Cluster multi-dimensional abnormality monitoring method, device, equipment and storage medium

Abstract

The embodiments of this specification provide a cluster multi-dimensional abnormality monitoring method, apparatus, device and storage medium, the method comprising: obtaining cluster performance information and node status information of each node in the cluster; generating a first monitoring sub-result according to the cluster performance information, and generating a second monitoring sub-result according to the node status information; determining the abnormal monitoring result of the cluster according to the first monitoring sub-result and the second monitoring sub-result. The embodiments of this specification can improve the accuracy of cluster abnormality monitoring.

Description

Technical Field

[0001] The present invention relates to the field of cluster monitoring technology, and in particular to a cluster multi-dimensional abnormality monitoring method, device, equipment and storage medium. Background Art

[0002] The deployment of large-scale clusters is of great help in supporting business development, but it also increases the complexity of application systems and brings great challenges to cluster abnormality monitoring. At present, a large number of clusters still use the traditional single-node monitoring method. However, the abnormality of a single node does not necessarily affect the normal service of the cluster. Therefore, a cluster abnormality monitoring strategy method is needed to comprehensively evaluate the service capabilities and alarm strategies of the cluster to improve the accuracy of cluster abnormality monitoring. Summary of the invention

[0003] The purpose of the embodiments of this specification is to provide a cluster multi-dimensional anomaly monitoring method, device, equipment and storage medium to improve the accuracy of cluster anomaly monitoring.

[0004] To achieve the above objectives, on the one hand, an embodiment of this specification provides a cluster multi-dimensional abnormality monitoring method, including:

[0005] Get cluster performance information and node status information of each node in the cluster;

[0006] Generate a first monitoring sub-result according to the cluster performance information, and generate a second monitoring sub-result according to the node status information;

[0007] An abnormal monitoring result of the cluster is determined according to the first monitoring sub-result and the second monitoring sub-result.

[0008] In an embodiment of this specification, generating a first monitoring sub-result according to the cluster performance information includes:

[0009] Processing the cluster performance information according to a preset classification algorithm to obtain the number of abnormal data points within a first specified time;

[0010] Determine whether the number of abnormal data points is greater than a set number threshold;

[0011] If the number of abnormal data points is greater than the number threshold, a first monitoring sub-result is generated accordingly.

[0012] In an embodiment of this specification, generating a second monitoring sub-result according to the node status information includes:

[0013] Determine a single node abnormality rate within a first specified time according to the node status information;

[0014] In an embodiment of this specification, generating a second monitoring sub-result according to the node status information includes:

[0015] Determine a single node abnormality rate within a first specified time according to the node status information;

[0016] Enter the single node abnormality rate into the formula Get the cluster node abnormality rate;

[0017] Determine whether the cluster node abnormality rate is greater than a set abnormality rate threshold;

[0018] If the cluster node abnormality rate is greater than the abnormality rate threshold, a second monitoring sub-result is generated accordingly;

[0019] Among them, r is the abnormal rate of cluster nodes, M is the total number of abnormal nodes within the first specified time, and a n is the weight coefficient of the nth abnormal node within the first specified time, b n It is the single node abnormality rate of the nth abnormal node within the first specified time.

[0020] In the embodiment of this specification, in the weight coefficient, when n=1, a1 is calculated according to the formula Determine; when n ≥ 2, a n According to formula a n =a1×q n-1 Determine; wherein a1 is the weight coefficient of the first abnormal node within the first specified time, q is the set value, and q>1.

[0021] In an embodiment of this specification, determining the single node abnormality rate within the first specified time according to the node status information includes:

[0022] Reading a node status message of a target node from a message queue; the node status message is sent to the message queue by each node at a regular interval;

[0023] Determining whether a node status message of the target node is read from the message queue within a second specified time;

[0024] When no node status message of the target node is read from the message queue within the second specified time, or when a node status message of the target node containing abnormal indicator data is read within the second specified time, confirming that the target node is an abnormal node;

[0025] A single node abnormality rate within a first specified time is determined according to the abnormal node.

[0026] In an embodiment of this specification, determining the abnormal monitoring result of the cluster according to the first monitoring sub-result and the second monitoring sub-result includes:

[0027] According to the formula Determining an abnormal monitoring value of the cluster;

[0028] Determine an abnormal monitoring result of the cluster according to the abnormal monitoring value;

[0029] Among them, F is the abnormal monitoring result of the cluster, A1 is the first monitoring sub-result, and A2 is the second monitoring sub-result.

