Method and device for automatically recording abnormal events, storage medium, and electronic device

Abstract

The present disclosure relates to the field of computers, and provides a method and device for automatically recording abnormal events, a computer storage medium, and an electronic device. The method for automatically recording abnormal events includes: detecting a target server to obtain abnormal data; storing the abnormal data in a buffer in a preset format to update the abnormal records in the buffer; processing the updated abnormal records according to preset rules to obtain a first target abnormal record; and updating the abnormal event records in a database table according to the first target abnormal record. On the one hand, the method of the present disclosure can automatically complete the accurate identification of abnormal events, avoid manual intervention, reduce manpower and costs, and improve identification efficiency; on the other hand, it can remove invalid records from a large number of abnormal records, greatly improving operation and maintenance efficiency and system high availability.

Description

Background Art

[0002] With the rapid development of cloud computing and artificial intelligence technologies, the scale of Internet companies' data centers is constantly expanding, and the number of servers is also increasing by orders of magnitude, supporting the rapid growth and expansion of Internet companies' businesses. However, the server operation and maintenance management methods in data centers are not keeping up with the times and seem to be unable to cope with the situation.

[0003] In terms of server abnormality management, accurate and efficient recording of server abnormal event information can provide reference for server maintenance, detection, and abnormal alarms. At present, many companies use spreadsheets to record abnormal events, and some companies' data centers use the function of integrating abnormal event recording in the monitoring system, that is, when the monitoring system detects abnormal server connectivity, it writes the relevant information of the event into the database. However, whether using spreadsheets or management systems to record server abnormal events, manual entry is required. This method is inefficient, error-prone, and cannot be automated in the scenario of large-scale data centers. In addition, the function of integrating abnormal event recording in the monitoring system is relatively simple, and it is impossible to achieve record convergence and remove invalid records, making the obtained event record information very redundant or even unreliable, and the value of reference and mining is greatly reduced.

[0004] In view of this, there is an urgent need in the art to develop a new method and device for automatically recording abnormal events.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure. Summary of the invention

[0006] The purpose of the present disclosure is to provide a method for automatically recording abnormal events, an apparatus for automatically recording abnormal events, a computer storage medium and an electronic device, thereby avoiding manual identification of abnormal events to at least a certain extent, reducing manpower and costs and improving accuracy by automatically completing the identification of abnormal events; and being able to remove invalid records, and being able to continue to work stably even when the number of servers increases dramatically, greatly improving operation and maintenance efficiency and the high availability of the system.

[0007] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0008] According to a first aspect of the present disclosure, a method for automatically recording abnormal events is provided, characterized by comprising:

[0009] Probe the target server to obtain abnormal data;

[0010] Storing the abnormal data in a buffer in a preset format to update the abnormal record in the buffer;

[0011] Process the updated abnormal record according to a preset rule to obtain a first target abnormal record;

[0012] Update the abnormal event record in the database table according to the first target abnormal record.

[0013] In an exemplary embodiment of the present disclosure, the detection includes a first detection and a second detection; detecting a target server to obtain abnormal data, including:

[0014] Perform the first detection on the target server to determine whether to perform the second detection according to the detection result;

[0015] When the detection result is passed, continue to perform the second detection on the target server to obtain the abnormal data;

[0016] When the detection result is not passed, use the data corresponding to the detection result as the abnormal data.

[0017] In an exemplary embodiment of the present disclosure, the first detection is an Internet Packet Explorer detection, and the second detection is a Secure Shell Protocol detection.

[0018] In an exemplary embodiment of the present disclosure, the preset format is <IP: event type: write time: write count>, where the IP is the IP address of the target server, the event type is the event type corresponding to the abnormal data, the write time is the latest write time of the abnormal data, and the write count is the write count of the abnormal data in the buffer.

[0019] In an exemplary embodiment of the present disclosure, multiple abnormal records are stored in the buffer; storing the abnormal data in the buffer in a preset format to update the abnormal records in the buffer, including:

[0020] Match the combination of the IP address and event type corresponding to the abnormal data with the combinations of the IP address and event type of each abnormal record, and determine whether there is a second target abnormal record in the buffer that matches the combination of the IP address and event type corresponding to the abnormal data;

[0021] If it is determined that there is the second target abnormal record, increment the write count in the second target abnormal record by one to update the second target abnormal record.

