A memory failure early warning method and device

Abstract

The present invention discloses a memory failure early warning method and device, which relates to the field of computer technology. The main purpose of the present invention is to describe the characteristics corresponding to the memory working state from multiple dimensions, so as to predict whether the memory has a failure risk. The main technical scheme of the present invention is: obtaining the abnormal log of the device; analyzing the time series change characteristics of the memory abnormal log according to a preset time period based on the memory abnormal log in the abnormal log; counting the operating state characteristics of the memory in the device based on the address information of the memory error in the abnormal log; fusing the time series change characteristics with the operating state characteristics into a memory failure early warning feature; using the early warning model to process the memory failure early warning feature to obtain the memory early warning information of the device.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a memory failure early warning method and device. Background Art

[0002] In large-scale data centers, maintaining server stability is crucial. Memory failures can cause server performance degradation or even downtime, greatly affecting server reliability. Active fault-tolerance technology is an important means to improve data center and system stability. Fault prediction, as an important aspect of active fault-tolerance technology, studies whether a server will fail in the future by monitoring its current and historical status, thereby improving system reliability.

[0003] Since the proportion of downtime caused by memory failure has exceeded the proportion of other hardware failures, such as downtime caused by CPU, hard disk and other failures, accurate warning of memory failures and business migration can effectively reduce the losses caused by server unavailability and improve system reliability. At present, memory failure warning is mainly based on analyzing the machine's abnormal logs to predict the working status of the memory in the future. However, since not all abnormal logs are logs of memory abnormalities, and the analysis of a large number of abnormal logs requires high computing resources, the existing memory failure warning solutions have certain defects in prediction accuracy and applicable scenarios. A more efficient and accurate memory failure warning solution is urgently needed. Summary of the invention

[0004] In view of the above problems, the present invention proposes a memory failure early warning method and device, the main purpose of which is to describe the characteristics corresponding to the memory working state from multiple dimensions, so as to predict whether there is a risk of memory failure.

[0005] In order to achieve the above object, the present invention mainly provides the following technical solutions:

[0006] In one aspect, the present invention provides a memory failure early warning method, which specifically includes:

[0007] Get the abnormal log of the device;

[0008] Analyzing the time series change characteristics of the memory abnormality log according to a preset time period based on the memory abnormality log in the abnormality log;

[0009] Counting the operating status characteristics of the memory in the device based on the address information of the memory error in the abnormal log;

[0010] Merging the time series variation feature with the operation status feature into a memory fault warning feature;

[0011] The memory fault warning feature is processed using the warning model to obtain memory warning information of the device.

[0012] On the other hand, the present invention provides a memory failure early warning device, specifically comprising:

[0013] An acquisition unit, used to acquire abnormal logs of a device;

[0014] A first determining unit, configured to analyze a time series variation feature of the memory abnormality log according to a preset time period based on the memory abnormality log in the abnormality log obtained by the acquiring unit;

[0015] A second determining unit, configured to collect statistics on operating status characteristics of the memory in the device based on address information of memory errors in the abnormal log obtained by the acquiring unit;

[0016] a fusion unit, configured to fuse the time series variation feature obtained by the first determination unit and the operation status feature obtained by the second determination unit into a memory fault warning feature;

[0017] The early warning unit is used to process the memory fault early warning characteristics obtained by the fusion unit by using the early warning model to obtain the memory early warning information of the device.

[0018] On the other hand, the present invention provides a processor, which is used to run a program, wherein the program executes the above-mentioned memory failure early warning method when running.

[0019] By means of the above technical solution, the present invention provides a memory failure warning method and device, which is based on the analysis of the abnormal log, and constructs the memory failure warning feature from different dimensions. The memory failure warning feature is composed of the fusion of the time series change feature and the operation status feature, wherein the time series change feature is obtained by analyzing the memory abnormal log in a preset time period, which describes the state of the device memory from a macro perspective, and the operation status feature is obtained by analyzing the address information of the memory error, which describes the state of the device memory from a micro perspective. It can be seen that the memory failure warning feature combines the features of the macro and micro dimensions, making the feature description richer, so that the warning model can more accurately predict the risk of device memory failure.

