A method, device and equipment for monitoring application operation status

Abstract

The embodiments of this specification provide a method, device and equipment for monitoring the operation of an application, which relates to the field of artificial intelligence technology, wherein the method includes: determining a common indicator information set of multiple target applications; defining a target log format according to the common indicator information set; using a distributed search analysis engine to record logs generated by the operation of the multiple target applications; wherein the format of the logs generated by the operation of the multiple target applications is the target log format; combining the distributed search engine and the open source visualization platform, monitoring the operation of each target application based on the logs generated by the operation of the target application. In the embodiments of this specification, the reusability between each application is effectively improved, and the operation of each target application can be efficiently monitored through each common indicator in the log.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of artificial intelligence technology, and more particularly to a method, device and equipment for monitoring application operation status. Background Art

[0002] The timeliness of fault discovery is crucial in the application operation and maintenance process. The transaction logs during the operation of the application itself record the real-time status of the application operation, and clues of faults can be found through the transaction logs. In the prior art, application logs are usually visualized and customized for monitoring alarms. It is necessary to manually define a set of personalized log formats containing business and technical indicator fields for different applications, and customize monitoring visualization charts according to this format. As a result, the reusability between different applications is poor and the cost of accessing new applications is high. Therefore, the technical solutions in the prior art cannot efficiently monitor the operation status of different applications.

[0003] Currently, no effective solution has been proposed to the above problems. Summary of the invention

[0004] The embodiments of this specification provide a method, device and equipment for monitoring the running status of an application to solve the problem in the prior art that the running status of different applications cannot be monitored efficiently.

[0005] An embodiment of the present specification provides a method for monitoring the operation status of an application, comprising: determining a common indicator information set for multiple target applications; defining a target log format based on the common indicator information set; using a distributed search and analysis engine to record logs generated by the operation of the multiple target applications; wherein the format of the logs generated by the operation of the multiple target applications is the target log format; combining the distributed search engine and the open source visualization platform, and monitoring the operation status of each target application based on the logs generated by the operation of the target application.

[0006] An embodiment of the present specification also provides a device for monitoring the operation status of an application, including: a determination module, used to determine a common indicator information set of multiple target applications; a definition module, used to define a target log format according to the common indicator information set; a recording module, used to record logs generated by the operation of the multiple target applications using a distributed search analysis engine; wherein the format of the logs generated by the operation of the multiple target applications is the target log format; and a monitoring module, used to combine the distributed search engine and the open source visualization platform to monitor the operation status of each target application based on the logs generated by the operation of the target application.

[0007] The embodiment of the present specification also provides a device for monitoring the running status of an application, including a processor and a memory for storing instructions executable by the processor, and the processor implements the steps of the method for monitoring the running status of the application when executing the instructions.

[0008] The embodiments of the present specification also provide a computer-readable storage medium on which computer instructions are stored, and when the instructions are executed, the steps of the method for monitoring the running status of the application are implemented.

[0009] The embodiments of this specification provide a method for monitoring the operation of an application, which can determine a common indicator information set for multiple target applications, and define a target log format based on the common indicator information set, thereby unifying the common indicators and log formats contained in the logs of different target applications, effectively improving the reusability between applications and reducing the cost of new application access. Furthermore, a distributed search analysis engine can be used to record logs in a target log format generated by the operation of multiple target applications, and the logs generated by the operation of the target applications recorded in the above-mentioned distributed search engine can be visualized using an open source visualization platform, so that the operation of each target application can be efficiently monitored through each common indicator in the log. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The drawings described herein are used to provide a further understanding of the embodiments of this specification, constitute a part of the embodiments of this specification, and do not constitute a limitation of the embodiments of this specification. In the drawings:

[0011] Figure 1 It is a schematic diagram of the steps of a method for monitoring the running status of an application provided in an embodiment of this specification;

[0012] Figure 2 is a schematic diagram of an application overall operation status display module provided according to an embodiment of this specification;

[0013] Figure 3 It is a schematic diagram of a module for displaying the operation status of a submodule in an application provided in an embodiment of this specification;

[0014] Figure 4 It is a structural diagram of a monitoring system for application operation provided in accordance with an embodiment of this specification;

[0015] Figure 5 It is a structural diagram of a monitoring device for application operation status provided in an embodiment of this specification;

[0016] Figure 6 It is a structural diagram of a monitoring device for application operation status provided according to an embodiment of this specification. DETAILED DESCRIPTION

[0017] The principles and spirit of the embodiments of this specification will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the embodiments of this specification, and are not intended to limit the scope of the embodiments of this specification in any way. On the contrary, these embodiments are provided to make the disclosure of the embodiments of this specification more thorough and complete, and to fully convey the scope of the disclosure to those skilled in the art.

