An intelligent operation and maintenance learning method and system related to monitoring a baseline

Abstract

The application provides an intelligent operation and maintenance learning method and system related to monitoring a baseline, and relates to the technical field of computer operation and maintenance. The method comprises: collecting a plurality of core index monitoring data of a target server cluster in a set historical period to obtain a historical monitoring data set; performing time series segmentation processing on the historical monitoring data set to obtain a time series data segment set; performing trend fitting on the time series data segment set by a linear regression algorithm to obtain a corresponding trend fitting straight line; determining a center data point based on the trend fitting straight line, and determining a bidirectional data fluctuation interval according to a residual error analysis result at the center data point. The application realizes dynamic matching of the baseline with the business, full-process automation, precision improvement, and reduction of false and missed reports.

Description

Technical Field

[0001] This invention relates to the field of computer operation and maintenance technology, and in particular to an intelligent operation and maintenance learning method and system for monitoring baselines. Background Technology

[0002] Traditional monitoring baseline construction often relies on static threshold presets or manual periodic calibration. Operation and maintenance personnel usually set fixed alarm thresholds for core indicators such as CPU utilization and memory usage based on historical experience, or manually update the baseline range at fixed intervals to achieve monitoring of the operating status and early warning of anomalies.

[0003] For example, to support the concurrent learning needs of a large number of users, an online education platform deployed a large-scale application server cluster. Its memory usage monitoring adopted a static baseline strategy with fixed alarm thresholds. However, in actual operation, the cluster's memory usage exhibited significant periodic characteristics: during peak business hours on weekdays, due to demands such as live course streaming and assignment submissions, the usage rate often remained high, while during the off-peak hours in the early morning, it dropped to a low level. Occasionally, there were short-term spikes in memory usage due to temporary data backups, which quickly returned to normal. Under the traditional approach, false alarms at the fixed threshold were frequently triggered during peak weekday hours, while during the early morning hours, some servers experienced abnormally high usage rates due to memory leaks, but these rates did not reach the threshold. The problem of false alarms and missed alarms means that the operations and maintenance team has to spend a lot of time every day checking invalid alarms and manually adjusting thresholds. This still cannot adapt to the dynamic changes in business traffic. Moreover, because the transient abnormal data generated by temporary operations is not filtered, similar data is mistakenly included in the sample when manually updating the baseline, which further leads to baseline deviation. Traditional technical solutions have defects. Static baselines cannot adapt to the periodic fluctuations of indicators and sudden changes in business, resulting in prominent false alarm and missed alarm problems. Manual calibration relies on experience and has a lag in response, making it difficult to match the needs of large-scale dynamic operation. At the same time, there is a lack of abnormal data filtering mechanism, and the purity of the baseline learning sample is insufficient. Ultimately, it cannot meet the core requirements of intelligent operation and maintenance for monitoring accuracy, real-time performance and automation. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide an intelligent operation and maintenance learning method and system for monitoring baselines, so as to realize dynamic matching of baselines with business, full-process automation, improved accuracy and reduced false alarms and missed alarms.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0006] Firstly, an intelligent operation and maintenance learning method for monitoring baselines, the method comprising:

[0007] Collect monitoring data of multiple core indicators of the target server cluster within a set historical period to obtain a historical monitoring dataset;

[0008] The historical monitoring dataset is segmented into time series data segments to obtain a set of time series data segments. A trend fitting is performed on the set of time series data segments using a linear regression algorithm to obtain the corresponding trend fitting line. The center data point is determined based on the trend fitting line, and the bidirectional data fluctuation range is determined based on the residual analysis results at the center data point.

[0009] The standard deviation confidence interval is calculated based on the bidirectional data fluctuation range as the data fluctuation range, and multiple sampling locations are selected inside and outside the data fluctuation range; a periodic envelope is generated based on the temporal distribution characteristics of the multiple sampling locations; and baseline calibration parameters are calculated based on the periodic envelope to obtain dynamic monitoring baseline candidate data.

[0010] Transient outlier data identification and filtering are performed on the baseline candidate data to obtain purified baseline learning samples;

[0011] The purified baseline learning samples are relearned to obtain the optimized dynamic monitoring baseline.

[0012] The current monitoring and alarms of the target server cluster are judged based on the optimized dynamic monitoring baseline in order to complete the update of the dynamic monitoring baseline.

[0013] Furthermore, monitoring data of multiple core metrics of the target server cluster are collected within a set historical period to obtain a historical monitoring dataset, including:

[0014] The system performs unified scheduling and collection of multiple core metrics from each server in the target server cluster to obtain an initial monitoring data stream.

[0015] The initial monitoring data stream is initially cleaned and formatted to eliminate noise and format inconsistencies, in order to obtain an intermediate dataset with standardized timestamps and a unified data structure.

[0016] The intermediate datasets are aggregated and persistently stored through storage devices, ultimately resulting in a complete and standardized historical monitoring dataset that can be directly accessed.

[0017] Furthermore, the historical monitoring dataset is segmented into time series data segments to obtain a set of time series data segments; a trend fit is performed on the set of time series data segments using a linear regression algorithm to obtain the corresponding trend fitting line; the center data point is determined based on the trend fitting line, and the bidirectional data fluctuation range is determined based on the residual analysis results at the center data point, including:

[0018] The dataset is segmented into time series data segments, dividing continuous monitoring data into multiple independent time series data segments to obtain a set of time series data segments.

[0019] Perform linear regression analysis on each data segment in the time series data set to obtain the trend fitting line corresponding to each data segment;

[0020] By determining the center data point of each trend fitting line, and based on the center data point of each trend fitting line, the residual between each actual data point in the corresponding data segment and the trend fitting line is calculated.

[0021] Based on the distribution of the residuals, the data fluctuation boundaries above and below the central data point are determined, ultimately yielding the bidirectional data fluctuation range.