[0020] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0022] Figure 1 A flow chart of a memory failure early warning method proposed by an embodiment of the present invention is shown;

[0023] Figure 2 A flow chart showing a process of constructing a time series variation feature in an embodiment of the present invention is shown;

[0024] Figure 3 A flowchart of a process for filtering memory exception logs according to an embodiment of the present invention is shown;

[0025] Figure 4 A flow chart showing a process of constructing a running status feature according to an embodiment of the present invention is shown;

[0026] Figure 5 A schematic diagram of a memory failure alarm interface in an embodiment of the present invention is shown;

[0027] Figure 6 A block diagram showing a composition of a memory failure warning device proposed in an embodiment of the present invention;

[0028] Figure 7 A block diagram showing the composition of another memory failure warning device proposed in an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0030] The memory failure warning method provided by the embodiment of the present invention can be applied to various devices, monitor the memory status and warn based on the abnormal log information of the device, and prevent the server from being unavailable due to memory failure. Specifically, the warning steps of this method are as follows: Figure 1 As shown, including:

[0031] Step 101: Obtain the abnormal log of the device.

[0032] A large amount of log information is generated during the operation of the device, among which the exception log records various types of abnormal events that occur during the operation of the device. The content of these exception logs has a potential correlation with the failure of the device. By analyzing the exception logs, it is possible to predict the failure of the device that may occur in the future. This embodiment is to warn of the memory failure of the device based on the exception log.

[0033] The abnormal logs in this step are mainly collected from multiple log sources such as kern log (including logs generated by the kernel), dmesg log (including logs of kernel buffer information), messages (including overall system information and logs during system startup), command log (kernel logs collected through out-of-band), sel log (system event log), etc. If these abnormal logs are used directly for early warning, a large number of false alarms will be caused. Therefore, it is necessary to parse these abnormal logs, build the features required for early warning based on the obtained content, and use the prediction model to perform fault early warning.

[0034] Step 102: Analyze the time series variation characteristics of the memory abnormality log according to a preset time period based on the memory abnormality log in the abnormality log.

[0035] The time series variation feature in this step uses the abnormal log to construct the feature for memory early warning from a macro perspective. By screening out the memory abnormal logs that have the ability to distinguish memory failures from the abnormal logs, and counting the distribution of memory abnormal logs in different time periods, the time series variation feature between memory failures and the number of memory abnormal logs is constructed to predict the risk probability of device memory failure within a certain period of time in the future.

[0036] Among them, the setting of the preset time period can be determined according to the length and accuracy of the predicted future time. The longer the predicted length and the higher the accuracy, the larger the amount of existing data required for statistics, and the preset time period should contain more memory exception logs.

[0037] In addition, the memory exception log in this step refers to an exception log that has the ability to distinguish memory failures. It can be obtained by screening from the exception log through a preset log template, or by other screening methods, such as manual labeling. This embodiment does not make specific limitations on this.

[0038] Step 103: Count the operating status characteristics of the memory in the device based on the address information of the memory error in the abnormal log.

[0039] The operating status features in this step are constructed from the microscopic perspective using the exception log to construct features for memory early warning. The address information of the memory error in the exception log is used to count the memory particles with errors in the physical memory. The features constructed based on these memory particles can effectively describe the operating status of the device and predict whether there are memory particles with physical failures, and then predict whether there is a risk of failure in the device memory.

[0040] The memory error in this step refers to the error information that can be corrected by the CPU and will not affect any operation of the system, that is, the corrected memory error, CE information. The address information of the memory error is the CE address, which is the memory address where the CE occurs after parsing.

[0041] Specifically, the operating status characteristics in this step are comprehensive characteristics constructed based on the CE address and quantity through multiple preset indicators. The specific construction method needs to determine the corresponding preset indicators according to the specific application scenario. Therefore, this step does not make specific restrictions on this.