[0030] In an embodiment of this specification, determining the abnormal monitoring result of the cluster according to the abnormal monitoring value includes:

[0031] When F>1, a cluster high-level alarm is output;

[0032] When 0<F<1, a cluster low-level alarm is output;

[0033] When F=0, the cluster has no alarm output.

[0034] In the embodiment of the present specification, each message in the message queue includes: node identification, node IP, CPU usage, memory usage, process status, IO performance and storage space status.

[0035] In an embodiment of the present specification, the classification algorithm includes a nearest neighbor node algorithm.

[0036] On the other hand, the embodiment of this specification also provides a cluster multi-dimensional abnormality monitoring device, including:

[0037] The acquisition module is used to obtain cluster performance information and node status information of each node in the cluster;

[0038] A generating module, configured to generate a first monitoring sub-result according to the cluster performance information, and to generate a second monitoring sub-result according to the node status information;

[0039] A determination module is used to determine the abnormal monitoring result of the cluster according to the first monitoring sub-result and the second monitoring sub-result.

[0040] On the other hand, an embodiment of the present specification further provides a computer device, including a memory, a processor, and a computer program stored in the memory, wherein when the computer program is executed by the processor, the instructions of the above method are executed.

[0041] On the other hand, an embodiment of the present specification further provides a computer storage medium on which a computer program is stored. When the computer program is executed by a processor of a computer device, the instructions of the above method are executed.

[0042] It can be seen from the technical solutions provided in the above embodiments of this specification that the embodiments of this specification no longer perform abnormality monitoring based solely on single node information, but also take into account cluster performance information. That is, the embodiments of this specification combine node status information and cluster performance information for abnormality monitoring, thereby improving the accuracy of cluster abnormality monitoring, reducing the probability of the cluster generating a large amount of redundant alarm information, and alleviating cluster operation and maintenance pressure and costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art description. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. In the drawings:

[0044] Figure 1 A flowchart of a cluster multi-dimensional anomaly monitoring method in some embodiments of this specification is shown;

[0045] Figure 2 A flowchart of generating a first monitoring sub-result according to cluster performance information in an embodiment of this specification is shown;

[0046] Figure 3 A flowchart of generating a second monitoring sub-result according to node status information in an embodiment of this specification is shown;

[0047] Figure 4 It shows a structural block diagram of a cluster multi-dimensional abnormality monitoring device in some embodiments of this specification;

[0048] Figure 5 The structure block diagram of the computer device in some embodiments of the present specification is shown.

[0049] [Description of Reference Numerals]

[0050] 41. Get module;

[0051] 42. Generate module;

[0052] 43. Determine the module;

[0053] 502. Computer equipment;

[0054] 504, processor;

[0055] 506. Memory;

[0056] 508, driving mechanism;

[0057] 510, input / output interface;

[0058] 512. Input devices;

[0059] 514. Output device;

[0060] 516. Presentation equipment;

[0061] 518. Graphical user interface;

[0062] 520, network interface;

[0063] 522, communication link;

[0064] 524. Communication bus. DETAILED DESCRIPTION

[0065] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0066] The embodiments of this specification relate to cluster abnormality monitoring technology. The cluster refers to a server cluster. A server cluster refers to a collection of multiple servers that perform the same service together, and the client sees it as if there is only one server. The cluster can use multiple computers for parallel computing to achieve a high computing speed, and can also use multiple computers for backup, so that if any machine fails, the entire system can still operate normally.

[0067] In traditional technology, cluster alarms are generally limited to alarms based on abnormalities of a single server (i.e., a single node). When the system detects an abnormality in a node in the cluster, it directly reports the alarm module to issue an alarm. In fact, in many cases, the abnormality of a single node does not necessarily affect the normal service of the cluster. Therefore, traditional technology is prone to generate a large number of redundant alarms, which will cause a heavy burden on cluster operation and maintenance.

[0068] In view of this, in order to improve the accuracy of cluster anomaly monitoring and reduce the burden of cluster operation and maintenance. This specification provides an improved cluster multi-dimensional anomaly monitoring method, which can be applied to any suitable computing device. Figure 1 As shown, in some embodiments of this specification, the cluster multi-dimensional abnormality monitoring method may include the following steps:

[0069] S101. Obtain cluster performance information and node status information of each node in the cluster.