[0018] Those skilled in the art know that the implementation of the embodiments of this specification can be implemented as a system, device, method or computer program product. Therefore, the embodiments disclosed in this specification can be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0019] Although the processes described below include multiple operations that occur in a particular order, it should be clear that these processes may include more or fewer operations, and that the operations may be performed sequentially or in parallel (eg, using parallel processors or a multi-threaded environment).

[0020] See also Figure 1 This embodiment can provide a method for monitoring the running status of an application. The method for monitoring the running status of an application can be used to efficiently monitor the running status of multiple different applications. The above-mentioned method for monitoring the running status of an application can include the following steps.

[0021] S101: Determine a common indicator information set of multiple target applications.

[0022] In this embodiment, a general indicator information set of multiple target applications may be determined. The multiple target applications may be multiple applications of different industries and types that need to be monitored in real time, and the general indicator information set may include multiple general indicators.

[0023] In this embodiment, by investigating various industries and types of applications, the commonly used technical and business indicators for application operation are extracted, and the determined commonly used technical and business indicators are screened to obtain multiple general indicators. The above-mentioned general indicators may include but are not limited to at least one of the following: log type, log identifier, serial number, application abbreviation, node IP, module name, service name, method name, network point, organization, return code, resource transfer amount, resource transfer success rate, resource transfer time, number of timeout resource transfers, etc. Of course, the determination method of the general indicators is not limited to the above examples. The technical personnel in the relevant field may make other changes under the inspiration of the technical essence of the embodiments of this specification, but as long as the functions and effects achieved are the same or similar to the embodiments of this specification, they should be covered within the protection scope of the embodiments of this specification.

[0024] S102: Define a target log format according to the general indicator information set.

[0025] In this embodiment, in order to better monitor each target application, one of the effective monitoring means is log monitoring. Therefore, the target log format can be defined according to the above-mentioned general indicator information set, so as to unify the log format of each target application, so that the target application has a unified format when generating logs.

[0026] In this embodiment, the log can be divided into: transaction log, error log, batch log, etc. Among them, the transaction log can be used to count transaction responses, count transaction volume, analyze transaction process, and analyze transaction success rate. The response time of the transaction can be analyzed according to the start and end time of each transaction, and the change of transaction response can be analyzed in real time; the transaction volume can be classified and counted in real time according to the transaction message and other information of the transaction. The method of transaction log statistics can meet the demand of real-time display of application system transaction volume, while the impact on the application system is minimal. The transaction process can be sorted and analyzed according to the transaction log, and application problems can be located more efficiently from the perspective of the transaction process; the transaction success rate per unit time can be calculated in real time according to the return information statistics of each transaction in the log.

[0027] In this embodiment, the target log format can be defined according to the general indicators included in the general indicator information set, and the target log format can include all the general indicators in the general indicator information set. Since each transaction is successful or failed or has an exception, the transaction log should have clear and complete "start" and "end" identification, so that the start and end of each transaction can be clearly found in the log analysis to distinguish transactions. And because the log file may be controlled by multiple threads or processes, each transaction log should have a uniquely identifiable transaction code, such as a thread ID or process ID, during the start and end period. The determined log format can be: <timestamp> <threadid processid> <class file> <level>[Transaction information, which may be start / end / message / exception information, etc.], where TIMESTAMP is a timestamp; ThreadID / ProcessID is a thread or process ID; Class / File is the type or file of the executed transaction; Level is the log level. Of course, the method of determining the target log format is not limited to the above examples. Under the inspiration of the technical essence of the embodiments of this specification, technical personnel in the relevant field can also make other changes based on the general indicators actually determined, but as long as the functions and effects achieved are the same or similar to those of the embodiments of this specification, they should be covered within the protection scope of the embodiments of this specification.

[0028] S103: Using a distributed search analysis engine to record logs generated by the operation of multiple target applications; wherein the format of the logs generated by the operation of multiple target applications is a target log format.