[0042] It should be noted that there is no logical sequence relationship between this step and the previous step 102 during the actual execution process.

[0043] Step 104: Merge the time series variation feature and the operation status feature into a memory fault warning feature.

[0044] This step is to fuse the macro features and micro features obtained above to obtain features with richer description content, namely, memory fault warning features.

[0045] This step does not limit the fusion method. It can be achieved by vectorizing the features and then concatenating them, or by fusing the features through a fusion algorithm, that is, through a preset fusion model, such as a feature fusion algorithm based on a linear feature dependency model, a feature fusion algorithm based on sparse representation theory, etc., which is determined according to the specific application scenario and requirements.

[0046] Step 105: Use the warning model to process the memory fault warning characteristics to obtain the memory warning information of the device.

[0047] Through the above Figure 1 It can be seen from the steps in the illustrated embodiment that the embodiment of the present invention is based on the analysis of abnormal logs, constructs features for predicting memory failures from two different dimensions, macro and micro, and fuses the obtained features to form memory failure warning features, and then uses the warning model for prediction. Since the memory failure warning features used in the present invention combine features of different dimensions, the device memory status described by the memory failure warning features is richer, so more accurate warning information can be obtained.

[0048] Furthermore, in the above embodiment, the memory state is mainly described by features from two different dimensions, macroscopic and microscopic, but the present invention does not limit the number of dimensional features to be integrated, that is, more features from different dimensions can be integrated to describe the memory state, and then early warning of memory failures can be given. It should be noted that the features of the first dimension are mainly extracted from the abnormal log, but can also be derived from other data channels, and the embodiments of the present invention do not make specific limitations on this. At present, common parameters for predicting memory failures also include memory temperature. In another feasible embodiment of the present invention, the memory temperature abnormality log can also be extracted from the abnormal log to obtain the temperature abnormality feature corresponding to the memory. Since the temperature change has a certain linear law, the temperature abnormality feature counted by the temperature abnormality log can predict the temperature change of the memory in the future, so that the temperature abnormality feature has a certain reference value for the early warning of memory failures. Based on this, the temperature abnormality feature can be further integrated with the above-mentioned time series change feature and operation status feature into a memory failure early warning feature, and then the failure risk of the device memory can be predicted.

[0049] According to the technical solution of the present invention described in the above embodiment, it can be known that the focus is to use the abnormal log to construct features for predicting memory failure from different macro and micro dimensions, namely step 102 and step 103. Figure 1 The above steps in the illustrated embodiment illustrate their preferred implementations one by one:

[0050] First, for step 102, based on the memory abnormality log in the abnormality log, the time series change characteristics of the memory abnormality log are analyzed according to the preset time period, that is, the characteristics constructed from a macro perspective. The specific construction process is as follows: Figure 2 As shown, including:

[0051] Step 201: Set multiple time windows.

[0052] The time window is used to specify a time period. The multiple time windows set may be user-defined, or may be determined by specifying a longer time period and determining the corresponding multiple time windows based on a sliding window algorithm.

[0053] Step 202: Filter the memory exception logs of the corresponding type from the exception logs using the memory exception log template.

[0054] The memory exception log template in this step is a log template obtained by parsing and abstracting the exception log. The memory exception log template is used to screen and obtain the memory exception log that can identify the memory fault.

[0055] Specifically, the specific implementation method of this step is as follows Figure 3 As shown, including:

[0056] Step 301: Determine an exception log template according to the content of the exception log.

[0057] This step is to abstract the corresponding exception log template based on the parsed content of the exception log. The exception log template can be used to structure the exception log for subsequent processing. The abstraction process of the exception log template includes:

[0058] First, filter the exception logs according to the preset categories.

[0059] This screening is a preprocessing process for abnormal logs. Since there are many types of abnormal logs, and the logs involving memory failures are mainly concentrated in several specified categories, using these categories as preset classifications to screen abnormal logs can effectively reduce the number of logs to be analyzed and improve computing efficiency.