[0022] Furthermore, a standard deviation confidence interval is calculated based on the bidirectional data fluctuation range as the data fluctuation range, and multiple sampling locations are selected within and outside the data fluctuation range; a periodic envelope is generated based on the temporal distribution characteristics of the multiple sampling locations; baseline calibration parameters are calculated based on the periodic envelope to obtain dynamic monitoring baseline candidate data, including:

[0023] Calculate the standard deviation and determine the confidence interval based on the data distribution within the two-way data fluctuation range, and establish the data fluctuation range;

[0024] Based on the established data fluctuation range, multiple representative sampling locations are selected along the time axis between the inner boundary and the outer region of the data fluctuation range.

[0025] The temporal distribution characteristics of monitoring data values ​​at multiple sampling locations are analyzed, and upper and lower envelopes representing periodic changes are formed through fitting processing to construct a complete periodic envelope.

[0026] Based on the constructed periodic envelope, calibration and adjustment are performed according to preset business tolerance parameters to finally obtain candidate data for dynamic monitoring baseline.

[0027] Furthermore, transient outlier identification and filtering are performed on the baseline candidate data to obtain purified baseline learning samples, including:

[0028] Based on the normal fluctuation range defined by the candidate data of the dynamic monitoring baseline, anomaly determination is performed on each data point in the historical monitoring dataset to obtain the anomaly determination result.

[0029] Based on the results of the anomaly determination, instantaneous abnormal data points that exceed the normal fluctuation range are identified;

[0030] The instantaneous abnormal data points are filtered out and removed from the historical monitoring dataset to obtain the filtered and removed results;

[0031] The purified baseline learning sample is obtained based on the results after filtering and removal.

[0032] Furthermore, the purified baseline learning samples are relearned to obtain an optimized dynamic monitoring baseline, including:

[0033] Based on the purified baseline learning samples, the time series segmentation, trend fitting calculation, and bidirectional data fluctuation range determination processes are re-executed to obtain the updated bidirectional data fluctuation range.

[0034] Based on the updated bidirectional data fluctuation range, the data fluctuation range calculation, periodic envelope construction, and baseline calibration parameter determination processes are performed again to obtain the optimized dynamic monitoring baseline.

[0035] Furthermore, based on the optimized dynamic monitoring baseline, the current monitoring and alarm judgments of the target server cluster are analyzed to update the dynamic monitoring baseline, including:

[0036] The optimized dynamic monitoring baseline is deployed to the real-time monitoring of the target server cluster to obtain the optimized dynamic monitoring baseline.

[0037] Based on the optimized dynamic monitoring baseline that has been deployed, the system continuously collects the current operating status data of the target server cluster in real time, and compares and analyzes the collected current monitoring data with the optimized dynamic monitoring baseline in real time to obtain the results of the real-time comparison and analysis.

[0038] Based on the results of real-time comparison and analysis, the system monitors in real time, identifies abnormal states that exceed the baseline according to preset alarm rules, and generates corresponding abnormal alarm information to complete the dynamic monitoring baseline update and real-time monitoring application.

[0039] Secondly, an intelligent operation and maintenance learning system for monitoring baselines includes:

[0040] The acquisition module is used to collect monitoring data of multiple core indicators of the target server cluster within a set historical period to obtain a historical monitoring dataset.

[0041] The calculation module is used to perform time-series segmentation processing on the historical monitoring dataset to obtain a set of time-series data segments; to perform trend fitting on the set of time-series data segments using a linear regression algorithm to obtain the corresponding trend fitting line; to determine the center data point based on the trend fitting line, and to determine the bidirectional data fluctuation range based on the residual analysis results at the center data point; to calculate the standard deviation confidence interval based on the bidirectional data fluctuation range as the data fluctuation range, and to select multiple sampling locations inside and outside the data fluctuation range; to generate a periodic envelope based on the temporal distribution characteristics of the multiple sampling locations; and to calculate the baseline calibration parameters based on the periodic envelope to obtain candidate data for dynamic monitoring baselines.

[0042] The purification module is used to identify and filter instantaneous abnormal data in the baseline candidate data to obtain purified baseline learning samples.

[0043] The optimization module is used to relearn the purified baseline learning samples to obtain an optimized dynamic monitoring baseline.

[0044] The update module is used to judge the current monitoring and alarms of the target server cluster based on the optimized dynamic monitoring baseline, so as to complete the update of the dynamic monitoring baseline.

[0045] Thirdly, a computing device, comprising:

[0046] One or more processors;

[0047] A storage device for storing one or more programs that, when executed by one or more processors, cause the one or more processors to implement the method.

[0048] Fourthly, a computer-readable storage medium storing a program that, when executed by a processor, implements the method.

[0049] The above-described solution of the present invention has at least the following beneficial effects:

[0050] A unified scheduling method is used to collect monitoring data from multiple core indicators of the target server cluster. After cleaning and formatting, the data is persistently stored to form a standardized historical monitoring dataset. The dataset is segmented into time series segments, and a linear regression algorithm is used to fit the trend lines of each data segment. Combined with residual analysis of the central data points, the bidirectional data fluctuation range is determined. Based on the bidirectional data fluctuation range, the standard deviation confidence interval is calculated to establish the data fluctuation range. Sampling positions are selected along the time axis, and periodic envelopes are generated according to the time series characteristics. Combined with business tolerance parameters, dynamic monitoring baseline candidate data is obtained. Transient anomalies are identified and filtered from the candidate data to obtain purified samples. The purified samples are then relearned and optimized to obtain an accurate baseline. Finally, the optimized baseline is... This approach, which deploys data to real-time monitoring, continuously collects current data and compares it with a baseline. Based on alarm rules, it identifies anomalies and generates alarm information. This overcomes the technical problems of traditional monitoring baselines, which rely on static thresholds and cannot adapt to periodic fluctuations in indicators, have slow response times and rely on experience for manual calibration, and lack anomaly filtering mechanisms that lead to impure samples and frequent false alarms and missed alarms. These issues make it difficult to meet the requirements of intelligent operation and maintenance for monitoring accuracy, real-time performance, and automation. As a result, the monitoring baseline can dynamically match the business operation rules of the target server cluster, achieve full-process automation without manual intervention, improve baseline accuracy, and significantly reduce false alarm and missed alarm rates, thus meeting the core technical requirements of intelligent operation and maintenance of the target server cluster. Attached Figure Description

[0051] Figure 1 This is a flowchart illustrating an intelligent operation and maintenance learning method for monitoring baselines provided by an embodiment of the present invention.

