log corpus pre-training is adopted. This model captures contextual associations (such as the differentiated semantics of "connection timeout" in the database and network modules) through a bidirectional attention mechanism, thereby generating a low-dimensional dense semantic vector (such as 128 dimensions) while retaining key entity information (such as error code, service name, etc.).

[0070] At the same time, the structured indicators in this embodiment need to be converted into numerical vectors through dynamic grouping and normalization operations, which can be achieved in the following ways:

[0071] Divide indicator data groups (such as production environment database clusters) according to component type and environment label. Calculate the mean and variance within the sliding window for each data group. Perform Z-Score normalization to eliminate dimensional differences and retain relative fluctuation characteristics (such as mapping CPU usage from the original value [30%, 85%] to the range [-1.2, 1.8]). This results in a standardized numerical vector of structured indicators.

[0072] Step 103: Concatenate the text vector and the normalized numerical vector of the structural index to obtain a unified high-dimensional feature vector, which are recorded as a historical feature vector and a real-time feature vector respectively;

[0073] Specifically, in this embodiment, the text vector and the numerical vector of the structured index after normalization are concatenated to obtain a unified high-dimensional feature vector in the following manner:

[0074] The two types of data are unified to the same time granularity (for example, aggregated by 1-second windows) through the spatiotemporal alignment engine, and metadata tags (such as service instance ID, timestamp, etc.) are used for precise matching. Finally, the text semantic vector and the standardized numerical vector are spliced ​​in the feature dimension to form a joint high-dimensional feature vector (such as 128 dimensions for text + 20 dimensions for indicators = 148 dimensions).

[0075] Understandably, existing technologies typically use a separate approach to preprocess heterogeneous performance and log data (e.g., Chinese patent CN118656741A, which separates performance data into database and system data and constructs differential features for log data), making it difficult to achieve deep correlation of multimodal data. To address this, this embodiment designs a joint feature generation mechanism for heterogeneous data sources. This mechanism combines embedding learning in natural language processing (NLP) with time series forecasting (TSA). Using vector space alignment technology, unstructured log text and structured metrics are mapped into a unified vector space, enabling subsequent AI models to identify cross-modal correlation patterns. For example, when the term "connection pool exhausted" appears in a semantic vector, if the normalized value of the number of active connections exceeds a preset threshold, the confidence level of the "database connection pool exhausted" anomaly is automatically increased. This overcomes the limitations of existing technologies that separate the analysis of text logs and numerical metrics, significantly improving the detection accuracy of complex faults.

[0076] In step 104 , the historical feature vectors and the real-time feature vectors are stored together to form a vector database spanning time periods.

[0077] Step 105: Build an AI model based on a multi-model fusion architecture. The AI ​​model is used for cascade reasoning of time series prediction, anomaly detection, and classification decisions.

[0078] Specifically, in this embodiment, the AI ​​model built based on the multi-model fusion architecture includes:

[0079] Time series forecasting model, used to predict resource usage trends based on historical feature vectors as a dynamic baseline for anomaly detection;

[0080] An anomaly detection model is used to identify the deviation between the input real-time feature vector and the dynamic baseline output by the time series prediction model to output an anomaly feature vector;

[0081] The classification decision model is used to determine the fault type based on the abnormal feature vector output by the anomaly detection model.

[0082] It can be understood that the cascade reasoning of the AI ​​model in this embodiment means that the output of the anomaly detection model triggers the operation of the classification decision model, thereby avoiding real-time analysis of the entire data.

[0083] Furthermore, a dynamic weight allocation strategy can be designed to adjust the confidence weights of the outputs of each model in the AI ​​model according to business periods (such as peak / valley periods), which is not limited in this embodiment.