[0070] S102: Generate a first monitoring sub-result according to the cluster performance information, and generate a second monitoring sub-result according to the node status information.

[0071] S103: Determine an abnormal monitoring result of the cluster according to the first monitoring sub-result and the second monitoring sub-result.

[0072] The embodiments of this specification no longer perform abnormality monitoring based solely on single node information, but also take into account cluster performance information. That is, the embodiments of this specification combine node status information and cluster performance information for abnormality monitoring, thereby improving the accuracy of cluster abnormality monitoring, reducing the probability of the cluster generating a large amount of redundant alarm information, and alleviating cluster operation and maintenance pressure and costs.

[0073] The node status information of each node in the cluster mainly reflects the individual status of the corresponding single node, while the cluster performance information can reflect the overall performance of the cluster to a certain extent. Therefore, in order to more comprehensively and accurately monitor the abnormality of the cluster, in the embodiments of this specification, not only the node status information of each node in the cluster can be obtained, but also the cluster performance information can be obtained.

[0074] In one embodiment of this specification, the node status information may include, for example, node identification, node IP, CPU usage, memory usage, process status, IO performance, storage space status, etc. Among them, the node identification (such as node number, etc.) can be used to uniquely identify a node in the cluster; the node IP is the IP address of the node; the CPU usage, memory usage, process status, IO performance, and storage space status correspond to the current CPU usage, memory usage, process status (such as the number of running processes, the number of ready processes, the number of blocked processes, etc.), IO performance (such as disk IO performance, network IO performance, etc.), and storage space status of the node, respectively.

[0075] In one embodiment of the present specification, cluster performance information may include indicators such as throughput and response time. Cluster performance information can well reflect the overall online performance of the cluster. Among them, throughput can be, for example, transaction volume, etc. Response time refers to the response time of the cluster, that is, the average response time of all nodes in the cluster.

[0076] Those skilled in the art will appreciate that the above-mentioned node status information and cluster performance information are merely illustrative examples. In other embodiments of this specification, the node status information may include more or less information, which is not limited in this specification and may be selected as needed.

[0077] In some embodiments of this specification, each node in the cluster can upload its own node status information to a designated message queue in the form of a message at a fixed time (e.g., every 5 seconds, every 10 seconds, etc.). Accordingly, by reading and processing the message from the message queue, the node status information of each node in the cluster can be obtained. In one embodiment of this specification, cluster performance information can be collected through a script program or other tools.

[0078] refer to Figure 2 As shown, in some embodiments of this specification, generating the first monitoring sub-result according to the cluster performance information may include the following steps:

[0079] S201. Process the cluster performance information according to a preset classification algorithm to obtain the number of abnormal data points within a first specified time.

[0080] The advantage of processing the cluster performance information by a classification algorithm is that it is possible to identify whether the cluster performance is abnormal by means of the relatively accurate classification capability of the classification algorithm, thereby facilitating improving the accuracy of cluster performance identification.

[0081] The preset classification algorithm can be any suitable classification algorithm, which is not limited in this specification and can be selected as needed. For example, in an embodiment of this specification, the preset classification algorithm can be a nearest neighbor node algorithm (K-NearestNeighbor, KNN) and the like. The KNN algorithm in the embodiment of this specification includes a KNN model trainer and a KNN classifier. Based on the historical cluster performance information, the KNN model trainer can be trained to generate a KNN classifier (including determining the K value of the KNN algorithm). For cluster performance information obtained within a sampling time (for example, 30 seconds), data classification can be performed through the current KNN classifier, so as to determine whether there are abnormal data points (for example, abnormal request volume, abnormal response time, etc.) according to the classifier; if so, the number of abnormal data points within this sampling time is recorded. In addition, the KNN classifier can be dynamically updated according to the daily cluster performance information incremental data to further improve the classification accuracy of the KNN classifier. Among them, a sampling time contains several sampling points. For example, taking a sampling rate of once every 5 seconds as an example, there can be 6 sampling data within a sampling time of 30 seconds.

[0082] In some embodiments of this specification, a data analysis list ExceptionKnn{} can also be built in (here taking the KNN classification algorithm as an example). ExceptionKnn{} can be used to store information about data points where the cluster performance data collected every 1 second by the cluster deviates from the KNN classifier within a single sampling duration (for example, 30 seconds), that is, to save abnormal data points. In addition, data that exceeds this sampling duration can be cleaned up (i.e., removed from ExceptionKnn{}).