[0052] Figure 2 This is a schematic diagram of an intelligent operation and maintenance learning system for monitoring baselines provided by an embodiment of the present invention. Detailed Implementation

[0053] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0054] like Figure 1 As shown, an embodiment of the present invention proposes an intelligent operation and maintenance learning method for monitoring baselines, the method comprising the following steps:

[0055] Step 1: Collect monitoring data of multiple core indicators of the target server cluster within a set historical period to obtain a historical monitoring dataset.

[0056] Step 2: Perform time series segmentation on the historical monitoring dataset to obtain a set of time series data segments; perform trend fitting on the set of time series data segments using a linear regression algorithm to obtain the corresponding trend fitting line; determine the center data point based on the trend fitting line, and determine the bidirectional data fluctuation range based on the residual analysis results at the center data point;

[0057] Step 3: Calculate the standard deviation confidence interval based on the bidirectional data fluctuation range as the data fluctuation range, and select multiple sampling locations inside and outside the data fluctuation range; generate a periodic envelope based on the temporal distribution characteristics of the multiple sampling locations; calculate the baseline calibration parameters based on the periodic envelope to obtain dynamic monitoring baseline candidate data;

[0058] Step 4: Perform instantaneous outlier identification and filtering on the baseline candidate data to obtain the purified baseline learning samples;

[0059] Step 5: Relearn the purified baseline learning samples to obtain the optimized dynamic monitoring baseline;

[0060] Step 6: Based on the optimized dynamic monitoring baseline, determine the current monitoring and alarm status of the target server cluster to complete the update of the dynamic monitoring baseline.

[0061] In this embodiment of the invention, monitoring data of multiple core indicators of the target server cluster within a set historical period are collected to form a historical monitoring dataset. The dataset is segmented into time series segments, and a trend line is fitted using a linear regression algorithm. The bidirectional data fluctuation range is determined by combining the residual analysis of the central data point. Based on the bidirectional data fluctuation range, the standard deviation confidence interval is calculated to establish the data fluctuation range, and a periodic envelope is generated by selecting sampling positions to obtain dynamic monitoring baseline candidate data. Instantaneous anomalies are identified and filtered in the candidate data to obtain purified baseline learning samples. The purified samples are re-learned and processed to obtain an optimized dynamic monitoring baseline. Finally, the target server cluster is monitored and alarms are judged based on the optimized baseline. Therefore, this technical means overcomes the technical problems of traditional monitoring baselines, which rely on static thresholds and cannot adapt to the periodic fluctuations of indicators, have slow response to manual calibration and rely on experience, and lack anomaly data filtering mechanisms, resulting in impure samples and frequent false alarms and missed alarms. These problems make it difficult to meet the core requirements of intelligent operation and maintenance for monitoring accuracy, real-time and automation. Thus, the technical effects of monitoring baselines being able to dynamically match the operating rules of the target server cluster, achieving full-process automation without manual intervention, improving baseline accuracy and reducing false alarm and missed alarm rates, and meeting the technical requirements of intelligent operation and maintenance of the target server cluster are achieved.

[0062] In a preferred embodiment of the present invention, step 1 above may include:

[0063] Step 1.1 involves the unified scheduling and collection of multiple core metrics from each server in the target server cluster to obtain an initial monitoring data stream. Specifically, for the target server cluster of an online education platform supporting the concurrent learning needs of a large number of users, the data collection unit first receives the data collection strategy issued by the operations and maintenance personnel based on the platform's business characteristics. The strategy specifies the types of core metrics to be collected, the collection frequency for different time periods, and the collection order for each server. Subsequently, the data collection unit uniformly schedules each server in the cluster according to the strategy, sequentially connects to the monitoring interface of each server, and collects the core metric data of each server in an orderly manner. The collected real-time metric data is then integrated according to the collection time order to form the initial monitoring data stream.

[0064] Step 1.2 involves preliminary cleaning and formatting of the initial monitoring data stream to eliminate noise and format inconsistencies, resulting in an intermediate dataset with standardized timestamps and a unified data structure. Specifically, after the data acquisition unit obtains the initial monitoring data stream, it first cleans the data, checking each data entry one by one to identify and remove noise data such as short-term spikes in memory usage caused by temporary data backup operations and invalid numerical data generated by server sensor malfunctions. Next, it performs formatting, converting the timestamps of all data to a fixed format to avoid data confusion caused by differences in time formats across different servers. Simultaneously, it standardizes the structure of each data entry to include the server number, core indicator type, acquisition timestamp, and specific indicator value, ultimately forming an intermediate dataset with standardized timestamps and a unified data structure.

[0065] Step 1.3 involves aggregating and persistently storing the intermediate dataset through a storage device to obtain a complete and standardized historical monitoring dataset that can be directly accessed. Specifically, this includes: the data acquisition unit transmitting the processed intermediate dataset to a pre-set storage device, such as a distributed storage system, via a stable data transmission channel; the storage device receiving the intermediate dataset aggregating and integrating the intermediate data from different servers according to the acquisition time sequence to ensure that the data fully reflects the changes in the target server cluster's operational indicators within the set historical period; simultaneously, the storage device activating a persistent storage mechanism to securely store the aggregated intermediate data, preventing data loss or corruption; and finally, after aggregation and persistent storage, a complete and standardized historical monitoring dataset covering all core indicators of the target server cluster within the set historical period is formed and can be directly accessed.