[0022] In an exemplary embodiment of the present disclosure, storing the abnormal data in the buffer in a preset format to update the abnormal records in the buffer, including:

[0023] If it is determined that the second target abnormal record does not exist, the abnormal data is formed into a new record according to the preset format, and the new record is stored in the buffer.

[0024] In an exemplary embodiment of the present disclosure, the updated abnormal record is processed according to a preset rule to obtain a first target abnormal record, including:

[0025] Obtaining a target write count according to the write count in the abnormal record;

[0026] Comparing the target write count with a first preset value to determine whether the abnormal record is the first target abnormal record;

[0027] When the target writing times is greater than the first preset value, the exception record is the first target exception record.

[0028] In an exemplary embodiment of the present disclosure, the method further includes: when the target number of write times is less than or equal to the first preset value, obtaining a first time difference between the write time in the abnormal record and the current moment;

[0029] Comparing the first time difference with a second preset value to determine whether to clear the abnormal record;

[0030] When the first time difference is greater than the second preset value, the abnormal record is cleared.

[0031] In an exemplary embodiment of the present disclosure, obtaining a target number of writes according to the number of writes in the abnormal record includes:

[0032] Calculate the positive square root of the number of write times in the abnormal record;

[0033] A maximum integer is obtained for the positive square root, and the maximum integer is used as the target number of write times.

[0034] In an exemplary embodiment of the present disclosure, updating the abnormal event record in the database table according to the first target abnormal record includes:

[0035] Obtaining a combination of an IP address and an event type in the first target abnormal record;

[0036] Determine whether there is a target abnormal event record in the database table that matches the combination of the IP address and the event type in the first target abnormal record;

[0037] When it is determined that the target abnormal event record exists, determining an update mode of the database table according to a write time in the first target abnormal event record and a write time in the target abnormal event record;

[0038] When it is determined that the target abnormal event record does not exist, the first target abnormal event record is written into the database table.

[0039] In an exemplary embodiment of the present disclosure, determining the update mode of the database table according to the write time in the first target abnormal record and the write time in the target abnormal event record includes:

[0040] Obtain a second time difference between a writing time in the first target abnormality record and a writing time in the target abnormal event record;

[0041] Comparing the second time difference with a third preset value to determine whether to replace the target abnormal event record with the first target abnormal event record;

[0042] When the second time difference is less than or equal to the third preset value, replacing the target abnormal event record with the first target abnormal record;

[0043] When the second time difference is greater than the third preset value, the first target abnormal record is written into the database.

[0044] In an exemplary embodiment of the present disclosure, the updated abnormal record is processed according to a preset rule to obtain a first target abnormal record, including:

[0045] The updated exception record is fully checked and operated according to the preset rule and at intervals of a preset time period to obtain the first target exception record.

[0046] According to a second aspect of the present disclosure, there is provided a device for automatically recording abnormal events, characterized in that it comprises:

[0047] The detection module is used to detect the target server to obtain abnormal data;

[0048] A first updating module, used for storing the abnormal data in a buffer in a preset format to update the abnormal record in the buffer;

[0049] An abnormal record acquisition module, used for processing the updated abnormal record according to a preset rule to obtain a first target abnormal record;

[0050] The second updating module is used to update the abnormal event record in the database table according to the first target abnormal record.

[0051] According to a third aspect of the present disclosure, there is provided a computer storage medium on which a computer program is stored, characterized in that when the computer program is executed by a processor, the method for automatically recording abnormal events is implemented.

[0052] According to a fourth aspect of the present disclosure, there is provided an electronic device, characterized in that it includes:

[0053] Processor; and

[0054] A memory, configured to store executable instructions of the processor;

[0055] Wherein, the processor is configured to perform the above-mentioned method of automatically recording abnormal events by executing the executable instructions.

[0056] It can be seen from the above technical solutions that the method for automatically recording abnormal events, the device for automatically recording abnormal events, the computer storage medium and the electronic device in the exemplary embodiments of the present disclosure have at least the following advantages and positive effects:

[0057] The method for automatically recording abnormal events disclosed in the present invention acquires abnormal data by detecting the target server; stores the abnormal data in a buffer in a preset format to update the abnormal records in the buffer; then processes the updated abnormal records in accordance with preset rules to acquire a first target abnormal record; and finally updates the abnormal event record in the database table according to the first target abnormal record. On the one hand, the method disclosed in the present invention can automatically complete the accurate identification of abnormal events, avoid manual intervention, reduce manpower and cost, and improve identification efficiency; on the other hand, it can remove invalid records in a large number of abnormal records, greatly improving operation and maintenance efficiency and system high availability.