[0029] In this embodiment, a distributed search analysis engine (Elasticsearch) may be used to record logs generated by the operation of multiple target applications, wherein the format of the logs generated by the operation of the multiple target applications may be a target log format.

[0030] In this embodiment, the above-mentioned distributed search and analysis engine is a search server based on Lucene. It provides a distributed multi-user full-text search engine that can easily enable large amounts of data to have the ability to search, analyze and explore. Elasticsearch is developed in Java and released as open source under the terms of the Apache license. It is a popular enterprise-level search engine. Among them, Lucene is an open source full-text search engine toolkit released by the Apache Software Foundation. Elasticsearch can be used in cloud computing to achieve real-time search, stability, reliability, speed, and easy installation and use.

[0031] In this embodiment, logs of different applications can be stored separately, and an Elasticsearch distributed log storage and search cluster can be built. In some embodiments, the Fluentd tool can be used to obtain logs generated by target applications in real time or at intervals, and a corresponding application index can be established in Elasticsearch according to the application name of each target application. The logs generated by the operation of the target application can be sent to the Elasticsearch log center for storage through HTTP requests, so that the application structured logs can be written into the Elasticsearch distributed log storage and search cluster.

[0032] In this embodiment, the HTTP request refers to a request message from the client to the server, including the resource request method, resource identifier and protocol used in the first line of the message. Fluentd is an open source log collection system that can collect a variety of logs and convert them into a format that is convenient for machine processing.

[0033] S104: Combine the distributed search engine and the open source visualization platform to monitor the operation status of each target application based on the logs generated by the operation of the target application.

[0034] In this embodiment, the above-mentioned distributed search engine and the open source visualization platform (Grafana) can be combined to monitor the operation of each target application based on the logs generated by the operation of the target application. The logs generated by the operation of the target application recorded in the above-mentioned distributed search engine can be visualized using the open source visualization platform to monitor the operation of each target application.

[0035] In this embodiment, the open source visualization platform (Grafana) is an open source data visualization tool developed in Go language (a programming language), which can perform data monitoring and data statistics, and has an alarm function. It can visually define fault identification rules for important characteristic indicators. Grafana can continuously evaluate these characteristic indicators and send notifications of fault prompt information.

[0036] In this embodiment, the operating status of each target application can be used to characterize whether an abnormality occurs during the operation of the target application. The operating status of the target application can include real-time changes in characteristic indicators among multiple general indicators that can be used to characterize the operating status. If the value of the characteristic indicator is not within the normal range, it means that an abnormality has occurred, and the root cause analysis and notification of the fault are required.

[0037] From the above description, it can be seen that the embodiments of this specification achieve the following technical effects: the common indicator information set of multiple target applications can be determined, and the target log format can be defined according to the common indicator information set, so that the common indicators and log formats contained in the logs of different target applications can be unified, effectively improving the reusability between various applications and reducing the cost of new application access. Furthermore, a distributed search analysis engine can be used to record logs in the target log format generated by the operation of multiple target applications, and the logs generated by the operation of the target applications recorded in the above-mentioned distributed search engine can be visualized using an open source visualization platform, so that the operation of each target application can be efficiently monitored through the various common indicators in the log.

[0038] In one embodiment, using a distributed search and analysis engine to record logs generated by the operation of multiple target applications may include: multiple target applications call the interface provided by the online transaction monitoring software development toolkit to generate logs in the target log format during operation, and use the Fluentd tool to obtain the logs generated by the operation of multiple target applications, and establish an index of each target application in the distributed search and analysis engine according to the application name. Further, based on the index of each target application, the logs generated by the operation of multiple target applications can be sent to the distributed search and analysis engine for storage through HTTP requests.

[0039] In this embodiment, the target log format can be defined and extracted as an online transaction monitoring SDK (Software Development Kit). The target application can introduce the SDK and call the interface provided by the SDK to record the application log, so that the application can unify the format when generating the log. In some embodiments, the online transaction monitoring SDK can also reserve a set of custom fields for the Map application to support the target application to add personalized business indicators based on the general indicators. The above-mentioned Map is used to store key-value pairs, and the key is not allowed to be repeated, but the value can be repeated.

[0040] In this embodiment, the Fluentd tool can be used to obtain the logs generated by the target application in real time or at regular intervals, and a corresponding application index can be established in Elasticsearch according to the application name of each target application. The logs generated by the target application can be sent to the Elasticsearch log center for storage via HTTP requests, so that the application structured logs can be written into the Elasticsearch distributed log storage and search cluster.