[0066] In this embodiment of the invention, a data acquisition unit is used to uniformly schedule and collect multiple core indicators of each server in the target server cluster according to the distribution strategy. The initial monitoring data stream is cleaned and formatted to eliminate noise and format problems. The intermediate dataset is then transmitted to a storage device for aggregation and persistent storage. This overcomes the technical problems of disordered indicator collection, noisy and disordered data, and inability to completely persist data storage in the traditional data acquisition process, which leads to a lack of standardized data sources for subsequent baseline learning. As a result, the standardization of core indicator collection is achieved, pure and structurally unified intermediate data is obtained, and finally a complete and standardized historical monitoring dataset that can be directly called is formed.

[0067] In a preferred embodiment of the present invention, step 2 above may include:

[0068] Step 2.1 involves performing time-series segmentation on the dataset, dividing the continuous monitoring data into multiple independent time-series data segments to obtain a set of time-series data segments. Specifically, this includes: first, receiving a historical monitoring dataset covering the operation data of the online education platform server cluster. The dataset contains core indicator data such as memory usage rate during different time periods, such as weekday business peaks, early morning slumps, and weekends; then, performing time-series feature analysis on the dataset to identify time nodes in the data that conform to the business cycle. For example, using the start of live course streaming at 8:00 AM, the end of live course streaming at 10:00 PM, and the start of the slump at 0:00 AM on weekdays as dividing points, the continuous monitoring data is divided into multiple independent time-series data segments. For example, memory usage rate data from 8:00 AM to 10:00 PM on weekdays is classified as the business peak data segment, data from 0:00 AM to 6:00 AM is classified as the slump data segment, and data for the entire weekend is classified as the weekend data segment, ultimately forming a set of time-series data segments containing data from multiple differentiated time periods.

[0069] Step 2.2 involves performing linear regression analysis on each data segment in the time series data set to obtain a trend fitting line for each data segment. Specifically, this includes processing each data segment separately. Taking the peak business data segment as an example, firstly, extracting the collection time and indicator value corresponding to all memory usage data within the data segment to establish a correspondence between time and indicator value; then, performing linear regression analysis on these correspondences to find a straight line that best fits the changing trend of all actual data points within the data segment. For example, during peak business periods, memory usage is stable at a high level, and the trend fitting line obtained after linear regression analysis is close to horizontal, and the numerical range corresponding to the line is consistent with the concentrated range of actual usage during the period. For the low-peak data segment in the early morning, the same operation is performed to obtain a fitting line with a lower numerical range and a stable trend.

[0070] Step 2.3 involves determining the center data point of each trend fitting line and, based on this center data point, calculating the residual between each actual data point within the corresponding data segment and the trend fitting line. Specifically, this includes: for each trend fitting line, first determining the midpoint of the time range corresponding to the line, finding the corresponding indicator value on the trend fitting line at the midpoint time, and using this midpoint and the corresponding indicator value as the center data point of the data segment; for example, the peak business data segment ranges from 8 AM to 10 PM, with the midpoint at 3 PM. Finding the memory usage rate value at 3 PM on the trend fitting line of the data segment is the center data point of the segment; then, iterating through all the actually collected indicator data within the data segment, calculating the difference between each actual data point, such as the memory usage rate value at 8:10 AM and the corresponding indicator value on the trend fitting line at that time point. This difference is the residual of the actual data point; for example, the difference between the actual data point where temporary data backup causes a short-term spike in memory usage and the corresponding trend fitting line value will be greater than the difference for normal data points.

[0071] Step 2.4 determines the data fluctuation boundaries above and below the central data point based on the residual distribution, ultimately obtaining a bidirectional data fluctuation range. This specifically includes: performing distribution analysis on the residual list for each data segment, and statistically analyzing the residual concentration range of most normal data points; for example, in peak business data segments, 95% of the normal data point residuals are concentrated between -5% and +5%, with only abnormal data point residuals caused by temporary backups exceeding this range; in off-peak data segments, 95% of the normal data point residuals are concentrated between -3% and +3%. Based on the distribution pattern, using the central data point as a benchmark, the data fluctuation boundaries above and below the central data point are determined. For peak business data segments, the upper boundary is the central data point value plus 5%, and the lower boundary is the central data point value minus 5%; for off-peak data segments, the upper boundary is the central data point value plus 3%, and the lower boundary is the central data point value minus 3%. This ultimately forms a bidirectional data fluctuation range for each data segment, adapted to its fluctuation characteristics.

[0072] In this embodiment of the invention, the historical monitoring dataset is segmented into independent data segments by time series analysis. Linear regression analysis is performed on each data segment to obtain a trend fitting line. The center data point of each trend line is determined and the residual between each actual data point and the trend line is calculated. Then, the fluctuation boundaries above and below the center data point are determined based on the residual distribution to obtain the bidirectional data fluctuation range. Therefore, this method overcomes the technical problems of traditional static monitoring baselines, which fail to segment continuous monitoring data into time periods, making it impossible to capture the characteristics of indicator changes in different time periods, and lacking a fluctuation range definition mechanism based on trend analysis and residual statistics, thus failing to adapt to the dynamic fluctuation law of indicators. This method achieves the goal of splitting and capturing the changing trends of monitoring indicators in different time periods, and quantitatively determining the normal bidirectional fluctuation range of data around the trend in each time period.

[0073] In a preferred embodiment of the present invention, step 3 above may include:

[0074] Step 3.1: Calculate the standard deviation and determine the confidence interval based on the data distribution within the bidirectional data fluctuation interval, and establish the data fluctuation range. Specifically, this includes: First, processing different data segments of the online education platform server cluster, such as the weekday peak data segment and the early morning low-peak data segment, respectively. Taking the peak data segment as an example, extract all normal memory usage data within the bidirectional data fluctuation interval of the data segment; by statistically calculating the dispersion of the data, obtain the standard deviation of the data within the interval; then, based on the reliability standards commonly used in intelligent operation and maintenance, determine a confidence interval that can cover 95% of normal data. The interval will accurately include most of the memory usage data that conforms to the normal fluctuation pattern during the peak business period, while excluding short-term spikes in abnormal data caused by temporary data backups. Establish a data fluctuation range adapted to its own characteristics for each data segment to ensure that the range can truly reflect the normal fluctuation boundary of the corresponding time period indicator.