[0083] S202: Determine whether the number of abnormal data points is greater than a set number threshold.

[0084] In an embodiment of the present specification, the number of abnormal data points can be counted regularly. For example, in an embodiment of the present specification, the number of elements in ExceptionKnn{} (i.e., ExceptionKnn.size()) can be counted every 5 seconds, and compared with the set number threshold. If it is greater than the number threshold, step S203 can be executed; otherwise, the next count and judgment can be performed.

[0085] S203: If the number of abnormal data points is greater than the number threshold, a first monitoring sub-result is generated accordingly.

[0086] For example, in one embodiment of this specification, if ExceptionKnn.size()>5 (here 5 is used as the quantity threshold, which can be adjusted according to actual production). That is, if there are 5 abnormal data points in the cluster within a single sampling time, it is considered that there is a greater risk of cluster abnormality. Therefore, generating the first monitoring sub-result based on this can mean: the probability of abnormal data points in the corresponding single sampling time is used as the first monitoring sub-result. For example, the number of data points in a single sampling time is 60, and there are 5 abnormal data points, then the corresponding probability of abnormal data points is In addition, the cluster KNN alarm information is triggered and marked as AlarmKnn.

[0087] So, through Figure 2 The method shown can obtain a more accurate cluster performance monitoring result (ie, the first monitoring sub-result).

[0088] Combination Figure 3 As shown, in some embodiments of this specification, generating the second monitoring sub-result according to the node status information may include the following steps:

[0089] S301. Determine a single node abnormality rate within a first specified time period according to the node status information.

[0090] In order to improve data processing efficiency, in some embodiments of this specification, a cluster information synchronization process and multiple message processing processes can be started. Among them, the cluster information synchronization process is used to record and update the node identification and node IP information of all nodes in the current cluster. Through the cluster information synchronization process, the number of nodes in the cluster, the number of each node and its IP can be quickly understood; at the same time, the cluster information synchronization process can also be responsible for summarizing the information of node anomalies within each sampling period for subsequent processing. Multiple message processing processes can be used to read messages in the message queue and process the messages according to preset processing rules.

[0091] For example, in one embodiment of the present specification, the specific processing logic of the message processing process can be: if the message of a certain node is not read from the message queue within the current sampling time, the node is marked as abnormal; if the message of the node can be read from the message queue within 5 seconds, but an indicator in the message is abnormal (such as CPU usage exceeds the threshold, etc.), the node can also be marked as abnormal. If the abnormal nodes in the cluster are marked after processing by the message processing process, the cluster information synchronization process will summarize the abnormal information and calculate the single node abnormality rate based on it for subsequent processing. Among them, the single node abnormality rate within the first specified time refers to: the abnormality rate of each node within a sampling time.

[0092] In some embodiments of the present specification, a data analysis list ExceptionSingleList{} may also be built in. The list ExceptionSingleList{} is used to store predefined abnormal node description information (i.e., abnormal nodes are defined) so as to determine the single node abnormality rate according to the definition.

[0093] S302: Input the single node abnormality rate into the formula Get the cluster node abnormality rate.

[0094] In the formula of this step, r is the cluster node abnormality rate, M is the total number of abnormal nodes within the first specified time, and a n is the weight coefficient of the nth abnormal node within the first specified time, b n It is the single node abnormality rate of the nth abnormal node within the first specified time.

[0095] In some embodiments of the present specification, in the weight coefficient, when n=1, a1 is calculated according to the formula Determine; when n ≥ 2, a n According to formula a n =a1×q n-1Determine; where a1 is the weight coefficient of the first abnormal node within the first specified time, q is the set value, and q>1. It can be seen that in this case, the closer the sampling time is, the greater the weight. The advantage of using this weighting is that it reduces the influence of the initial acquisition point (because there is a possibility of automatic recovery later, such as occasional abnormal jitter can be automatically recovered), so that the abnormal scene of automatic recovery can be ignored to a large extent to reduce false alarms.

[0096] S303: Determine whether the cluster node abnormality rate is greater than a set abnormality rate threshold. If the cluster node abnormality rate is greater than the abnormality rate threshold, execute step S304; otherwise, the next calculation can be performed.

[0097] S304: If the cluster node abnormality rate is greater than the abnormality rate threshold, a second monitoring sub-result is generated accordingly.