[0058] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0060] Figure 1 A schematic flow chart showing a method for automatically recording abnormal events in an exemplary embodiment of the present disclosure;

[0061] Figure 2 An example diagram showing an application scenario of the method for automatically recording abnormal events in an exemplary embodiment of the present disclosure;

[0062] Figure 3 A flow chart showing a detection process of a target server in an exemplary embodiment of the present disclosure is shown;

[0063] Figure 4 A schematic diagram showing a process of processing abnormal records in an exemplary embodiment of the present disclosure is shown;

[0064] Figure 5 A schematic diagram showing a flow chart of updating an abnormal event record in a database table according to a first target abnormal record in an exemplary embodiment of the present disclosure;

[0065] Figure 6 A schematic diagram showing the structure of a device for automatically recording abnormal events in an exemplary embodiment of the present disclosure;

[0066] Figure 7 A schematic diagram showing the structure of a computer storage medium in an exemplary embodiment of the present disclosure;

[0067] Figure 8 A schematic structural diagram of an electronic device in an exemplary embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0068] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0069] The terms "a", "an", "the" and "said" are used in this specification to indicate the presence of one or more elements / components / etc.; the terms "including" and "having" are used to express an open-ended inclusion and mean that additional elements / components / etc. may exist in addition to the listed elements / components / etc.; the terms "first" and "second" etc. are used only as labels and are not intended to limit the quantity of their objects.

[0070] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings represent the same or similar parts, and their repeated descriptions will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities.

[0071] In view of the problems existing in the related art, the present invention proposes a method for automatically recording abnormal events. Figure 1 A flow chart showing a method for automatically recording abnormal events is shown. Figure 1 As shown, the method for automatically recording abnormal events includes:

[0072] Step S110: Detecting the target server to obtain abnormal data;

[0073] Step S120: storing the abnormal data in a buffer in a preset format to update the abnormal record in the buffer;

[0074] Step S130: Processing the updated exception record according to a preset rule to obtain a first target exception record;

[0075] Step S140: updating the abnormal event record in the database table according to the first target abnormal record.

[0076] The method for automatically recording abnormal events disclosed in the present invention can automatically and accurately identify abnormal events, avoid manual intervention, reduce the investment in manpower and costs, and improve operation and maintenance efficiency and high availability of the system.

[0077] Combine the following Figure 2 The structure shown in FIG. 1 is used to describe in detail each step of the method for automatically recording abnormal events.

[0078] In step S110, the target server is detected to obtain abnormal data.

[0079] In an exemplary embodiment of the present disclosure, multiple detection services are deployed in the data center 201, and the multiple detection services are used to detect the target server 202 and obtain abnormal data of abnormalities in the hardware, software or network link of the target server 202. In order to detect the target server 202 through the detection service, it is necessary to ensure that the detection service and the target server 202 are in the same intranet and are interconnected.

[0080] In an exemplary embodiment of the present disclosure, two detection services are deployed in the data center 201 for performing a first detection and a second detection on the target server. Furthermore, the first detection is an Internet Packet Explorer (Ping) detection, and the second detection is a Secure Shell (SSH) detection. The Internet Packet Explorer Ping is a command under Windows, Unix and Linux systems. It belongs to a communication protocol and is a part of the TCP / IP protocol. The "ping" command can be used to check whether the network is connected, and then analyze and determine network failures; the Secure Shell Protocol SSH is a security protocol based on the application layer. It is currently the most reliable protocol designed to provide security for remote login sessions and other network services. The use of the SSH protocol can effectively prevent information leakage during remote management. In the present disclosure, Internet Packet Explorer detection and Secure Shell Protocol detection can detect the target server. Figure 3 The detection flow chart of the target server is shown as Figure 3 As shown, in step S301, a ping detection is performed on the target server; in step S302, it is determined whether the detection of the target server 202 is passed; in step S303, when the detection result of the ping detection at the detection end of the target server 202 is passed, the ssh detection is continued to be performed on the target server 202; in step S304, it is determined whether the detection of the ssh detection at the target server 202 is passed; specifically, a simple command can be executed for ssh login to determine whether the ssh detection is passed; in step S305, when the detection result of the ssh detection at the target server 202 is passed, it is determined that the state of the target server 202 is normal; in step S306, when the detection result of the ssh detection at the target server 202 is not passed, it is determined that the state of the target server 202 is abnormal, and there is a hardware or software abnormality; in step S307, when the detection result of the ping detection at the detection end of the target server 202 is not passed, it is determined that the state of the target server 202 is abnormal, and there is a hardware, software or network link abnormality. It should be noted that when the detection result of the ping detection is failure, it is not necessary to continue to perform ssh detection on the target server 202.