[0075] Step 3.2: Based on the established data fluctuation range, select multiple representative sampling locations along the time axis within the inner boundary and outer area of ​​the data fluctuation range. Specifically, this includes: selecting sampling locations along the time axis based on the established data fluctuation range for each data segment and the business time patterns of the online education platform; taking a weekday as an example, from 8:00 AM to 10:00 PM, dividing the time interval into hourly segments, selecting sampling locations both within the inner boundary of the data fluctuation range and in the outer area of ​​the fluctuation range, such as locations close to but not exceeding the boundary, or locations that occasionally briefly exceed the boundary but quickly recover, including key time points before and after temporary backup operations. At least 20 representative sampling locations are selected for each data segment to ensure that the sampling points cover different states of normal fluctuation of the indicators and key time nodes within the time period.

[0076] Step 3.3 involves analyzing the temporal distribution characteristics of monitoring data values ​​at multiple sampling locations. Through fitting, an upper and lower envelope representing periodic changes are formed, constructing a complete periodic envelope. Specifically, this includes arranging all sampling locations in chronological order, extracting the memory usage monitoring data values ​​corresponding to each sampling location, and analyzing the temporal distribution characteristics of these data values ​​over time. It was found that during weekdays, the sampling data values ​​from 8 AM to 10 PM generally remain at a high level, while the sampling data values ​​from 12 AM to 6 AM drop to a lower level. Furthermore, the changing trends of the sampling data values ​​during the same time period each week are highly similar, exhibiting a periodic pattern. Based on this characteristic, curve fitting is used to connect the highest normal points of the sampling data values ​​in each time period sequentially, forming an upper envelope that represents the boundary of the highest periodic fluctuation of the indicator. Then, the lowest normal points of the sampling data values ​​in each time period are connected sequentially, forming a lower envelope that represents the boundary of the lowest periodic fluctuation of the indicator.

[0077] Step 3.4: Based on the constructed periodic envelope, the data is calibrated and adjusted according to preset business tolerance parameters to obtain candidate data for dynamic monitoring baseline. Specifically, this involves: first, obtaining the preset business tolerance parameters from the online education platform's operations team. These parameters are set according to the platform's actual business needs. For example, considering the high requirements for system stability during peak weekday business hours such as live course streaming and homework submission, a small fluctuation of 1% in memory usage is allowed above the upper boundary of the periodic envelope to avoid triggering unnecessary alarms due to minor fluctuations. During off-peak hours in the early morning, the system load is lower, and the tolerance for abnormal fluctuations is even lower; therefore, fluctuations exceeding the envelope boundary are not allowed. Based on these parameters, the constructed periodic envelope is calibrated and adjusted: the upper envelope value during peak business hours is appropriately increased by 1%, while the envelope boundary during off-peak hours remains unchanged. The calibrated periodic envelope is the candidate data for dynamic monitoring baseline.

[0078] In this embodiment of the invention, a data fluctuation range is established by calculating the standard deviation and determining the confidence interval based on the data distribution within the bidirectional data fluctuation range. Based on the range along the time axis, multiple representative sampling positions are selected in the inner boundary and outer region of the fluctuation range. The temporal distribution characteristics of the monitoring data values ​​at the sampling positions are analyzed, and upper and lower envelopes representing periodic changes are formed through fitting. Then, the periodic envelopes are calibrated and adjusted in combination with preset business tolerance parameters. Therefore, this method overcomes the technical problems of traditional static monitoring baselines failing to capture the periodic change patterns of indicators and failing to adjust according to actual business needs, resulting in poor adaptability between the baseline and the business operation status. Thus, it achieves the goal of establishing a data fluctuation range that can accurately reflect the periodic fluctuation patterns of indicators and generating dynamic monitoring baseline candidate data that fits the business tolerance requirements.

[0079] In a preferred embodiment of the present invention, step 4 above may include:

[0080] Step 4.1: Based on the normal fluctuation range defined by the dynamic monitoring baseline candidate data, perform anomaly determination on each data point in the historical monitoring dataset to obtain the anomaly determination result. Specifically, this includes: receiving the dynamic monitoring baseline candidate data, which clarifies the normal fluctuation range of memory usage of the online education platform server cluster at different times, such as a higher range during weekday peak business hours and a lower range during the early morning off-peak hours; calling the historical monitoring dataset, extracting each memory usage data point in the dataset one by one, matching the collection time of each data point with the normal fluctuation range of the corresponding time period, and determining whether the value of the data point is within the normal fluctuation range of the matched time period; if it is within the range, it is determined to be a normal data point; if it is outside the range, it is determined to be an abnormal data point, and finally forming a record containing the normal or abnormal determination results of all data points.

[0081] Step 4.2 identifies transient abnormal data points that exceed the normal fluctuation range based on the anomaly determination results. This includes: analyzing all data points determined to be abnormal based on the anomaly determination results; checking whether there were short-term operations such as temporary data backups at the time corresponding to the abnormal data points, in conjunction with the business operation logs of the online education platform; if an abnormal data point lasts only for a short time and there are temporary operation records at the corresponding time, and then quickly recovers to the normal fluctuation range, such as the memory usage rate briefly exceeding the normal range during peak hours due to temporary data backup and falling back within 10 minutes, then it is identified as a transient abnormal data point; abnormal data points that last for a long time and have no temporary operation records are not classified as transient anomalies for the time being.

[0082] Step 4.3 involves filtering and removing transient abnormal data points from the historical monitoring dataset to obtain the filtered and removed results. Specifically, this includes: locating the corresponding locations of the identified transient abnormal data points in the historical monitoring dataset, including the specific collection time, server identifier, and value; then completely removing the transient abnormal data points from the historical monitoring dataset, ensuring that the dataset after removal only retains data points within the normal fluctuation range of each time period, as well as other data not identified as transient abnormalities, thus obtaining the dataset after filtering and removing transient abnormal data.