[0060] In addition, the preprocessing of the exception log also includes information filtering of the screened exception log, for example, removing irrelevant characters and symbols in the content of the exception log through regular expressions, so as to improve the information validity of the exception log.

[0061] Secondly, the parse tree is used to determine the type of the filtered exception log.

[0062] The parse tree in this embodiment uses a tree structure heuristic algorithm to express the filtered abnormal logs, thereby effectively extracting log templates. The parse tree is an m-tree, which is specifically defined as follows: each node of an m-tree has at most m child nodes; for an m-tree with a height of h, the maximum number of leaf nodes is m h ; The key values ​​in each node are arranged in ascending order. The root node and internal nodes of the parse tree are used for searching, and the leaf nodes store logs. Each leaf node corresponds to a type; the search of each internal node can cut the nodes according to certain preset rules, and the rules are divided into discrete rules and continuous rules. In other words, the parse tree divides and classifies the abnormal logs according to the hierarchical preset rules and the log content. For continuous rules, the classification is based on the mapping of the log content to the corresponding continuous interval. The number of intervals corresponds to the divided categories, and the classification corresponding to the abnormal log is determined according to the mapped interval. For discrete rules, it is necessary to first define several categories and define the content of each category, and then determine the corresponding category by matching the log content.

[0063] Through the processing of the parse tree, the exception log can be divided into leaf nodes, which can be existing nodes or newly created leaf nodes. In this regard, the processing process of the parse tree is to first divide the exception log into an existing leaf node according to the preset rules of each level, that is, to determine the type of the exception log as an existing type; then, determine whether the content of the log corresponding to the existing type is sufficiently similar to the content of the exception log, which can be determined by calculating the similarity between the two. In this embodiment, the content of the exception log can be understood as consisting of multiple log sequence unit strings (tokens). In this way, comparing the similarity of two exception logs can be converted into comparing the tokens at corresponding positions in the exception logs. The similarity calculation formula is as follows:

[0064]

[0065] Among them, seq1 represents the currently processed exception log, seq2 represents multiple exception logs stored in the leaf node, seq(i) represents the i-th token in the log content, n is the length of the log content, and the token similarity calculation formula is as follows:

[0066]

[0067] Among them, t represents the value of token.

[0068] The above formula can be used to calculate the similarity between the exception log and the log in the leaf node. When the similarity is greater than the threshold, the exception log is attributed to the leaf node and its corresponding type is determined. Otherwise, a new leaf node is created and the type corresponding to the new leaf node is determined based on the content of the exception log, that is, a new type is determined based on the sequence of tokens in the exception log.

[0069] Again, match the log template according to the type.

[0070] In this embodiment, different types correspond to different log templates, that is, after the above steps, the parsing tree will divide the abnormal log into multiple types, that is, multiple leaf nodes. In different types, the sequence of tokens in the log is different, based on which different log modules can be matched.

[0071] Finally, clustering is performed based on the similarity between log templates to obtain the abnormal log template corresponding to the abnormal log.

[0072] This is to further structure the log template in order to avoid over-parsing or results that do not conform to the parsing tree segmentation rules. To this end, the log templates obtained above are clustered, and the similarity between log templates is calculated. Clustering methods such as hierarchical clustering or mean clustering are used to merge similar log templates to obtain the final abnormal log template.

[0073] Specifically, in this embodiment, Manhattan distance is used to evaluate the similarity between log templates a and b, and the formula is as follows:

[0074]

[0075] Where N is the number of tokens in abnormal logs a and b, a i Indicates the number of times the i-th token appears in a. When d(a,b) is less than the preset maximum distance threshold, the two log templates a and b are merged to obtain a new abnormal log template.

[0076] Step 302: Filter the memory exception log template from the exception log templates using the memory exception log marked in the exception log.

[0077] This step is to perform significance analysis on the abnormal log template so that the obtained memory abnormal log template can effectively screen out memory abnormal logs that have the ability to identify memory faults.