[0081] In an exemplary embodiment of the present disclosure, the number of target servers 202 may be one or more. For large enterprises, multiple target servers are usually set up. Therefore, in the present disclosure, multiple target servers can be detected simultaneously through ping detection and ssh detection. Further, the ping detection and ssh detection can detect the target servers at intervals of a preset time period, which can be set according to actual needs. For example, it can be set to 5s, 10s, etc. The present disclosure does not make specific limitations in this regard.

[0082] In step S120, the abnormal data is stored in the buffer in a preset format to update the abnormal records in the buffer.

[0083] In an exemplary embodiment of the present disclosure, after obtaining the abnormal data that causes the target server to be abnormal by detecting the target server 202, the abnormal data can be stored in the buffer to update the abnormal records in the buffer. To ensure the consistency of the storage format of the abnormal data in the buffer and facilitate data query, the abnormal data can be stored in the buffer in a preset format. In the present disclosure, the data structure of the abnormal data in the buffer can be represented as <IP: event type: write time: write count>, where IP is the IP address of the target server 202. Since the target server 202 is in the intranet environment of the data center, the IP address of the target server 202 is unique; the event type is the event type corresponding to the abnormal data. Taking the ping detection and ssh detection of the target server 202 as an example, the event types of the target server 202 being abnormal can be divided into two types: the ping detection fails, and the ping detection passes while the ssh detection fails, which can be expressed as: IPPingFailed, IPPingSuccessSShFailed; the write time is the latest write time when the abnormal data is written into the buffer. Since the same abnormal data may be detected at different times, when writing into the buffer, the records corresponding to the same abnormal data can be merged, and only the time when the target server is detected to be abnormal for the last time is retained, that is, the current time when writing data into the buffer each time; the write count is the number of times the abnormal data is written into the buffer. For example, if the same abnormal data is detected once or multiple times, then in the buffer, there is only one record corresponding to the abnormal data, and the write count corresponds to the number of times detected.

[0084] In an exemplary embodiment of the present disclosure, since the IP address of the target server 202 is unique, the combination formed by the IP and the event type can be used as the unique identifier of the exception record in the buffer. Further, the write count is the number of times the exception data is written, so its type is an integer. For example, the IP address corresponding to the exception data is 172.22.80.100, the event type is IPPingSuccessSShFailed, and the time when the exception data is detected is 2018-1-10 21:24:53. Then, it is possible to match according to <IP:event type> in the buffer to determine whether there is an exception record with the same <IP:event type>. If it exists, increment the write count of this exception record by one. For example, there is an exception record in the buffer as <172.22.80.100:IPPingSuccessSSh Failed:2018-1-10 21:24:48:1>. After writing this exception data into the buffer, this exception record becomes <172.22.80.100:IPPingSuccessSShFailed:2018-1-10 21:24:53:2>; if it does not exist, form a new exception record from the exception data according to the preset format and insert it into the buffer, and its specific structure is: <172.22.80.100:IPPingSuccessSShFailed:2018-1-10 21:24:53:1>.

[0085] In step S130, process the updated exception record according to a preset rule to obtain a first target exception record.

[0086] In an exemplary embodiment of the present disclosure, after storing the exception data in the buffer to complete the update of the exception record in the buffer, the exception record in the buffer can be processed to remove invalid records and retain valid records, thereby improving the storage space and operation and maintenance efficiency.