[0098] In the embodiment of this specification, generating the second monitoring sub-result based on this may refer to taking the cluster node abnormality rate r at this time as the second monitoring sub-result, and may also trigger the generation of node abnormality alarm information and mark it as AlarmSingle. Figure 3 The method shown can obtain a more accurate node status monitoring result (ie, the second monitoring sub-result).

[0099] In some embodiments of the present specification, determining the abnormal monitoring result of the cluster according to the first monitoring sub-result and the second monitoring sub-result may include: according to the formula Determine the abnormal monitoring value of the cluster; and determine the abnormal monitoring result of the cluster according to the abnormal monitoring value. Wherein, F is the abnormal monitoring result of the cluster, A1 is the first monitoring sub-result, and A2 is the second monitoring sub-result. From the formula It can be seen that the abnormal monitoring result of the cluster comprehensively considers the first monitoring sub-result (i.e., cluster performance monitoring) and the second monitoring sub-result (i.e., single node status monitoring), and the coefficient of the first monitoring sub-result (i.e., cluster performance monitoring) is greater than the coefficient of the second monitoring sub-result (i.e., single node status monitoring), that is, compared with the node status, cluster performance is more important in cluster abnormality monitoring, so it is assigned a higher coefficient.

[0100] In some embodiments of this specification, the abnormal monitoring result of the cluster determined according to the abnormal monitoring value may include: when F>1, outputting a high-level cluster alarm; when 0<F<1, outputting a low-level cluster alarm; when F=0, no cluster alarm output. In this way, multi-level abnormal warnings (such as shown in Table 1 below) are implemented according to the severity of the abnormal situation, thereby improving the accuracy of cluster abnormal monitoring.

[0101] Table 1

[0102] AlarmSingle AlarmKnn Alarm level 1 0 Low 1 1 high 0 1 high 0 0 normal

[0103] Although the process flows described above include multiple operations that occur in a particular order, it should be clearly understood that the processes may include more or fewer operations, which may be performed sequentially or in parallel (eg, using parallel processors or a multi-threaded environment).

[0104] Corresponding to the above method, this specification also provides an embodiment of a cluster multi-dimensional abnormality monitoring device. Figure 4 As shown, in some embodiments of this specification, the cluster multi-dimensional anomaly monitoring device may include:

[0105] The acquisition module 41 may be used to acquire cluster performance information and node status information of each node in the cluster;

[0106] A generating module 42, which may be used to generate a first monitoring sub-result according to the cluster performance information, and to generate a second monitoring sub-result according to the node status information;

[0107] The determination module 43 may be configured to determine the abnormal monitoring result of the cluster according to the first monitoring sub-result and the second monitoring sub-result.

[0108] In some device embodiments of this specification, generating a first monitoring sub-result according to the cluster performance information includes:

[0109] Processing the cluster performance information according to a preset classification algorithm to obtain the number of abnormal data points within a first specified time;

[0110] Determine whether the number of abnormal data points is greater than a set number threshold;

[0111] If the number of abnormal data points is greater than the number threshold, a first monitoring sub-result is generated accordingly.

[0112] In some device embodiments of this specification, generating a second monitoring sub-result according to the node status information includes:

[0113] Determine a single node abnormality rate within a first specified time according to the node status information;

[0114] Enter the single node abnormality rate into the formula Get the cluster node abnormality rate;

[0115] Determine whether the cluster node abnormality rate is greater than a set abnormality rate threshold;

[0116] If the cluster node abnormality rate is greater than the abnormality rate threshold, a second monitoring sub-result is generated accordingly;

[0117] Among them, r is the abnormal rate of cluster nodes, M is the total number of abnormal nodes within the first specified time, and a n is the weight coefficient of the nth abnormal node within the first specified time, b n It is the single node abnormality rate of the nth abnormal node within the first specified time.

[0118] In some device embodiments of this specification, in the weight coefficient, when n=1, a1 is calculated according to the formula Determine; when n ≥ 2, a n According to formula a n =a1×q n-1 Determine; wherein a1 is the weight coefficient of the first abnormal node within the first specified time, q is the set value, and q>1.

[0119] In some device embodiments of this specification, determining the single node abnormality rate within the first specified time according to the node status information includes:

[0120] Reading a node status message of a target node from a message queue; the node status message is sent to the message queue by each node at a regular interval;

[0121] Determining whether a node status message of the target node is read from the message queue within a second specified time;

[0122] When no node status message of the target node is read from the message queue within the second specified time, or when a node status message of the target node containing abnormal indicator data is read within the second specified time, confirming that the target node is an abnormal node;

[0123] A single node abnormality rate within a first specified time is determined according to the abnormal node.