[0078] The specific screening process is as follows:

[0079] First, the sequence type of the exception log template is obtained, that is, the sequence type of each exception log template is determined. The sequence type is determined based on the granularity of exception log aggregation and the matching of the exception log template. It can also be set manually and is divided into discrete sequence and continuous sequence.

[0080] Secondly, select the corresponding method according to the sequence type to filter the memory exception log template.

[0081] When the sequence type is a discrete sequence, a chi-square test is used according to the content of the marked memory exception log to determine whether the exception log template is a memory exception log template; wherein the content of the marked memory exception log refers to the marking information in the exception log that indicates that the log is associated with a memory failure, and the marking information needs to be marked in the exception log in advance.

[0082] When the sequence type is a continuous sequence, a KS test is performed based on the distribution of the annotated memory exception logs in the same type of exception logs to determine whether the exception log template is a memory exception log template.

[0083] Step 303: Search the exception log for a log that meets the memory exception log template as the memory exception log.

[0084] This step is to further filter the exception logs using the memory exception log template to obtain the memory exception logs that are associated with the memory failure.

[0085] above Figure 3 The steps shown are to parse and screen the exception logs based on significance analysis, from which different types of memory exception logs are obtained, wherein the type of memory exception log is the type corresponding to the memory exception log template, that is, the type of the leaf node in the corresponding parsing tree.

[0086] Step 203: Count the number of different types of memory exception logs for each time window.

[0087] Different time windows correspond to different time periods. This step counts the number of memory exception logs according to the type and time window. As the memory of a device changes from a normal state to an abnormal state, the number of corresponding abnormal logs will also fluctuate. Therefore, counting the number of different time windows helps analyze the state change pattern of the device memory.

[0088] Step 204: Use a preset statistical algorithm to calculate statistical values ​​of the number of memory abnormality logs in multiple time windows to obtain time series change characteristics.

[0089] Among them, the preset statistical algorithm is set according to the needs of the actual application. Generally, multiple statistical algorithms are set. The statistical values ​​corresponding to different statistical algorithms represent characteristic indicators with different meanings. Commonly used statistical algorithms include: std standard deviation, median middle value, diff window difference, entropy entropy, skew deviation, kurtosis kurtosis, etc. Finally, the time series change feature is composed of multiple groups of statistical values ​​in different time windows. For example, using 5 statistical algorithms to count the number of memory abnormality logs in two time windows respectively, 10 statistical values ​​will be obtained. Then, the time series change feature is composed of these 10 statistical values ​​as characteristic indicators. The time series change feature can describe the operation of the device's memory in a certain period of time.

[0090] Further, for Figure 1 Step 103 shown in FIG. 1 is to calculate the operating state characteristics of the memory in the device based on the address information of the memory error in the abnormal log, that is, the characteristics constructed from a microscopic perspective. The specific construction process is as follows: Figure 4 As shown, including:

[0091] Step 401: extract address information of memory errors from the exception log according to a preset time window.

[0092] In this step, the preset time windows include the current time window and the historical time window, wherein the current time window is a time period defined based on the current time, and the historical time window is another time period defined based on the current time window. For example, the current time point is T, and the current time window C[Tc,T] is constructed by moving forward c hours from time T, and the historical data time window H is constructed as [Tch,Tc] by moving forward h hours from time Tc.

[0093] According to the time window constructed above, address information of the memory error occurring in the corresponding time window, that is, CE address information, is obtained.

[0094] Step 402: Count abnormal memory particles in the device memory according to the address information.

[0095] The physical structure of the device memory is composed of numerous memory particles. A conventional memory stick generally contains multiple memory banks. The memory particles in each memory bank are arranged in a matrix form. Each memory particle has corresponding location information, that is, the address information of the memory.

[0096] The abnormal memory particles in this step refer to memory particles with a risk of failure, and specifically include weak particles, weak memory rows, weak memory columns, and adjacent weak particles.

[0097] Specifically, a weak particle refers to a memory particle that has at least two memory particles corresponding to the same address information in the current time window, and a memory particle that has at least one memory particle corresponding to the same address information in both the current time window and the historical time window. That is, a memory particle with two or more CEs in the current time window C, or a memory particle that has only one CE in the current time window C and has also had a CE at the same position in the historical time window H, can be defined as a weak particle.