[0084] It is understandable that the existing technology has technical defects of staticness and singleness in the architecture of intelligent operation and maintenance decision-making models. For example, Chinese patent CN118656741A adopts a fixed combination of dual-branch contrastive learning (performance data) and isolation forest (log data), lacking dynamic adjustment capabilities. Its multimodal model is only simply integrated (such as splicing with Alibaba's large language model in step S4), resulting in the separation of detection of sudden anomalies (such as CPU spikes) and periodic faults (such as database connection leaks). It displays fault modes through unsupervised clustering, and has a delayed response defect. To this end, this embodiment creatively constructs a three-level AI model architecture to achieve full-process collaboration from trend prediction to accurate fault decision-making. Specifically, first, dynamic baseline generation and trend prediction are performed through the time series prediction model to provide a dynamic baseline for anomaly detection. Then, the anomaly detection model identifies real-time deviations and anomaly markers based on the predicted baseline, overcoming the false alarm problem caused by static thresholds in the existing technology. Finally, the classification decision model distinguishes the fault type and locates the root cause based on the abnormal feature vector, avoiding the delayed response defect of the unsupervised clustering display fault mode in the existing technology, and realizing the full-link fault processing from "trend prediction → real-time anomaly detection → rapid fault decision", thereby greatly improving the dynamic adjustment capability of the model while achieving rapid decision-making on the fault type, significantly improving operation and maintenance efficiency and fault detection accuracy.

[0085] Furthermore, in this embodiment, the time series prediction model predicts resource usage trends based on historical feature vectors as a dynamic baseline for anomaly detection, including:

[0086] Based on historical feature vectors, the Prophet algorithm is used to decompose the periodicity, trend and holiday effects of the time series, predict and generate a dynamic baseline for the future time window, and pass it to the anomaly detection model.

[0087] Specifically, the time series prediction model uses the Prophet algorithm to decompose the periodicity, trend, and holiday effects of time series based on historical logs and performance data. For example, for the database active connection number indicator, the model automatically identifies periodic fluctuations during daily business peaks (such as daily connection peaks), quarterly growth trends (such as a linear increase in connections caused by monthly new users), and special events (such as instantaneous surges caused by promotional activities). The prediction results generate a dynamic baseline for the future time window (such as a predicted memory usage baseline of 75% ± 5% for the next 2 hours) and output a confidence interval (such as CPU usage between 60% and 85% at 80% confidence). Furthermore, this dynamic baseline not only serves as a reference standard for anomaly detection, but is also passed to the anomaly detection model through a cross-level data sharing interface, providing it with context-aware capabilities. For example, when a business peak is predicted to be approaching, the anomaly detection layer can temporarily relax the alarm threshold for network latency to avoid false positives.

[0088] On the other hand, in this embodiment, the anomaly detection model identifies the deviation between the input real-time feature vector and the dynamic baseline output by the time series prediction model to output an anomaly feature vector, including:

[0089] Based on the real-time feature vector input and the dynamic baseline output by the time series prediction model, the reconstruction error is calculated using the encoding-decoding structure of AutoEncoder;

[0090] The real-time feature vector is scored for abnormality based on the reconstruction error to obtain the abnormal feature vector, which is then passed to the classification decision model.

[0091] Specifically, the anomaly detection model receives real-time collected second-level indicators (such as CPU usage and HTTP error rate) and the dynamic baseline generated by the time series prediction model, and calculates the reconstruction error through the encoding-decoding structure of AutoEncoder.

[0092] The specific process includes:

[0093] 1. Input feature construction: The real-time feature vector is aggregated into statistical features (mean, variance, and extreme values) by time window (e.g., 10 seconds), and is concatenated with the predicted value of the dynamic baseline and the upper and lower bounds of the confidence interval to form the input vector.

[0094] 2. Anomaly score generation: AutoEncoder compresses and reconstructs the input vector and generates an anomaly score by comparing the difference between the original data and the reconstructed data (such as the Euclidean distance). For example, when the actual memory usage exceeds the baseline confidence interval and the reconstruction error exceeds the threshold, it is marked as a "memory anomaly."

[0095] 3. Context Enhancement: Adjust anomaly thresholds based on metadata tags (such as service type and environment). For example, the container restart threshold for a test environment can be higher than that for a production environment to reduce irrelevant alerts.