[0041] In this embodiment, the HTTP request refers to a request message from the client to the server, including the resource request method, resource identifier and protocol used in the first line of the message. Fluentd is an open source log collection system that can collect a variety of logs and convert them into a format that is convenient for machine processing.

[0042] In one embodiment, the distributed search engine and the open source visualization platform are combined to monitor the operation of each target application based on the logs generated by the operation of the target application, which may include: calling the open source visualization platform interface to create a monitoring dashboard, fault identification rules and fault notification channels for each target application based on the application name of each target application and the index of each target application in the distributed search analysis engine. Further, based on the index of each target application in the distributed search analysis engine, the operation of multiple target applications can be displayed according to the monitoring dashboard of multiple target applications.

[0043] In this embodiment, the Grafana data visualization tool can be used to build a highly available tool cluster on the cloud, and the index of each target application in the distributed search and analysis engine can be used as the data source for generating the monitoring dashboard of each target application. In order to distinguish the monitoring dashboard, the open source visualization platform interface can be called according to the application name of each target application to create a monitoring dashboard, fault identification rules and fault notification channels for each target application.

[0044] In this embodiment, different applications have different characteristics, and the corresponding fault identification rules may also be different. The above-mentioned fault notification channel can be email, text message, etc., of course, it can also be any other possible channel, such as: telephone, etc., which can be determined according to actual conditions, and this specification embodiment does not limit this.

[0045] In this embodiment, each target application can define a fault identification rule based on the corresponding characteristic indicators, such as defining a fault identification rule based on characteristic indicators such as success rate, time consumption, and timeout transaction volume, so as to define the conditions for triggering a fault alarm, such as: a fault alarm is triggered when the average success rate of resource transfer within 5 minutes is lower than 80%, etc. The specific conditions can be determined according to the actual situation, and the embodiments of this specification are not limited to this.

[0046] In this embodiment, after the monitoring dashboard, fault identification rules, fault notification channels and other information of each target application are customized in the Grafana background, they can be persistently stored in the MySQL database for subsequent calls. Among them, the above-mentioned MySQL is an open source relational database management system.

[0047] In this embodiment, the Grafana runtime engine can consume the logs of each application from the log center of the distributed search and analysis engine based on the index of each target application in the distributed search and analysis engine, thereby generating corresponding icons for front-end display based on the monitoring dashboard of each target application.

[0048] In one embodiment, based on the application name of each target application and the index of each target application in the distributed search and analysis engine, calling the open source visualization platform interface to create a new monitoring dashboard for each target application can include: determining at least one characteristic indicator from the general indicator information set, and based on the characteristic indicator, the application name of each target application and the index of each target application in the distributed search and analysis engine, calling the open source visualization platform interface to create a new monitoring dashboard for each target application; wherein, the monitoring dashboard of the target application is used to display the operating status of each characteristic indicator, and the monitoring dashboard includes: an application overall operating status display module, an application sub-module operating status display module, a node operating status display module in the sub-module, and a sub-module formal grayscale environment comparison display module.

[0049] In this embodiment, since not all indicators in the general indicators can be used to determine whether an application is abnormal, at least one characteristic indicator can be determined from the general indicator information set, and the characteristic indicators of different target applications can be different. The above characteristic indicators may include, but are not limited to: resource transfer success rate, resource transfer time consumption, number of timed resource transfers, etc., and it is understandable that other possible indicators may also be included, such as: average resource transfer success rate, etc., which can be determined according to actual conditions, and the embodiments of this specification do not limit this.

[0050] In this embodiment, a one-click access function can be implemented. The Grafana interface is called through characteristic indicators, the application names of each target application, and the indexes of each target application in the distributed search and analysis engine to achieve new applications, new users, new data sources corresponding to the indexes of each target application in the distributed search and analysis engine, new monitoring dashboards, new fault identification rules and fault notification channels, etc.

[0051] In this implementation, the target application can be supported to extend personalized business indicators in the log. The target application can abstract personalized feature indicator extensions based on the business indicators in the log, and the corresponding monitoring dashboard visualization view and fault identification rules can be adjusted online in real time according to the needs of the target application itself. After going online, the application overview view and the operation status of each level of monitoring can be viewed in real time, and the chart query logic and fault identification rules can be adjusted at any time.