[0083] Step 4.4: Based on the results of filtering and removal, obtain the purified baseline learning sample. Specifically, check the dataset after filtering and removal to confirm that all identified transient abnormal data points have been removed and that the remaining data fully covers all time periods within the set historical period, including weekday business peaks, early morning off-peaks, and weekends, without any missing data or time period gaps. After confirming that there are no errors, use the dataset as the purified baseline learning sample.

[0084] In this embodiment of the invention, an anomaly determination is performed on each data point in the historical monitoring dataset using the normal fluctuation range defined by the candidate data of the dynamic monitoring baseline as the standard. Instantaneous abnormal data points that exceed the range are identified and filtered out from the historical monitoring dataset to obtain purified baseline learning samples. This overcomes the technical problem in traditional technical solutions where the lack of an anomaly filtering mechanism leads to the mixing of instantaneous abnormal data generated by temporary operations into the baseline learning samples, thereby causing baseline deviation and affecting the accuracy of monitoring. In this way, the technical effect of removing interference data from the original data and obtaining a high-purity baseline learning sample that can truly reflect the normal operating state is achieved, thus ensuring the accuracy of the final dynamic monitoring baseline.

[0085] In a preferred embodiment of the present invention, step 5 above may include:

[0086] Step 5.1: Based on the purified baseline learning samples, the time series segmentation processing, trend fitting calculation, and bidirectional data fluctuation range determination process are re-executed to obtain the updated bidirectional data fluctuation range. Specifically, this includes: first, obtaining the output purified baseline learning samples, where the instantaneous abnormal memory usage data caused by temporary data backup in the online education platform server cluster has been removed, and only the indicator data under normal business operation is retained; then, the time series segmentation processing is re-executed on the samples: combining the platform's business cycle pattern, the purified sample data is divided into multiple independent segments, with the weekday peak period from 8:00 AM to 10:00 PM and the off-peak period from 12:00 AM to 6:00 AM as the dividing line. First, time series data segments are established to ensure that the data within each segment reflects the normal indicator change characteristics of the corresponding time period. Then, trend fitting calculations are performed on each newly divided data segment. Linear regression analysis is used to obtain a fitting straight line that better fits the normal data trend. For example, the fitting straight line for peak business periods can more accurately reflect the pattern that memory utilization is stable at a high level during the period, avoiding interference from previous abnormal data on the trend. Finally, based on the newly obtained trend fitting straight line, the center data point of each line is determined, and the residual between each normal actual data point in the data segment and the trend fitting straight line is calculated. The fluctuation boundaries above and below the center data point are re-determined according to the residual distribution, forming an updated two-way data fluctuation range.

[0087] Step 5.2 involves re-performing the data fluctuation range calculation, periodic envelope construction, and baseline calibration parameter determination processes based on the updated bidirectional data fluctuation range to obtain an optimized dynamic monitoring baseline. Specifically, this includes: recalculating the standard deviation of data within each data segment based on the updated bidirectional data fluctuation range; determining a confidence interval that covers 95% of normal data; and establishing a precise data fluctuation range. For example, the normal fluctuation range of memory usage during peak business hours no longer includes the previously excessively high upper limit caused by abnormal data, better reflecting the actual fluctuation boundaries of indicators in normal business scenarios. Subsequently, based on the updated data fluctuation range, multiple representative sampling locations are selected along the time axis, and normal memory usage data at each sampling location is extracted. Analyzing the temporal distribution characteristics of these data reveals a clearer periodic pattern where data remains high during weekday peak hours and drops to low levels during the early morning off-peak hours, with more stable data fluctuations within the period. Based on this characteristic, the periodic envelope construction is re-performed. The upper and lower envelopes formed through fitting processing more accurately represent the upper and lower limits of normal fluctuations in indicators at different times. Finally, by combining the business tolerance parameters preset by the online education platform, the baseline calibration parameters were redefined, the periodic envelope was calibrated and adjusted, and the optimized dynamic monitoring baseline was finally obtained.

[0088] In this embodiment of the invention, a technical approach is adopted that, based on the purified baseline learning samples, the process of first re-executing time series segmentation processing, trend fitting calculation, and determination of bidirectional data fluctuation range is performed to obtain an updated bidirectional data fluctuation range. Then, based on the updated range, the process of calculating the data fluctuation range, constructing the periodic envelope, and determining the baseline calibration parameters is performed again. Therefore, this approach overcomes the technical problems of insufficient baseline accuracy obtained from learning from original samples containing instantaneous abnormal data, and the lack of a baseline iteration optimization mechanism in traditional techniques to correct deviations, resulting in poor adaptability of the baseline to the normal operation of the system. As a result, the optimized dynamic monitoring baseline obtained at the end is more in line with the core indicator change patterns under the normal operation of the server cluster, more accurately adapts to the periodic fluctuation characteristics of the business, and significantly improves the overall accuracy of the baseline.

[0089] In a preferred embodiment of the present invention, step 6 above may include:

[0090] Step 6.1 involves deploying the optimized dynamic monitoring baseline to the real-time monitoring of the target server cluster to obtain the optimized dynamic monitoring baseline. Specifically, this includes: the baseline update unit acquiring the optimized dynamic monitoring baseline, which is precisely adapted to the business cycle characteristics of the online education platform server cluster, including the normal fluctuation range of memory usage during peak business hours on weekdays and the normal fluctuation range during off-peak hours in the early morning; the baseline update unit loading the optimized dynamic monitoring baseline into the real-time monitoring of the target server cluster through an internal data interface, covering the memory usage monitoring of all servers in the cluster; during the deployment process, the real-time monitoring will automatically update the original static threshold configuration, replacing it with the dynamic fluctuation range corresponding to each time period in the new baseline, and verifying the integrity and format compatibility of the baseline data to ensure that the real-time monitoring can normally call the optimized dynamic monitoring baseline to carry out subsequent monitoring work.