[0096] 4. The anomaly detection results (i.e., anomaly feature vectors) are passed to the classification decision model through feature importance weighting. For example, abnormal events marked as "high priority" (such as a sudden increase in database lock wait time) will be prioritized in the classification process.

[0097] On the other hand, in this embodiment, the classification decision model determines the fault type based on the abnormal feature vector output by the abnormality detection model, including:

[0098] Obtain a fault sample database;

[0099] Based on the fault sample database and the abnormal feature vectors output by the anomaly detection model, the XGBoost integrated learning mechanism is used to make decisions, output the probability distribution of fault types and the root cause location results, and feed back high-frequency fault types to the time series prediction model for optimization.

[0100] Among them, the high-value data of the fault sample database in this embodiment can be collected through two paths:

[0101] 1. Real-time anomaly capture: High-deviation events flagged by the AutoEncoder in the anomaly detection model, along with complete contextual metrics (such as CPU / memory curves for the five minutes before and after the anomaly).

[0102] 2. Manual verification and annotation: Operations and maintenance personnel mark the root cause of the fault (such as "database master-slave delay exceeds the limit") through the interactive interface and associate it with the error stack in the ELK log platform for storage.

[0103] Specifically, the classification decision model receives the abnormal feature vector and context information (such as service dependency topology), combines it with the fault sample database, and uses the XGBoost ensemble learning mechanism to achieve multi-dimensional decision-making:

[0104] 1. Feature Cross-Analysis: The model automatically constructs cross-level features, such as combining "CPU usage deviation" with "number of container restarts" to identify container crash patterns caused by resource competition.

[0105] 2. Fault type identification: Based on the feature importance ranking (for example, the number of active database connections accounts for 30%), the fault type probability distribution is output (for example, the probability of "database connection pool exhaustion" is 85%, and the probability of "network congestion" is 10%).

[0106] 3. Root cause identification: Generate a root cause hypothesis tree based on the failure patterns in the fault sample database (e.g., the causal chain of "accumulation of slow SQL statements → surge in connection numbers → CPU overload"). For example, if the number of slow SQL statements increases simultaneously with the number of connections, optimize SQL indexes rather than expand resources.

[0107] Furthermore, the three-level cascaded AI model designed in this embodiment can also be linked through feature sharing channels. For example, the trend confidence output by Prophet is used to adjust the anomaly threshold of AutoEncoder, and the classification results of XGBoost are fed back to the time series prediction model to optimize the periodic parameters. For example, incorporating high-frequency fault types (such as CPU overload caused by daily scheduled tasks) into the periodic parameters of Prophet can improve baseline prediction accuracy.

[0108] It can be understood that this embodiment achieves full-dimensional time-space operation and maintenance fault coverage by using Prophet to capture long-term trends, AutoEncoder to identify transient anomalies, and XGBoost to classify spatial distribution patterns.

[0109] Step 106: Train the AI ​​model based on the vector database to obtain a trained AI model.

[0110] Furthermore, in this embodiment, the AI ​​model is trained based on the vector database to obtain a trained AI model, including:

[0111] Divide the feature vectors in the vector database into a training set (such as the first three weeks of data) and a test set (such as the last week of data of the training set) in proportion, with the test set's time sequence being closer than the training set's;

[0112] Train the AI ​​model based on the training set to obtain a trained AI model;

[0113] The trained AI model is verified and optimized based on the test set to obtain the final AI model.

[0114] It is understandable that traditional random sample partitioning strategies can undermine the causal nature of time series, causing the intelligent operation and maintenance model to "peek" into future data during the training phase, resulting in the illusion of overfitting. To this end, this embodiment preserves temporal continuity when proportionally partitioning the feature vectors in the vector database into training and test sets. For example, if the training set uses the time-series operation and maintenance data from the first three weeks, the test set uses the time-series operation and maintenance data from the last week of the training set. This allows the AI ​​model to fully learn historical trends (such as the gradual process of memory leaks) during the training phase and effectively verify the AI ​​model's predictive ability for new events in real operation and maintenance scenarios (such as resource bottlenecks caused by promotional activities) during the testing phase. At the same time, the operation and maintenance environment often causes concept drift due to system upgrades and configuration changes (such as changes in the distribution of resource monitoring indicators after containerization). Therefore, the temporal continuity partitioning strategy proposed in this embodiment forces the model to face a data distribution in the test set (the last week) that may be different from the training set (the first three weeks). This forces the algorithm to improve its adaptability to drift and to some extent reduces its reliance on manual re-labeling.