[0087] In an exemplary embodiment of the present disclosure, the exception record in the buffer can be processed at intervals of a preset time period. The preset time period can be set according to actual needs, such as set to 3 min, 5 min, etc., and the present disclosure does not make specific limitations on this. Figure 4 shows a schematic flow diagram of processing the exception record, as Figure 4 shown, in step S401, obtain a target write count according to the write count in the exception record; for example, the square root of the write count can be calculated and the positive square root can be rounded down to obtain the largest integer not greater than the positive square root, and this largest integer can be used as the target write count, and its expression is as shown in formula (1):

[0088] count'=floor(sqrt(count)) (1)

[0089] Where count is the number of writes, sqrt is the square root function, floor is the floor function, and count' is the target number of writes.

[0090] In step S402, the target write times are compared with the first preset value to determine whether the abnormal record is the first target abnormal record; in step S403, when the target write times are greater than the first preset value, the abnormal record is the first target abnormal record; in step S404, when the target write times are less than or equal to the first preset value, the first time difference between the write time in the abnormal record and the current time is obtained; in step S405, the first time difference is compared with the second preset value to determine whether to clear the abnormal record; in step S406, when the first time difference is greater than the second preset value, the abnormal record is cleared; in step S407, when the first time difference is less than or equal to the second preset value, the abnormal record is not processed and the next abnormal record is checked. Among them, the first preset value and the second preset value can be set according to actual needs, such as the first preset value can be set to 3, the second preset value can be set to 5min, etc., by comparing the target write times with 3, it is determined whether the abnormal record is the first target abnormal record, and the first time difference is compared with 5min, and the abnormal record is invalidated or retained according to different comparison results.

[0091] In step S140, the abnormal event record in the database table is updated according to the first target abnormal record.

[0092] In an exemplary embodiment of the present disclosure, after obtaining the first target abnormal record, a query may be performed in a database table according to the first target abnormal record, and the database table may be updated according to the query result. Figure 5 A schematic diagram of a process for updating an abnormal event record in a database table according to a first target abnormal record is shown. Figure 5As shown, in step S501, a combination of an IP address and an event type in a first target abnormal record is obtained; in step S502, it is determined whether there is a target abnormal event record matching the combination of the IP address and the event type in the first target abnormal record in the database table; in step S503, when it is determined that there is a target abnormal event record matching the combination of the IP address and the event type in the first target abnormal record in the database table, a second time difference between a write time in the first target abnormal record and a write time in the target abnormal event record is obtained; in step S504, the second time difference is compared with a third preset value to determine whether to replace the target abnormal event record with the first target abnormal record; in step S505, when the second time difference is greater than the third preset value, the first target abnormal record is written into the database table; in step S506, when the second time difference is less than or equal to the third preset value, the target abnormal event record is replaced with the first target abnormal record; in step S507, when it is determined that there is no target abnormal event record matching the combination of the IP address and the event type in the first target abnormal record in the database table, the first target abnormal record is written into the database table. Among them, the third preset value can be set according to actual needs, such as setting the third preset value to 24h, etc., by comparing the second time difference with 24h, the first target abnormal record is written into the database table or the abnormal event record in the database table is replaced according to different comparison results.

[0093] In an exemplary embodiment of the present disclosure, the data storage structure in the database table is different from the data storage structure in the buffer. The buffer uses the combination of IP and event type as a unique index, while the database table may contain multiple abnormal event records with the same IP and event type, so as to query historical records for scenarios such as data mining. Furthermore, in order to facilitate query, an ID field may be added to the database table as the primary key to uniquely identify the abnormal event record.

[0094] The method of automatically recording abnormal events disclosed in the present invention, after processing all records in the buffer in one cycle, all invalid or false alarm server detection abnormal event records have been cleared from the buffer, and the truly detected server abnormal event records are updated to the database table for storage, which can effectively reduce the problem of too many writes of the same abnormal event due to high detection frequency, and at the same time can reduce the false alarm of a single isolated abnormal event and the problem of repeated recording of the same abnormal event due to network jitter and other reasons, so as to achieve fully automatic, accurate and efficient recording of server abnormal events in large-scale data centers, and the recorded information can be used in real-time alarm, query and data mining and other scenarios. After receiving the alarm information, the data center operation and maintenance personnel can manually repair the target server. After locating the actual cause of the fault, the management program obtains the cause of the fault from the maintenance system and updates it to the field of the corresponding record in the database table for future reference and data mining.