[0098] A weak memory row and a weak memory column refer to a memory row or a memory column containing at least one of the above-mentioned weak particles, and a memory row or a column in which at least one address information exists in the same memory row or column in the current time window and the historical time window, that is, different memory particles in the same memory row or memory column have CE information in the time windows C and H respectively.

[0099] Neighboring weak particles refer to searching for address information existing in the current time window within a preset range according to the determined weak memory row or weak memory column, and the memory particles corresponding to the address information are neighboring weak particles. Neighboring weak particles can reflect the characteristic that memory errors will spread along the same line or column. The preset range is to set the query interval of rows or columns according to actual needs. For example, the weak memory row is the memory particle in the 10th row, and the preset range is 4 rows above and below. Then the neighboring weak particles are the memory particles in the 6th-9th row memory particles and the 11th-14th row memory particles that have CE information and have not yet formed weak particles.

[0100] Step 403: Count the operating status characteristics of the device memory according to the abnormal memory particles and the preset indicators.

[0101] The preset indicators constituting the operating status characteristics in this step include: scatter, row error, column error, small area error, and single bit error.

[0102] Among them, the scatter is the number of weak particles, the row error is the number of address information existing in the weak memory row, the column error is the number of address information existing in the weak memory column, the small area error is the number of adjacent weak particles, and the single-bit error is the number of memory particles in which the number of address information existing in the weak particles is greater than a threshold.

[0103] Further, for Figure 1 In step 104 of the embodiment shown, the time series change feature and the operation state feature are integrated into the memory fault warning feature. The preferred integration method of this embodiment is: vectorizing the time series change feature and the operation state feature. The vectorized representation can be in the above Figure 2 and Figure 4 In the process of constructing features shown in the figure, the features are directly vectorized; then, the vectors corresponding to the timing change features and the running status features are concatenated to obtain the vector representation of the memory fault warning features.

[0104] Furthermore, based on the memory warning information obtained in the above embodiment, the embodiment of the present invention can also optimize the device memory according to the memory warning information to avoid the device memory from failing. Specifically, the target memory with failure risk can be determined based on the device's memory warning information, and the corresponding failure optimization strategy can be determined based on the description information of the memory failure in the memory warning information, that is, how to optimize the memory, wherein the specific memory optimization method includes but is not limited to adjusting the size of the cache area, releasing memory space, optimizing the data in the memory, etc. Afterwards, the target memory is optimized based on the determined failure optimization strategy to avoid the predicted failure of the memory.

[0105] It should be noted that the optimization processing operation can be manually determined based on the memory warning information to determine whether to execute it, or the corresponding memory optimization operation can be automatically executed after the memory warning information is determined.

[0106] Furthermore, in order to effectively prompt the memory warning information, the embodiment of the present invention can also display the memory warning information through a visual fault alarm interface based on the memory warning information obtained in the above embodiment, so as to prompt the relevant maintenance personnel to optimize the memory. Specifically, the fault alarm interface is as follows: Figure 5 As shown, the memory warning information is arranged and displayed in the form of a list, and the display order can be sorted according to the generation time of the predicted information, or according to the time when the predicted target memory fails. At the same time, in each displayed memory warning information, there is also a corresponding optimization processing button for the memory warning information, and the optimization processing button is used to execute the fault optimization strategy corresponding to the memory warning information. Moreover, the optimization processing button is displayed as an operable state only when the user selects a certain memory warning information, that is, the user can only perform the corresponding memory optimization operation after selecting a memory warning information. Furthermore, a corresponding batch selection button can also be set for the user to select memory warning information. Furthermore, after the user chooses to complete the optimization processing for the target memory, the fault alarm interface can also delete the corresponding memory warning information.