[0115] Step 107: Input the real-time feature vector into the trained AI model, and output the real-time analysis results and prediction results of the system service operation status.

[0116] Furthermore, this embodiment can display the real-time analysis results and prediction results of the system service operation status in the form of reports, including hardware resource curves, AI summaries, and root cause analysis, to overcome the technical defects of the existing technology that relies on large language models to generate prompt words, which are not easily interpretable. Specifically, the following implementation methods can be used:

[0117] 1. Panoramic resource view: Overlays real-time indicator curves with dynamic baselines, noting abnormal periods and associated events (such as memory fluctuations triggered by container restart operations).

[0118] 2. Root Cause Location Tree: Based on XGBoost feature importance sorting, it highlights key influencing factors (such as "database lock wait time accounts for 70%) and associates relevant log fragments (such as the corresponding slow SQL statements).

[0119] 3. Prediction Analysis Report: Based on the capacity forecast for the next three days output by Prophet (e.g., 1.5% daily disk growth), the report recommends expansion plans based on the fault sample database (e.g., "expanding the Redis shard cluster to 8 nodes").

[0120] Furthermore, the ELK log platform can be combined with manual annotation to form or update a traceable fault sample database.

[0121] In summary, this embodiment provides a server operation status monitoring method, designs a joint feature generation mechanism for heterogeneous data sources, and effectively realizes the unified expression of cross-modal features by embedding and fusing unstructured log text with structured indicators, so as to solve the defect of separate analysis of text logs and numerical indicators in the existing technology, so that the AI ​​model can capture the multi-dimensional correlation of system status, which helps to improve the detection accuracy of complex faults. The creative design of the cascade reasoning of the collaborative AI model "time series prediction-anomaly detection-classification decision" realizes the full process collaboration from trend prediction to accurate fault decision-making, and realizes rapid decision-making on fault types while improving the dynamic adjustment capability of the AI ​​model.

[0122] Example 2:

[0123] This embodiment only compares Figure 1 The differences between the first embodiment and the second embodiment are described below. The technical concepts of the remaining designs are similar to those of the first embodiment and will not be described in detail in this embodiment.

[0124] In this embodiment, the time series prediction model includes a Transformer module, a TCN module, a feature fusion layer and a fully connected network, wherein the input of the Transformer module is a historical feature vector, the output of the Transformer module is a long-term semantic coding vector, the input of the TCN module is a real-time feature vector, the output of the TCN module is a short-term event coding vector, the input of the feature fusion layer is the long-term semantic coding vector output by the Transformer module and the short-term event coding vector output by the TCN module, the feature fusion layer is used to perform spatiotemporal alignment on the two types of input vectors and dynamically allocate weights through a gated attention mechanism to output a fused feature vector, the input of the fully connected network is the fused feature vector, the output of the fully connected network is the dynamic baseline of the future time window, and the dynamic baseline of the future time window is passed to the anomaly detection model.

[0125] Specifically, this embodiment uses the Transformer-TCN hybrid model to implement threshold adaptive optimization of the early warning mechanism:

[0126] First, the Transformer module captures long-term patterns (such as quarterly business growth trends) from historical feature vectors and uses the self-attention mechanism to identify dependencies across time periods (such as the periodic intensification of database lock competition caused by early-month settlements). The long-term semantic encoding vector output by the Transformer represents the macro-regularity of system behavior.

[0127] At the same time, the TCN (Temporal Convolutional Network) module uses dilated causal convolution stacking to extract local temporal features (such as instantaneous traffic spikes caused by flash sales activities) from real-time feature vectors. The TCN module quickly extracts the amplitude, duration and change rate of sudden events through hierarchical convolution, generates short-term event encoding vectors, and characterizes micro-fluctuation characteristics to quickly respond to sudden anomalies.