[0095] The present disclosure also provides a device for automatically recording abnormal events. Figure 6 A schematic diagram of the structure of a device for automatically recording abnormal events is shown. Figure 6 As shown, the device 600 for automatically recording abnormal events may include a detection module 601, a first update module 602, an abnormal record acquisition module 603 and a second update module 604. Among them:

[0096] The detection module 601 is used to detect the target server to obtain abnormal data;

[0097] A first updating module 602, configured to store the abnormal data in a buffer in a preset format to update the abnormal records in the buffer;

[0098] The abnormal record acquisition module 603 is used to process the updated abnormal record according to a preset rule to obtain a first target abnormal record;

[0099] The second updating module 604 is used to update the abnormal event record in the database table according to the first target abnormal record.

[0100] The specific details of each module in the above-mentioned device for automatically recording abnormal events have been described in detail in the corresponding method for automatically recording abnormal events, so they will not be repeated here.

[0101] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0102] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0103] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0104] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0105] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0106] Refer to the following Figure 7 An electronic device 700 according to this embodiment of the present invention will be described. Figure 7 The electronic device 700 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0107] like Figure 7As shown, the electronic device 700 is in the form of a general computing device. The components of the electronic device 700 may include but are not limited to: at least one processing unit 710, at least one storage unit 720, and a bus 730 connecting different system components (including the storage unit 720 and the processing unit 710).

[0108] The storage unit stores program codes, which can be executed by the processing unit 710, so that the processing unit 710 performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 710 can perform the following steps: Figure 1 Step S110 shown in: detecting the target server to obtain abnormal data; step S120: storing the abnormal data in a buffer in a preset format to update the abnormal record in the buffer; step S130: processing the updated abnormal record according to preset rules to obtain a first target abnormal record; step S140: updating the abnormal event record in the database table according to the first target abnormal record.

[0109] The storage unit 720 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 7201 and / or a cache storage unit 7202 , and may further include a read-only storage unit (ROM) 7203 .

[0110] The storage unit 720 may also include a program / utility 7204 having a set (at least one) of program modules 7205, such program modules 7205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0111] Bus 730 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0112] The electronic device 700 may also communicate with one or more external devices 1100 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 700, and / or communicate with any device that enables the electronic device 700 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 750. Furthermore, the electronic device 700 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 760. As shown, the network adapter 760 communicates with other modules of the electronic device 700 via a bus 730. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0113] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0114] In an exemplary embodiment of the present disclosure, a computer storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to perform the steps of various exemplary implementations of the present invention described in the above "Exemplary Method" section of the present specification.

[0115] refer to Figure 8 As shown, a program product 800 for implementing the above method according to an embodiment of the present invention is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0116] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0117] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0118] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0119] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0120] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0121] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are to be considered as exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

Claims

1. A method for automatically recording abnormal events, characterized in that: Including: Probing a target server to obtain abnormal data; Storing the abnormal data in a buffer in a preset format to update the abnormal records in the buffer; Multiple abnormal records are stored in the buffer; Processing the updated abnormal records according to a preset rule to obtain a first target abnormal record; Updating the abnormal event records in the database table according to the first target abnormal record; Among them, the storing the abnormal data in a buffer in a preset format to update the abnormal records in the buffer includes: Matching the combination of the IP address and event type corresponding to the abnormal data with the combinations of the IP address and event type of each of the abnormal records to determine whether there is a second target abnormal record in the buffer that matches the combination of the IP address and event type corresponding to the abnormal data; if it is determined that there is the second target abnormal record, adding one to the write count in the second target abnormal record to update the second target abnormal record; The processing the updated abnormal records according to a preset rule to obtain a first target abnormal record includes: Obtaining a target write count according to the write count in the abnormal record. When the target write count is greater than a first preset value, the abnormal record is the first target abnormal record; when the target write count is less than or equal to the first preset value, if the first time difference between the write time in the abnormal record and the current time is greater than a second preset value, clearing the abnormal record.

2. The method for automatically recording abnormal events according to claim 1, characterized in that: The probing includes a first probe and a second probe; Probing a target server to obtain abnormal data includes: Performing the first probe on the target server to determine whether to perform the second probe according to the probe result; When the probe result is passed, continuing to perform the second probe on the target server to obtain the abnormal data; When the probe result is not passed, using the data corresponding to the probe result as the abnormal data.