[0124] In some device embodiments of this specification, determining the abnormal monitoring result of the cluster according to the first monitoring sub-result and the second monitoring sub-result includes:

[0125] According to the formula Determining an abnormal monitoring value of the cluster;

[0126] Determine an abnormal monitoring result of the cluster according to the abnormal monitoring value;

[0127] Among them, F is the abnormal monitoring result of the cluster, A1 is the first monitoring sub-result, and A2 is the second monitoring sub-result.

[0128] In some device embodiments of this specification, determining the abnormal monitoring result of the cluster according to the abnormal monitoring value includes:

[0129] When F>1, a cluster high-level alarm is output;

[0130] When 0<F<1, a cluster low-level alarm is output;

[0131] When F=0, the cluster has no alarm output.

[0132] In some device embodiments of the present specification, each message in the message queue includes: node identification, node IP, CPU usage, memory usage, process status, IO performance and storage space status.

[0133] In some device embodiments of this specification, the classification algorithm may include a KNN algorithm.

[0134] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0135] The embodiments of this specification also provide a computer device. Figure 5 As shown, in some embodiments of the present specification, the computer device 502 may include one or more processors 504, such as one or more central processing units (CPUs) or graphics processing units (GPUs), and each processing unit may implement one or more hardware threads. The computer device 502 may also include any memory 506, which is used to store any kind of information such as code, settings, data, etc. In a specific embodiment, the computer program on the memory 506 and can be run on the processor 504, when the computer program is run by the processor 504, can execute the instructions of the cluster multi-dimensional anomaly monitoring method described in any of the above embodiments. Non-limiting, for example, the memory 506 may include any one or more combinations of the following: any type of RAM, any type of ROM, flash memory device, hard disk, optical disk, etc. More generally, any memory can use any technology to store information. Further, any memory can provide volatile or non-volatile retention of information. Further, any memory can represent a fixed or removable component of the computer device 502. In one case, when the processor 504 executes an associated instruction stored in any memory or a combination of memories, the computer device 502 can perform any operation of the associated instruction. The computer device 502 also includes one or more drive mechanisms 508 for interacting with any storage, such as a hard disk drive mechanism, an optical disk drive mechanism, etc.

[0136] The computer device 502 may also include an input / output interface 510 (I / O) for receiving various inputs (via input devices 512) and for providing various outputs (via output devices 514). A specific output mechanism may include a presentation device 516 and an associated graphical user interface 518 (GUI). In other embodiments, the input / output interface 510 (I / O), input device 512, and output device 514 may not be included, and the computer device 502 may be used as a computer device in a network. The computer device 502 may also include one or more network interfaces 520 for exchanging data with other devices via one or more communication links 522. One or more communication buses 524 couple the components described above together.

[0137] The communication link 522 may be implemented in any manner, for example, through a local area network, a wide area network (e.g., the Internet), a point-to-point connection, etc., or any combination thereof. The communication link 522 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc., governed by any protocol or combination of protocols.

[0138] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products of some embodiments of the present specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processor to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processor generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0139] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processor to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0140] These computer program instructions can also be loaded onto a computer or other programmable data processor so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1A step that specifies a function in one or more boxes.

[0141] In a typical configuration, a computer device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0142] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0143] Computer readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computer device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0144] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, the embodiments of this specification may take the form of complete hardware embodiments, complete software embodiments or embodiments combining software and hardware. Moreover, the embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0145] The present specification embodiments may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present specification embodiments may also be practiced in distributed computing environments where tasks are performed by remote processors connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0146] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiment of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, in the absence of contradiction, a person skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0147] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A cluster multi-dimensional anomaly monitoring method, characterized in that: include: Get cluster performance information and node status information of each node in the cluster; Generate a first monitoring sub-result according to the cluster performance information, and generate a second monitoring sub-result according to the node status information; Determine an abnormal monitoring result of the cluster according to the first monitoring sub-result and the second monitoring sub-result; The generating of the first monitoring sub-result according to the cluster performance information includes: Processing the cluster performance information according to a preset classification algorithm to obtain the number of abnormal data points within a first specified time; Determine whether the number of abnormal data points is greater than a set number threshold; If the number of abnormal data points is greater than the number threshold, a first monitoring sub-result is generated accordingly; The generating a second monitoring sub-result according to the node status information includes: Determine a single node abnormality rate within a first specified time according to the node status information; Enter the single node abnormality rate into the formula Get the cluster node abnormality rate; Determine whether the cluster node abnormality rate is greater than a set abnormality rate threshold; If the cluster node abnormality rate is greater than the abnormality rate threshold, a second monitoring sub-result is generated accordingly; Among them, r is the abnormal rate of cluster nodes, M is the total number of abnormal nodes within the first specified time, and a n is the weight coefficient of the nth abnormal node within the first specified time, b n is the single node abnormality rate of the nth abnormal node within the first specified time, where in the weight coefficient, when n=1, a1 is calculated according to the formula Determine; when n ≥ 2, a n According to formula a n =a1×q n-1 Determine; wherein a1 is the weight coefficient of the first abnormal node within the first specified time, q is the set value, and q>1.