[0128] Next, the feature fusion layer spatially and temporally aligns the long-term semantic encoding vector output by the Transformer module with the short-term event encoding vector output by the TCN module (such as aggregating them in 10-minute windows), and dynamically allocates weights through the gated attention mechanism (GatedAttention). For example, during regular periods, the Transformer is given a higher weight (70%) to maintain baseline stability, while during promotional activities, the TCN weight is increased to 60% to enhance the burst mode response capability, and the fused feature vector is output.

[0129] Finally, the fused feature vector is fed into a fully connected network to predict the baseline values ​​and confidence intervals for metrics for the next 10 minutes. For example, the CPU usage baseline is predicted to be 65% ± 5%, the network latency baseline is predicted to be 45ms ± 10ms, and potential risk periods are flagged (for example, the number of database connections may exceed the baseline by 30% within the next hour).

[0130] Furthermore, this embodiment can also formulate a manual experience reinforcement plan. Specifically, by integrating key events manually annotated by operation and maintenance personnel (such as "CPU threshold relaxed to 85% during the Double 11 promotion" and "network delay threshold raised to 70ms during the machine room migration"), an event-threshold mapping knowledge base is constructed. In the baseline prediction stage, historical events are retrieved through similarity matching (such as cosine similarity > 0.8), and the current baseline is corrected by experience weighting to achieve real-time adaptive adjustment of early warning indicators. For example, when it is detected that the current traffic pattern is 85% similar to the historical promotion, the CPU threshold is automatically increased from the baseline 70% to 82%, and the confidence interval is expanded to ±8%, reducing the false alarm rate.

[0131] It is understandable that existing technologies (such as the combination of isolation forest and random forest used in Chinese patent CN118656741A) lack the ability to collaboratively analyze local and global periodic features of time series. Traditional threshold setting relies on manual experience or static statistics (3-sigma principle). To this end, this embodiment designs a Transformer-TCN hybrid model to achieve dynamic baseline generation and threshold adaptation of early warning indicators. The dual-path prediction baseline is achieved by TCN capturing sudden spikes and Transformer capturing periodic trends to achieve dynamic adjustment of thresholds. This "global + local" dual perspective is more suitable for the spatiotemporal characteristics of system load.

[0132] Example 3:

[0133] This embodiment only compares Figure 1 The differences between the first embodiment and the second embodiment are described below. The technical concepts of the remaining designs are similar to those of the first embodiment and will not be described in detail in this embodiment.

[0134] In this embodiment, the AI ​​model is trained based on the training set to obtain a trained AI model, including:

[0135] Based on high-frequency fault types and time series distribution, an incremental learning method is used to construct a dynamic training set;

[0136] The AI ​​model is iteratively trained based on a dynamic training set, generating an optimized new model version for each iteration, and retaining several historical model versions for rapid version rollback when historical faults recur.

[0137] Specifically, the implementation of this embodiment may be:

[0138] 1. Incremental batch loading: Adjust sample weights based on high-frequency fault types, assigning high weights to high-frequency fault types. During each training session, only newly added time series samples (data from the last 7 days) and high-weight historical samples (weight > 0.5) are loaded into the training set to avoid overloading the entire data set.

[0139] 2. Elastic parameter updates: Fixed the splitting points of existing decision trees and only fine-tuned the weights of leaf nodes to ensure that historical knowledge is not lost. Based on the feature distribution of newly added samples (such as a new container orchestration failure), the feature splitting priority is adjusted, but the adjustment range is limited (e.g., a maximum of ±20%) to avoid overwriting historical patterns.

[0140] 3. Each iteration generates a new optimized model version and retains several historical model versions to support rapid version rollback when historical faults recur.

[0141] Understandably, existing techniques typically utilize samples within three months, with an exponentially decreasing weight of older samples. This can easily cause the model to forget key historical patterns. Therefore, this embodiment employs an incremental learning strategy to collaboratively optimize the model, reducing computational overhead while avoiding the model degradation problem of existing techniques, thus ensuring the model's fault detection accuracy to a certain extent.