3. The method for automatically recording abnormal events according to claim 2, characterized in that: The first probe is an Internet Control Message Protocol (ICMP) probe, and the second probe is a Secure Shell (SSH) protocol probe.

4. The method for automatically recording abnormal events according to claim 1, characterized in that: The preset format is <IP: event type: write time: write count>, where the IP is the IP address of the target server, the event type is the event type corresponding to the abnormal data, the write time is the latest write time of the abnormal data, and the write count is the write count of the abnormal data in the buffer.

5. The method for automatically recording abnormal events according to claim 1, characterized in that: Storing the abnormal data in a buffer in a preset format to update the abnormal records in the buffer includes: If it is determined that there is no second target abnormal record, forming a new record with the abnormal data according to the preset format and storing the new record in the buffer.

6. The method for automatically recording abnormal events according to claim 1, characterized in that: Processing the updated abnormal records according to a preset rule to obtain a first target abnormal record includes: Comparing the target write count with the first preset value to determine whether the abnormal record is the first target abnormal record.

7. The method for automatically recording abnormal events according to claim 6, characterized in that: The method further includes: When the target number of write times is less than or equal to the first preset value, obtaining a first time difference between the write time in the abnormal record and the current time; The first time difference is compared with the second preset value to determine whether to clear the abnormal record.

8. The method for automatically recording abnormal events according to claim 6, characterized in that: Obtaining a target write count according to the write count in the abnormal record includes: Calculate the positive square root of the number of write times in the abnormal record; A maximum integer is obtained for the positive square root, and the maximum integer is used as the target number of write times.

9. The method for automatically recording abnormal events according to claim 1, characterized in that: Updating the abnormal event record in the database table according to the first target abnormal record includes: Obtaining a combination of an IP address and an event type in the first target anomaly record; Determine whether there is a target abnormal event record in the database table that matches the combination of the IP address and the event type in the first target abnormal record; When it is determined that the target abnormal event record exists, determining an update mode of the database table according to a write time in the first target abnormal event record and a write time in the target abnormal event record; When it is determined that the target abnormal event record does not exist, the first target abnormal event record is written into the database table.

10. The method for automatically recording abnormal events according to claim 9, characterized in that: Determining the update mode of the database table according to the writing time in the first target abnormal record and the writing time in the target abnormal event record includes: Obtain a second time difference between a writing time in the first target abnormality record and a writing time in the target abnormal event record; Comparing the second time difference with a third preset value to determine whether to replace the target abnormal event record with the first target abnormal event record; When the second time difference is less than or equal to the third preset value, replacing the target abnormal event record with the first target abnormal record; When the second time difference is greater than the third preset value, the first target abnormal record is written into the database table.

11. The method for automatically recording abnormal events according to claim 1, characterized in that: The updated exception record is processed according to a preset rule to obtain a first target exception record, including: The updated exception record is fully checked and operated according to the preset rule and at intervals of a preset time period to obtain the first target exception record.

12. A device for automatically recording abnormal events, characterized in that: include: The detection module is used to detect the target server to obtain abnormal data; A first updating module, used for storing the abnormal data in a buffer in a preset format to update the abnormal records in the buffer; the buffer stores a plurality of abnormal records; An abnormal record acquisition module, used for processing the updated abnormal record according to a preset rule to obtain a first target abnormal record; A second updating module, configured to update the abnormal event record in the database table according to the first target abnormal record; The storing of the abnormal data in a buffer in a preset format to update the abnormal records in the buffer includes: Matching the combination of the IP address and event type corresponding to the abnormal data with the combination of the IP address and event type of each abnormal record, and determining whether there is a second target abnormal record in the buffer that matches the combination of the IP address and event type corresponding to the abnormal data; if it is determined that the second target abnormal record exists, adding one to the number of writes in the second target abnormal record to update the second target abnormal record; The updated exception record is processed according to a preset rule to obtain a first target exception record, including: The target write count is obtained according to the write count in the exception record. When the target write count is greater than a first preset value, the exception record is the first target exception record. When the target write count is less than or equal to the first preset value, if the first time difference between the write time in the exception record and the current time is greater than a second preset value, the exception record is cleared.

13. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for automatically recording abnormal events according to any one of claims 1 to 11 is implemented.

14. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the method for automatically recording abnormal events according to any one of claims 1 to 11 by executing the executable instructions.

Images