[0107] Furthermore, as a response to the above Figure 1-4 The implementation of the method shown in the figure, the embodiment of the present invention provides a memory failure warning device, the main purpose of which is to describe the characteristics corresponding to the memory working state from multiple dimensions, so as to predict whether the memory has a failure risk. For ease of reading, this device embodiment will no longer repeat the details of the aforementioned method embodiment, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. The device is as follows Figure 6 As shown, specifically including:

[0108] An acquisition unit 51 is used to acquire an abnormality log of a device;

[0109] A first determining unit 52 is configured to analyze a time series variation feature of the memory abnormality log according to a preset time period based on the memory abnormality log in the abnormality log obtained by the acquiring unit 51;

[0110] A second determining unit 53 is used to count the operating status characteristics of the device memory based on the address information of the memory error in the abnormal log obtained by the acquiring unit 51;

[0111] A fusion unit 54, configured to fuse the time series variation feature obtained by the first determination unit 52 and the operation state feature obtained by the second determination unit 53 into a memory fault warning feature;

[0112] The early warning unit 55 is used to process the memory fault early warning feature obtained by the fusion unit 54 by using the early warning model to obtain the memory early warning information of the device.

[0113] Further, such as Figure 7 As shown, the first determining unit 52 includes:

[0114] A setting module 521, used to set multiple time windows;

[0115] A screening module 522, for screening corresponding types of memory exception logs from the exception logs using the memory exception log template;

[0116] A statistics module 523, used for counting the number of different types of memory exception logs obtained by the screening module 522 for each time window set by the setting module 521;

[0117] The feature construction module 524 is used to calculate the statistical value of the number of memory abnormality logs obtained by the statistical module 523 in the multiple time windows by using a preset statistical algorithm to obtain the time series change feature.

[0118] Further, such as Figure 7 As shown, the screening module 522 includes:

[0119] A determination submodule 5221 is used to determine an exception log template according to the content of the exception log, wherein the exception log template is used to structurally represent the content of the exception log;

[0120] The screening submodule 5222 is used to screen the memory exception log template from the exception log template determined by the determination submodule 5221 using the memory exception log marked in the exception log;

[0121] The matching submodule 5223 is used to search the exception log for a log that matches the memory exception log template obtained by the screening submodule 5222 as the memory exception log.

[0122] Furthermore, the determining submodule 5221 is specifically used for:

[0123] Screening the abnormal logs according to preset categories;

[0124] Determine the type of the filtered abnormal log by using a parse tree, wherein the parse tree is used to segment the abnormal log according to the hierarchical preset rules and the log content, the root node and the internal nodes of the parse tree are used for searching, the leaf nodes are used for storing logs, and each leaf node corresponds to a type;

[0125] Matching log templates according to the type;

[0126] Clustering is performed according to the similarities between the log templates to obtain the abnormal log template corresponding to the abnormal log.

[0127] Furthermore, when the determination submodule 5221 performs the operation of determining the type of the filtered abnormal log by using the parse tree, it specifically includes:

[0128] Determine the similarity between the content of the existing logs of the type and the content of the abnormal log;

[0129] If the similarity is greater than a threshold, the abnormal log is assigned to a leaf node corresponding to the type;

[0130] If the similarity is less than or equal to the threshold, a new leaf node is created, and the type corresponding to the leaf node is determined according to the content of the exception log.

[0131] Furthermore, the screening submodule 5222 is specifically used for:

[0132] Obtaining a sequence type of the abnormal log template, wherein the sequence type includes a discrete sequence and a continuous sequence;

[0133] If it is a discrete sequence, a chi-square test is used according to the content of the marked memory exception log to determine whether the exception log template is a memory exception log template;

[0134] If it is a continuous sequence, a KS test is performed based on the distribution of the annotated memory exception log in the same type of exception log to determine whether the exception log template is a memory exception log template.

[0135] Further, such as Figure 7 As shown, the second determining unit 53 includes:

[0136] An extraction module 531 is used to extract address information of memory errors from the exception log according to a preset time window;

[0137] A statistics module 532, configured to count abnormal memory particles in the device memory according to the address information obtained by the extraction module 531;

[0138] The feature construction module 533 is used to count the operating status features of the device memory according to the abnormal memory particles obtained by the statistical module 532 and the preset indicators.