[0142] In summary, this embodiment builds an intelligent monitoring system with self-learning capabilities through the operation and maintenance decision-making chain of "multimodal data fusion input → cascade model processing → dynamic baseline adjustment → incremental learning optimization", solving the three core problems of existing technologies: fragmented heterogeneous data processing, static rules lagging behind the dynamic environment, and fault diagnosis relying on manual experience.

[0143] Example 4:

[0144] See also Figure 2 , Figure 2 This is a schematic diagram of the structure of a server operation status monitoring system provided in one embodiment of this specification.

[0145] like Figure 2 As shown, the server operation status monitoring system may at least include:

[0146] Data acquisition module 1 is used to obtain historical time series operation and maintenance data of system services and collect time series operation and maintenance data in real time. Time series operation and maintenance data includes unstructured log text and structured indicators;

[0147] Cross-modal fusion module 2 is used to map unstructured log text into a low-dimensional dense text vector using an embedding learning method, and then concatenate the text vector with the standardized numerical vector of the structured indicator to obtain a unified high-dimensional feature vector, which is recorded as a historical feature vector and a real-time feature vector respectively.

[0148] Database formation module 3, used to store historical feature vectors and real-time feature vectors together to form a vector database across time periods;

[0149] AI model building module 4, used to build an AI model based on a multi-model fusion architecture. The AI ​​model is used for cascade reasoning of time series prediction, anomaly detection, and classification decisions;

[0150] Model training module 5, used to train the AI ​​model based on the vector database to obtain a trained AI model;

[0151] The real-time operation and maintenance decision module 6 is used to input the real-time feature vector into the trained AI model and output the real-time analysis results and prediction results of the system service operation status.

[0152] It is understandable that the technical concept of the server operation status monitoring system provided in this embodiment is similar to the technical concept of the aforementioned server operation status monitoring method, and this embodiment will not be repeated here.

[0153] Embodiment 5:

[0154] Another embodiment of the present disclosure provides a computer-readable storage medium storing instructions that, when executed on a computer or processor, cause the computer or processor to perform one or more steps of the aforementioned embodiments. If the components of the aforementioned electronic device are implemented as software functional units and used as independent downstream task predictions or tasks, they can be stored in the computer-readable storage medium.

[0155] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the embodiment of this specification is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted via a computer-readable storage medium. The computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. Available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, digital versatile discs (DVDs)), or semiconductor media (eg, solid state disks (SSDs)).

[0156] The above description is merely an illustration of the preferred embodiments disclosed in this application and the technical principles employed. Those skilled in the art should understand that the scope of protection provided by this disclosure is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned disclosed concepts. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

[0157] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details have been included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

Claims

1. A server operation status monitoring method, characterized in that: The following steps are involved: Obtain historical time-series operation and maintenance data of system services and collect time-series operation and maintenance data in real time. The time-series operation and maintenance data includes unstructured log text and structured indicators; Embedding learning method is used to map unstructured log text into low-dimensional dense text vectors; The text vector and the standardized numerical vector of the structured index are concatenated to obtain a unified high-dimensional feature vector, which is recorded as the historical feature vector and the real-time feature vector respectively. Store historical feature vectors and real-time feature vectors together to form a vector database across time periods; Building an AI model based on a multi-model fusion architecture, which is used for cascade reasoning of time series prediction, anomaly detection, and classification decisions; Train the AI ​​model based on the vector database to obtain a trained AI model; The real-time feature vector is input into the trained AI model, and the real-time analysis and prediction results of the system service operation status are output.

2. A server operation status monitoring method according to claim 1, characterized in that: AI models built based on a multi-model fusion architecture include: Time series forecasting model, used to predict resource usage trends based on historical feature vectors as a dynamic baseline for anomaly detection; An anomaly detection model is used to identify the deviation between the input real-time feature vector and the dynamic baseline output by the time series prediction model to output an anomaly feature vector; The classification decision model is used to determine the fault type based on the abnormal feature vector output by the anomaly detection model.