[0052] In this embodiment, the monitoring dashboard and fault identification rules can be adjusted online in real time and dynamically, and the adjustment can be saved to take effect. The target application can add and modify the monitoring panel, modify the rules for querying statistical log indicators, and select line charts, bar charts, oil gauge charts, pie charts, tables and other charts for display. The specific form can be determined according to the actual situation, and this specification embodiment does not limit this.

[0053] In this embodiment, a new application overall operation status display module, an application submodule operation status display module, a submodule node operation status display module, and a submodule formal grayscale environment comparison display module can be created based on the determined characteristic indicators. Thus, the application overview of each application can be viewed by application dimension, and the application topology map can be configured based on the calling relationship between the modules of the target application. Clicking on each module on the topology map can view the submodule operation status monitoring, clicking on each module on the topology map can view the comparison monitoring of the module and its grayscale module operation, and clicking on the module's node list can view the node operation status monitoring in the module. Among them, the application overall operation status display module in the above-mentioned monitoring dashboard can be as follows: Figure 2 As shown in the figure, the submodule operation status display module in the application can be Figure 3 As shown in . FullGC is to clean up the entire heap space, including the young generation and the permanent generation. If the system frequently performs FullGC, you need to find out the cause. Slow SQL is to record the structured query statements that run slowly in the log.

[0054] In one embodiment, after calling the open source visualization platform interface to create a monitoring dashboard, fault identification rules and fault notification channels for each target application, it may also include: selecting the application name corresponding to the target user and setting the viewing authority of the target user.

[0055] In this embodiment, the application name that each user has permission to use can be set to anonymously connect to Grafana to view the application overview view and various levels of monitoring. Among them, the above-mentioned target user can be the operation and maintenance personnel, developers, etc. corresponding to the target application, and the specific one can be determined according to the actual situation, and this embodiment of the specification does not limit this.

[0056] In this implementation, since native Grafana only supports anonymous viewing of a single application, in some embodiments, the Grafana source code may be modified to implement anonymous viewing of multiple different application monitoring dashboards.

[0057] In one embodiment, after monitoring the operation of each target application based on the log generated by the operation of the target application, it can also include: if it is determined that the target application has a fault based on the log generated by the operation of the target application and the fault identification rule, a fault prompt sending request is generated, and the fault prompt sending request is placed in the target queue, and the fault prompt sending request in the target queue is pre-processed. Further, the target processing object and target fault notification channel corresponding to the target fault prompt sending request in the pre-processed target queue can be determined; wherein the target fault prompt sending request is a fault prompt sending request that is not a false alarm and determines the cause of the fault. And based on the target fault notification channel, the fault prompt information corresponding to the target fault prompt sending request is sent to the target processing object.

[0058] In this embodiment, when it is determined that the target application has a fault based on the fault identification rule, an alarm can be triggered and a fault prompt sending request can be generated. Grafana can send the fault prompt information according to the fault notification channel configured by the application. In some embodiments, the generated fault prompt sending request can be synchronously sent to the alarm processing platform.

[0059] In this embodiment, the fault prompt sending request can be put into the target queue of the alarm processing platform, and the alarm processing platform can be used for multi-threading to pre-process the fault prompt sending request in the target queue. In the actual operation process, the above target queue can be multiple.

[0060] In this embodiment, the above-mentioned preprocessing may include data cleaning, and preliminary analysis may be performed in combination with the expert database formed by the most recent alarm and the historical alarm. For example, the same alarm content of the same application received in the last 5 minutes may be screened out as a duplicate alarm. Of course, the above-mentioned preprocessing method is not limited to the above-mentioned example. Technicians in the relevant field may make other changes under the inspiration of the technical essence of the embodiments of this specification, but as long as the functions and effects achieved are the same or similar to the embodiments of this specification, they should be covered within the protection scope of the embodiments of this specification.

[0061] In this embodiment, the fault prompt sending conditions in the pre-processed target queue are all non-false alarm fault prompt sending requests. Therefore, based on the fault type and fault content corresponding to the target fault prompt sending request in the pre-processed target queue, the corresponding fault cause and recommended processing method can be determined according to historical data. If it can be determined, the target processing object and target fault notification channel corresponding to the target fault prompt sending request in the pre-processed target queue can be determined, and the fault prompt information corresponding to the target fault prompt sending request is sent to the target processing object based on the target fault notification channel.