[0091] Step 6.2: Based on the deployed and optimized dynamic monitoring baseline, real-time monitoring continuously collects the current operating status data of the target server cluster and performs real-time comparison and analysis with the optimized dynamic monitoring baseline to obtain the results of the real-time comparison and analysis. Specifically, after the deployment of the optimized dynamic monitoring baseline, real-time monitoring starts to continuously collect the current memory usage data of each server in the target server cluster at a preset frequency, such as once per minute during peak business hours and once every five minutes during off-peak hours, while recording the corresponding data collection time. For each piece of current monitoring data collected, real-time monitoring first determines its time period. For example, if a piece of data is collected at 9:00 AM on a weekday, it is determined to be data from the peak business period; if it is collected at 3:00 AM, it is determined to be data from the off-peak period. Then, the value of the data is compared in real-time with the normal fluctuation range of the corresponding time period in the optimized dynamic monitoring baseline. If the value is within the range, it is marked as normal; if it is outside the range, it is marked as suspected abnormal, forming a real-time record containing the comparison results of each piece of current data.

[0092] Step 6.3: Based on the results of real-time comparison analysis, real-time monitoring identifies abnormal states exceeding the baseline according to preset alarm rules and generates corresponding abnormal alarm information to complete the update of the dynamic monitoring baseline and the application of real-time monitoring. Specifically, real-time monitoring identifies anomalies in the real-time comparison analysis results based on preset alarm rules, such as triggering an alarm if the value exceeds the baseline range for more than 5 minutes during peak hours and triggering an alarm if the value exceeds the range during off-peak hours, excluding brief exceedances during known temporary data backup periods. For example, if a server's memory usage exceeds the peak hour baseline limit at 10:00 AM on a weekday for 6 minutes without any temporary operation records, it is determined to be an abnormal state; if a server's memory usage exceeds the off-peak hour baseline limit at 2:00 AM, it is directly determined to be an abnormal state. For the identified abnormal states, real-time monitoring automatically generates alarm information including the time of occurrence of the anomaly, the server number involved, the current value, the baseline range, and the anomaly type, such as suspected memory leak, and sends it to the operation and maintenance management platform. At the same time, real-time monitoring archives the baseline update record, completing the update and implementation of the dynamic monitoring baseline and the application of real-time monitoring, achieving accurate monitoring and timely early warning of the cluster's operating status.

[0093] In this embodiment of the invention, a baseline update unit is used to deploy the optimized dynamic monitoring baseline to the real-time monitoring of the target server cluster. The real-time monitoring continuously collects the current operating status data of the cluster and compares and analyzes it with the baseline in real time. Then, according to the preset alarm rules, it identifies abnormal states that exceed the baseline and generates corresponding alarm information. Therefore, it overcomes the technical problems of traditional static baseline deployment, which cannot dynamically adapt to changes in system operation, real-time monitoring and baseline disconnection leading to frequent false alarms and missed alarms, and requires a lot of manual verification of alarms and has a delayed response. Thus, it achieves the real-time application of dynamic monitoring baseline, makes the current monitoring data accurately match the optimized baseline that fits the business rules, reduces the false alarm and missed alarm rate, reduces the cost of manual intervention, and meets the core technical requirements of intelligent operation and maintenance of the target server cluster for real-time monitoring, accuracy and automated alarm.

[0094] like Figure 2 As shown, embodiments of the present invention also provide an intelligent operation and maintenance learning system for monitoring baselines, including:

[0095] The acquisition module is used to collect monitoring data of multiple core indicators of the target server cluster within a set historical period to obtain a historical monitoring dataset.

[0096] The calculation module is used to perform time-series segmentation processing on the historical monitoring dataset to obtain a set of time-series data segments; to perform trend fitting on the set of time-series data segments using a linear regression algorithm to obtain the corresponding trend fitting line; to determine the center data point based on the trend fitting line, and to determine the bidirectional data fluctuation range based on the residual analysis results at the center data point; to calculate the standard deviation confidence interval based on the bidirectional data fluctuation range as the data fluctuation range, and to select multiple sampling locations inside and outside the data fluctuation range; to generate a periodic envelope based on the temporal distribution characteristics of the multiple sampling locations; and to calculate the baseline calibration parameters based on the periodic envelope to obtain candidate data for dynamic monitoring baselines.

[0097] The purification module is used to identify and filter instantaneous abnormal data in the baseline candidate data to obtain purified baseline learning samples.

[0098] The optimization module is used to relearn the purified baseline learning samples to obtain an optimized dynamic monitoring baseline.

[0099] The update module is used to judge the current monitoring and alarms of the target server cluster based on the optimized dynamic monitoring baseline, so as to complete the update of the dynamic monitoring baseline.

[0100] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An intelligent operation and maintenance learning method for monitoring baselines, characterized in that, The method includes: Collect monitoring data of multiple core indicators of the target server cluster within a set historical period to obtain a historical monitoring dataset; The historical monitoring dataset is segmented into time series data segments to obtain a set of time series data segments. A trend fitting is performed on the set of time series data segments using a linear regression algorithm to obtain the corresponding trend fitting line. The center data point is determined based on the trend fitting line, and the bidirectional data fluctuation range is determined based on the residual analysis results at the center data point. The standard deviation confidence interval is calculated based on the bidirectional data fluctuation range as the data fluctuation range, and multiple sampling locations are selected inside and outside the data fluctuation range; a periodic envelope is generated based on the temporal distribution characteristics of the multiple sampling locations; and baseline calibration parameters are calculated based on the periodic envelope to obtain dynamic monitoring baseline candidate data. Transient outlier data identification and filtering are performed on the baseline candidate data to obtain purified baseline learning samples; The purified baseline learning samples are relearned to obtain the optimized dynamic monitoring baseline. The current monitoring and alarms of the target server cluster are judged based on the optimized dynamic monitoring baseline in order to complete the update of the dynamic monitoring baseline.