3. A server operation status monitoring method according to claim 2, characterized in that: Predict resource usage trends based on historical feature vectors to serve as a dynamic baseline for anomaly detection, including: Based on historical feature vectors, the Prophet algorithm is used to decompose the periodicity, trend and holiday effects of the time series, predict and generate a dynamic baseline for the future time window, and pass it to the anomaly detection model.

4. A server operation status monitoring method according to claim 2, characterized in that: The time series prediction model includes a Transformer module, a TCN module, a feature fusion layer and a fully connected network, wherein the input of the Transformer module is a historical feature vector, the output of the Transformer module is a long-term semantic coding vector, the input of the TCN module is a real-time feature vector, the output of the TCN module is a short-term event coding vector, the input of the feature fusion layer is the long-term semantic coding vector output by the Transformer module and the short-term event coding vector output by the TCN module, the feature fusion layer is used to perform spatiotemporal alignment on the two types of input vectors and dynamically allocate weights through a gated attention mechanism to output a fused feature vector, the input of the fully connected network is the fused feature vector, the output of the fully connected network is the dynamic baseline of the future time window, and the dynamic baseline of the future time window is passed to the anomaly detection model.

5. A server operation status monitoring method according to claim 2, characterized in that: Identify the deviation between the input real-time feature vector and the dynamic baseline output by the time series prediction model to output an abnormal feature vector, including: Based on the real-time feature vector input and the dynamic baseline output by the time series prediction model, the reconstruction error is calculated using the encoding-decoding structure of AutoEncoder; The real-time feature vector is scored for abnormality based on the reconstruction error to obtain the abnormal feature vector, which is then passed to the classification decision model.

6. A server operation status monitoring method according to claim 2, characterized in that: The fault type is determined based on the abnormal feature vector output by the anomaly detection model, including: Obtain a fault sample database; Based on the fault sample database and the abnormal feature vectors output by the anomaly detection model, the XGBoost integrated learning mechanism is used to make decisions, output the probability distribution of fault types and the root cause location results, and feed back high-frequency fault types to the time series prediction model for optimization.

7. A server operation status monitoring method according to claim 6, characterized in that: The AI ​​model is trained based on the vector database to obtain the trained AI model, including: Divide the feature vectors in the vector database into a training set and a test set in proportion, with the test set's time sequence being closer than the training set's; Train the AI ​​model based on the training set to obtain a trained AI model; The trained AI model is verified and optimized based on the test set to obtain the final AI model.

8. A server operation status monitoring method according to claim 7, characterized in that: The AI ​​model is trained based on the training set to obtain the trained AI model, including: Based on high-frequency fault types and time series distribution, an incremental learning method is used to construct a dynamic training set; The AI ​​model is iteratively trained based on a dynamic training set, generating an optimized new model version for each iteration, and retaining several historical model versions for rapid version rollback when historical faults recur.

9. A server operation status monitoring system, characterized in that: include: A data acquisition module is used to obtain historical time-series operation and maintenance data of system services and collect time-series operation and maintenance data in real time. The time-series operation and maintenance data includes unstructured log text and structured indicators; The cross-modal fusion module uses an embedding learning method to map unstructured log text into a low-dimensional dense text vector. It then concatenates the text vector with the standardized numerical vector of the structured indicator to obtain a unified high-dimensional feature vector, which is recorded as a historical feature vector and a real-time feature vector. A database formation module is used to store historical feature vectors and real-time feature vectors together to form a vector database across time periods; An AI model building module, which is used to build an AI model based on a multi-model fusion architecture. The AI ​​model is used for cascade reasoning of time series prediction, anomaly detection, and classification decisions; The model training module is used to train the AI ​​model based on the vector database to obtain the trained AI model; The real-time operation and maintenance decision module is used to input real-time feature vectors into the trained AI model and output real-time analysis and prediction results of the system service operation status.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the server operation status monitoring method according to any one of claims 1 to 8 is implemented.

Images