[0062] In this embodiment, the above-mentioned fault prompt information may include the fault type, fault content and suggested processing method. The above-mentioned target processing object may be the operation and maintenance personnel or developers of the target application, etc., which can be determined according to actual conditions, and the embodiments of this specification do not limit this.

[0063] In one embodiment, after preprocessing the fault prompt sending request in the target queue, it can also include: transmitting the characteristic fault prompt sending request in the preprocessed target queue to the AIOps intelligent root cause analysis system for comprehensive fault root cause analysis; wherein, the characteristic fault prompt sending request is a fault prompt sending request that is not a false alarm and the cause of the fault has not been determined.

[0064] In this embodiment, if the fault type and fault content corresponding to the characteristic fault prompt sending request in the preprocessed target queue cannot determine the corresponding fault cause and recommended handling method based on historical data, then the characteristic fault prompt sending request in the preprocessed target queue can be transmitted to the AIOps intelligent root cause analysis system for comprehensive fault root cause analysis based on logs, system indicators, infrastructure, etc., wherein the above-mentioned characteristic fault prompt sending request is a fault prompt sending request that is not a false alarm and the fault cause has not been determined.

[0065] In this implementation, the AIOps intelligent root cause analysis system applies artificial intelligence to the field of operation and maintenance, and uses machine learning to further solve problems that automated operation and maintenance cannot solve based on existing operation and maintenance data (logs, monitoring information, application information, etc.). AIOps does not rely on manually specified rules, but advocates that machine learning algorithms automatically learn from massive operation and maintenance data, and continuously refine and summarize rules.

[0066] In one embodiment, the monitoring system for application operation status can be as follows: Figure 4 As shown in , the monitoring system architecture of application operation is divided into four layers, including the collection layer: the application APP (on the cloud or not) will generate logs in a unified format based on the online transaction monitoring SDK, use the Fluentd tool to obtain the logs generated by the application operation in real time or at intervals, and establish the corresponding application index in Elasticsearch according to the application name of each target application. The logs generated by the application operation can be sent to the Elasticsearch log center for storage through HTTP requests; storage layer: build an Elasticsearch Cluster distributed log cluster to store application logs; consumption layer: the Grafana background customizes the application monitoring dashboard, fault identification rules and fault notification channels, and stores them persistently in the MySQL database. The Grafana running engine consumes application logs from the log center and generates charts for front-end display. The monitoring triggers alarms through the alarm processing platform for alarm cleaning and AIOps root cause analysis. Presentation layer: the one-click access function can display the application overview, view monitoring by module and node, compare the formal grayscale environment monitoring, alarm list and other information.

[0067] Based on the same inventive concept, the embodiments of this specification also provide a device for monitoring the operation status of an application, such as the following embodiments. Since the principle of solving the problem by the device for monitoring the operation status of an application is similar to that of the method for monitoring the operation status of an application, the implementation of the device for monitoring the operation status of an application can refer to the implementation of the method for monitoring the operation status of an application, and the repeated parts will not be repeated. As used below, the term "unit" or "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable. Figure 5 is a structural block diagram of a monitoring device for application operation status of an embodiment of this specification, such as Figure 5 As shown, it may include: a determination module 501, a definition module 502, a recording module 503, and a monitoring module 504. The structure is described below.

[0068] A determination module 501 may be used to determine a common indicator information set of multiple target applications;

[0069] A definition module 502 may be used to define a target log format according to a common indicator information set;

[0070] The recording module 503 may be used to record the logs generated by the operation of multiple target applications using a distributed search analysis engine; wherein the format of the logs generated by the operation of multiple target applications is a target log format;

[0071] The monitoring module 504 can be used to combine the distributed search engine and the open source visualization platform to monitor the operation status of each target application based on the logs generated by the operation of the target application.

[0072] The embodiment of this specification also provides an electronic device, which can be specifically referred to in Figure 6 The electronic device composition structure diagram of the monitoring method of application operation status provided by the embodiment of this specification is shown, and the electronic device may specifically include an input device 61, a processor 62, and a memory 63. Among them, the input device 61 can be specifically used to input a common indicator information set of multiple target applications. The processor 62 can be specifically used to define the target log format according to the common indicator information set; use a distributed search and analysis engine to record the logs generated by the operation of multiple target applications; wherein the format of the logs generated by the operation of multiple target applications is the target log format; combine a distributed search engine and an open source visualization platform to monitor the operation of each target application based on the logs generated by the operation of the target application. The memory 63 can be specifically used to store parameters such as the target log format.