2. The cluster multi-dimensional abnormality monitoring method according to claim 1, characterized in that: The determining, according to the node status information, a single node abnormality rate within a first specified time period includes: Reading a node status message of a target node from a message queue; the node status message is sent to the message queue by each node at a regular interval; Determining whether a node status message of the target node is read from the message queue within a second specified time; When no node status message of the target node is read from the message queue within the second specified time, or a node status message of the target node containing abnormal indicator data is read within the second specified time, confirming that the target node is an abnormal node; A single node abnormality rate within a first specified time is determined according to the abnormal node.

3. The cluster multi-dimensional abnormality monitoring method according to claim 1, characterized in that: The determining the abnormal monitoring result of the cluster according to the first monitoring sub-result and the second monitoring sub-result includes: According to the formula Determining an abnormal monitoring value of the cluster; Determine an abnormal monitoring result of the cluster according to the abnormal monitoring value; Among them, F is the abnormal monitoring result of the cluster, A1 is the first monitoring sub-result, and A2 is the second monitoring sub-result.

4. The cluster multi-dimensional abnormality monitoring method according to claim 3, characterized in that: The determining the abnormal monitoring result of the cluster according to the abnormal monitoring value includes: When F>1, a cluster high-level alarm is output; When 0<F<1, a cluster low-level alarm is output; When F=0, the cluster has no alarm output.

5. The cluster multi-dimensional abnormality monitoring method according to claim 2, characterized in that: Each message in the message queue includes: node identification, node IP, CPU usage, memory usage, process status, IO performance and storage space status.

6. The cluster multi-dimensional abnormality monitoring method according to claim 1, characterized in that: The classification algorithm includes a nearest neighbor algorithm.

7. A cluster multi-dimensional anomaly monitoring device, characterized in that: include: The acquisition module is used to obtain cluster performance information and node status information of each node in the cluster; A generating module, configured to generate a first monitoring sub-result according to the cluster performance information, and to generate a second monitoring sub-result according to the node status information; A determination module, configured to determine an abnormal monitoring result of the cluster according to the first monitoring sub-result and the second monitoring sub-result; The generating of the first monitoring sub-result according to the cluster performance information includes: Processing the cluster performance information according to a preset classification algorithm to obtain the number of abnormal data points within a first specified time; Determine whether the number of abnormal data points is greater than a set number threshold; If the number of abnormal data points is greater than the number threshold, a first monitoring sub-result is generated accordingly; The generating a second monitoring sub-result according to the node status information includes: Determine a single node abnormality rate within a first specified time according to the node status information; Enter the single node abnormality rate into the formula Get the cluster node abnormality rate; Determine whether the cluster node abnormality rate is greater than a set abnormality rate threshold; If the cluster node abnormality rate is greater than the abnormality rate threshold, a second monitoring sub-result is generated accordingly; Among them, r is the abnormal rate of cluster nodes, M is the total number of abnormal nodes within the first specified time, and a n is the weight coefficient of the nth abnormal node within the first specified time, b n is the single node abnormality rate of the nth abnormal node within the first specified time. Among the weight coefficients, when n=1, a1 is calculated according to the formula Determine; when n ≥ 2, a n According to formula a n =a1×q n-1 Determine; wherein a1 is the weight coefficient of the first abnormal node within the first specified time, q is the set value, and q>1.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that: When the computer program is executed by the processor, the computer program executes the instructions of the method according to any one of claims 1 to 6.

9. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor of a computer device, the computer program executes instructions of the method according to any one of claims 1 to 6.

Images