2. The intelligent operation and maintenance learning method for monitoring baselines according to claim 1, characterized in that, Collect monitoring data on multiple core metrics of the target server cluster within a set historical period to obtain a historical monitoring dataset, including: The system performs unified scheduling and collection of multiple core metrics from each server in the target server cluster to obtain an initial monitoring data stream. The initial monitoring data stream is initially cleaned and formatted to eliminate noise and format inconsistencies, in order to obtain an intermediate dataset with standardized timestamps and a unified data structure. The intermediate datasets are aggregated and persistently stored through storage devices, ultimately resulting in a complete and standardized historical monitoring dataset that can be directly accessed.

3. The intelligent operation and maintenance learning method for monitoring baselines according to claim 2, characterized in that, The historical monitoring dataset is segmented into time series data segments to obtain a set of time series data segments; the set of time series data segments is then fitted with a trend using a linear regression algorithm to obtain the corresponding trend fitting line; The center data point is determined based on the trend-fitted straight line, and the bidirectional data fluctuation range is determined based on the residual analysis results at the center data point, including: The dataset is segmented into time series data segments, dividing continuous monitoring data into multiple independent time series data segments to obtain a set of time series data segments. Perform linear regression analysis on each data segment in the time series data set to obtain the trend fitting line corresponding to each data segment; By determining the center data point of each trend fitting line, and based on the center data point of each trend fitting line, the residual between each actual data point in the corresponding data segment and the trend fitting line is calculated. Based on the distribution of the residuals, the data fluctuation boundaries above and below the central data point are determined, ultimately yielding the bidirectional data fluctuation range.

4. The intelligent operation and maintenance learning method for monitoring baselines according to claim 3, characterized in that, The standard deviation confidence interval is calculated based on the two-way data fluctuation interval as the data fluctuation range, and multiple sampling locations are selected inside and outside the data fluctuation range. A periodic envelope is generated based on the temporal distribution characteristics of multiple sampling locations; Baseline calibration parameters are calculated based on the periodic envelope to obtain dynamic monitoring baseline candidate data, including: Calculate the standard deviation and determine the confidence interval based on the data distribution within the two-way data fluctuation range, and establish the data fluctuation range; Based on the established data fluctuation range, multiple representative sampling locations are selected along the time axis between the inner boundary and the outer region of the data fluctuation range. The temporal distribution characteristics of monitoring data values ​​at multiple sampling locations are analyzed, and upper and lower envelopes representing periodic changes are formed through fitting processing to construct a complete periodic envelope. Based on the constructed periodic envelope, calibration and adjustment are performed according to preset business tolerance parameters to finally obtain candidate data for dynamic monitoring baseline.

5. The intelligent operation and maintenance learning method for monitoring baselines according to claim 4, characterized in that, Transient outlier identification and filtering are performed on the baseline candidate data to obtain purified baseline learning samples, including: Based on the normal fluctuation range defined by the candidate data of the dynamic monitoring baseline, anomaly determination is performed on each data point in the historical monitoring dataset to obtain the anomaly determination result. Based on the results of the anomaly determination, instantaneous abnormal data points that exceed the normal fluctuation range are identified; The instantaneous abnormal data points are filtered out and removed from the historical monitoring dataset to obtain the filtered and removed results; The purified baseline learning sample is obtained based on the results after filtering and removal.

6. The intelligent operation and maintenance learning method for monitoring baselines according to claim 5, characterized in that, The purified baseline learning samples are relearned to obtain an optimized dynamic monitoring baseline, including: Based on the purified baseline learning samples, the time series segmentation, trend fitting calculation, and bidirectional data fluctuation range determination processes are re-executed to obtain the updated bidirectional data fluctuation range. Based on the updated bidirectional data fluctuation range, the data fluctuation range calculation, periodic envelope construction, and baseline calibration parameter determination processes are performed again to obtain the optimized dynamic monitoring baseline.

7. The intelligent operation and maintenance learning method for monitoring baselines according to claim 6, characterized in that, Based on the optimized dynamic monitoring baseline, the current monitoring and alarm assessments of the target server cluster are performed to update the dynamic monitoring baseline, including: The optimized dynamic monitoring baseline is deployed to the real-time monitoring of the target server cluster to obtain the optimized dynamic monitoring baseline. Based on the optimized dynamic monitoring baseline that has been deployed, the system continuously collects the current operating status data of the target server cluster in real time, and compares and analyzes the collected current monitoring data with the optimized dynamic monitoring baseline in real time to obtain the results of the real-time comparison and analysis. Based on the results of real-time comparison and analysis, the system monitors in real time, identifies abnormal states that exceed the baseline according to preset alarm rules, and generates corresponding abnormal alarm information to complete the dynamic monitoring baseline update and real-time monitoring application.

8. An intelligent operation and maintenance learning system for monitoring baselines, the system implementing the method as described in any one of claims 1 to 7, characterized in that, include: The acquisition module is used to collect monitoring data of multiple core indicators of the target server cluster within a set historical period to obtain a historical monitoring dataset. The calculation module is used to perform time-series segmentation processing on the historical monitoring dataset to obtain a set of time-series data segments; The time series data set is fitted with a trend using a linear regression algorithm to obtain the corresponding trend fitting line; the center data point is determined based on the trend fitting line, and the bidirectional data fluctuation range is determined based on the residual analysis results at the center data point; The standard deviation confidence interval is calculated based on the two-way data fluctuation interval as the data fluctuation range, and multiple sampling locations are selected inside and outside the data fluctuation range. A periodic envelope is generated based on the temporal distribution characteristics of multiple sampling locations; Baseline calibration parameters are calculated based on periodic envelopes to obtain dynamic monitoring baseline candidate data; The purification module is used to identify and filter instantaneous abnormal data in the baseline candidate data to obtain purified baseline learning samples. The optimization module is used to relearn the purified baseline learning samples to obtain an optimized dynamic monitoring baseline. The update module is used to judge the current monitoring and alarms of the target server cluster based on the optimized dynamic monitoring baseline, so as to complete the update of the dynamic monitoring baseline.

9. A computing device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program that, when executed by a processor, implements the method as described in any one of claims 1 to 7.

Images