[0073] In this embodiment, the input device can specifically be one of the main devices for information exchange between the user and the computer system. The input device can include a keyboard, a mouse, a camera, a scanner, a light pen, a handwriting input board, a voice input device, etc.; the input device is used to input the original data and the program for processing these numbers into the computer. The input device can also obtain and receive data transmitted from other modules, units, and devices. The processor can be implemented in any appropriate manner. For example, the processor can take the form of a computer-readable medium, a logic gate, a switch, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a programmable logic controller, and an embedded microcontroller, etc., such as a microprocessor or a processor and a computer-readable program code (such as software or firmware) that can be executed by the (micro) processor. The memory can specifically be a memory device used to store information in modern information technology. The memory can include multiple levels. In a digital system, anything that can store binary data can be a memory; in an integrated circuit, a circuit with a storage function without a physical form is also called a memory, such as a RAM, a FIFO, etc.; in a system, a storage device with a physical form is also called a memory, such as a memory stick, a TF card, etc.

[0074] In this embodiment, the functions and effects specifically realized by the electronic device can be explained in comparison with other embodiments and will not be described in detail here.

[0075] The embodiment of the present specification also provides a computer storage medium for a monitoring method based on application operation status, wherein the computer storage medium stores computer program instructions, which can achieve the following when executed: determining a common indicator information set for multiple target applications; defining a target log format based on the common indicator information set; using a distributed search and analysis engine to record logs generated by the operation of multiple target applications; wherein the format of the logs generated by the operation of multiple target applications is a target log format; and combining a distributed search engine and an open source visualization platform to monitor the operation status of each target application based on the logs generated by the operation of the target application.

[0076] In this embodiment, the storage medium includes, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a cache, a hard disk (HDD), or a memory card. The memory can be used to store computer program instructions. The network communication unit can be an interface for network connection communication set in accordance with the standard specified by the communication protocol.

[0077] In this embodiment, the functions and effects specifically implemented by the program instructions stored in the computer storage medium can be explained in comparison with other embodiments and will not be repeated here.

[0078] Obviously, those skilled in the art should understand that the modules or steps of the above-mentioned embodiments of this specification can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. In this way, the embodiments of this specification are not limited to any specific combination of hardware and software.

[0079] Although the embodiments of this specification provide method operation steps such as the above embodiments or flowcharts, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided in the embodiments of this specification. When the method is executed in an actual device or terminal product, it can be executed in the order of the method shown in the embodiments or drawings or in parallel (for example, in a parallel processor or multi-threaded processing environment).

[0080] It should be understood that the above description is for illustration and not for limitation. By reading the above description, many embodiments and many applications beyond the examples provided will be apparent to those skilled in the art. Therefore, the scope of the embodiments of this specification should not be determined with reference to the above description, but should be determined with reference to the full scope of the aforementioned claims and the equivalents possessed by these claims.

[0081] The above are only preferred embodiments of the embodiments of this specification and are not intended to limit the embodiments of this specification. For those skilled in the art, the embodiments of this specification may have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the embodiments of this specification shall be included in the protection scope of the embodiments of this specification.< / level> < / class> < / threadid> < / timestamp>

Claims

1. A method for monitoring application operation status, characterized in that: include: Determine a common set of indicator information for multiple target applications; The target application refers to the application APP; Defining a target log format according to the general indicator information set; Using a distributed search analysis engine to record logs generated by the operation of the multiple target applications; wherein the format of the logs generated by the operation of the multiple target applications is the target log format; In combination with the distributed search analysis engine and the open source visualization platform, the operation status of each target application is monitored based on the logs generated by the operation of the target application; The distributed search analysis engine is used to record the logs generated by the operation of the multiple target applications, including: The multiple target applications call the interface provided by the online transaction monitoring software development toolkit during operation to generate logs in a target log format; the target log format is a unified format for each target application; Using the Fluentd tool to obtain logs generated by the operation of the multiple target applications; Establishing an index of each target application in the distributed search analysis engine according to the application name; Based on the indexes of the target applications, the logs generated by the operation of the multiple target applications are sent to the distributed search and analysis engine for storage by way of HTTP requests; In combination with the distributed search analysis engine and the open source visualization platform, the operation of each target application is monitored based on the logs generated by the operation of the target application, including: According to the application name of each target application and the index of each target application in the distributed search and analysis engine, calling the open source visualization platform interface to create a monitoring dashboard, fault identification rules and fault notification channels for each target application; Based on the index of each target application in the distributed search analysis engine, the operation status of the multiple target applications is displayed according to the monitoring dashboard of the multiple target applications.

2. The method according to claim 1, characterized in that According to the application name of each target application and the index of each target application in the distributed search analysis engine, calling the open source visualization platform interface to create a monitoring dashboard for each target application, including: Determining at least one characteristic indicator from the general indicator information set; According to the characteristic indicators, the application names of the target applications and the indexes of the target applications in the distributed search and analysis engine, the open source visualization platform interface is called to create a monitoring dashboard for each target application; wherein the monitoring dashboard of the target application is used to display the operating status of each characteristic indicator, and the monitoring dashboard includes: an application overall operating status display module, an application sub-module operating status display module, a sub-module node operating status display module, and a sub-module formal grayscale environment comparison display module.

3. The method according to claim 1, characterized in that After calling the open source visualization platform interface to create a monitoring dashboard, fault identification rules, and fault notification channels for each target application, the following steps are also included: Select the application name corresponding to the target user and set the viewing permission for the target user.

4. The method according to claim 1, characterized in that: After monitoring the running status of each target application based on the log generated by the running of the target application, the method further includes: If it is determined that the target application has a fault based on the log generated by the operation of the target application and the fault identification rule, generating a fault prompt sending request; Putting the fault prompt sending request into a target queue; Preprocessing the fault prompt sending request in the target queue; Determine a target processing object and a target fault notification channel corresponding to a target fault prompt sending request in a preprocessed target queue; wherein the target fault prompt sending request is a fault prompt sending request that is not a false alarm and has a determined fault cause; The fault prompt information corresponding to the target fault prompt sending request is sent to the target processing object based on the target fault notification channel.

5. The method according to claim 4, characterized in that After preprocessing the fault prompt sending request in the target queue, the method further includes: The characteristic fault prompt sending request in the preprocessed target queue is transmitted to the AIOps intelligent root cause analysis system for comprehensive fault root cause analysis; wherein, the characteristic fault prompt sending request is a fault prompt sending request that is not a false alarm and the cause of the fault has not been determined.

6. The method according to claim 1, characterized in that The general indicators include: log type, log identifier, serial number, application abbreviation, node IP, module name, service name, method name, outlet, organization, return code, resource transfer amount, resource transfer success rate, resource transfer time, and number of timed resource transfers.

7. A monitoring device for application operation, characterized in that: include: A determination module, used for determining a common indicator information set of multiple target applications; The target application refers to the application APP; A definition module, used to define a target log format according to the general indicator information set; A recording module, used to record logs generated by the operation of the multiple target applications using a distributed search analysis engine; wherein the format of the logs generated by the operation of the multiple target applications is the target log format; A monitoring module, used to combine the distributed search analysis engine and the open source visualization platform to monitor the operation of each target application based on the logs generated by the operation of the target application; The distributed search analysis engine is used to record the logs generated by the operation of the multiple target applications, including: The multiple target applications call the interface provided by the online transaction monitoring software development toolkit during operation to generate logs in a target log format; the target log format is a unified format for each target application; Using the Fluentd tool to obtain logs generated by the operation of the multiple target applications; Establishing an index of each target application in the distributed search analysis engine according to the application name; Based on the indexes of the target applications, the logs generated by the operation of the multiple target applications are sent to the distributed search and analysis engine for storage by way of HTTP requests; In combination with the distributed search analysis engine and the open source visualization platform, the operation of each target application is monitored based on the logs generated by the operation of the target application, including: According to the application name of each target application and the index of each target application in the distributed search and analysis engine, calling the open source visualization platform interface to create a monitoring dashboard, fault identification rules and fault notification channels for each target application; Based on the index of each target application in the distributed search analysis engine, the operation status of the multiple target applications is displayed according to the monitoring dashboard of the multiple target applications.

8. A monitoring device for application operation, characterized in that: The method comprises a processor and a memory for storing processor-executable instructions, wherein the processor implements the steps of the method according to any one of claims 1 to 6 when executing the instructions.

9. A computer-readable storage medium, characterized in that: Computer instructions are stored thereon, and when the instructions are executed, the steps of the method according to any one of claims 1 to 6 are implemented.

Images