[0139] Furthermore, the preset time window includes a current time window and a historical time window; the statistical module 532 is specifically used for:

[0140] Determine as weak particles the memory particles corresponding to at least two pieces of the same address information in the current time window and the memory particles corresponding to at least one piece of the same address information in both the current time window and the historical time window;

[0141] Determine a memory row or a memory column containing at least one of the weak particles and a memory row or a memory column having at least one address information in the same memory row or column in a current time window and a historical time window as a weak memory row or a weak memory column;

[0142] According to the determined weak memory row or weak memory column, searching for address information existing in the current time window within a preset range, and determining the memory cell corresponding to the address information as a neighboring weak cell;

[0143] The weak grain, the weak memory row, the weak memory column, and the adjacent weak grain are determined as abnormal memory grains.

[0144] Furthermore, the preset indicators in the feature construction module 533 include: scatter, row error, column error, small area error, single bit error;

[0145] Among them, the scatter is the number of weak particles, the row error is the number of address information existing in the weak memory row, the column error is the number of address information existing in the weak memory column, the small area error is the number of adjacent weak particles, and the single-bit error is the number of memory particles in which the number of address information existing in the weak particles is greater than a threshold.

[0146] Further, such as Figure 7 As shown, the fusion unit 54 includes:

[0147] A vectorization module 541, used for vectorizing the time series variation characteristics and the operation status characteristics;

[0148] The splicing module 542 is used to splice the time series change characteristics obtained by the vectorization module 541 with the vector corresponding to the operation status characteristics to obtain the memory fault warning characteristics.

[0149] Further, such as Figure 7 As shown, the device also includes:

[0150] A third determining unit 56 is used to extract the memory temperature abnormality log from the abnormality log to obtain the temperature abnormality feature corresponding to the memory;

[0151] The fusion unit 54 is further configured to fuse the temperature anomaly feature obtained by the third determination unit 56 with the time series variation feature and the operation status feature into a memory fault warning feature.

[0152] Further, such as Figure 7 As shown, the device also includes:

[0153] The memory optimization unit 57 is used to determine the target memory with failure risk and the corresponding failure optimization strategy according to the memory warning information of the device obtained by the warning unit 55; and optimize the target memory according to the failure optimization strategy.

[0154] Further, such as Figure 7 As shown, the device also includes:

[0155] An information display unit 58, used to display the memory warning information of the device obtained by the warning unit 55 in the fault alarm interface;

[0156] The information display unit 58 is also used to display a corresponding optimization processing button in the fault alarm interface according to the memory warning information selected by the user, and the optimization processing button is used to execute the fault optimization strategy corresponding to the memory warning information.

[0157] Further, such as Figure 7 As shown, the information display unit 58 is also used to delete the corresponding memory warning information in the fault alarm interface after completing the optimization process of the target memory.

[0158] In addition, an embodiment of the present invention further provides a processor, which is used to run a program, wherein the program executes the memory failure early warning method provided by any one of the above embodiments when running.

[0159] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0160] It is understandable that the related features in the above methods and devices can be referenced to each other. In addition, the "first", "second" and the like in the above embodiments are used to distinguish the embodiments, but do not represent the advantages and disadvantages of the embodiments.

[0161] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0162] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific languages ​​is for disclosing the preferred embodiment of the present invention.

[0163] In addition, the memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0164] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0165] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0166] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0167] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0168] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0169] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0170] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0171] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0172] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0173] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A memory failure early warning method, the method comprising: Get the abnormal log of the device; Analyzing the time series change characteristics of the memory abnormality log according to a preset time period based on the memory abnormality log in the abnormality log; Counting the operating status characteristics of the memory in the device based on the address information of the memory error in the abnormal log; The timing change feature and the operation status feature are integrated into a memory fault warning feature; The memory fault warning feature is processed using the warning model to obtain memory warning information of the device.

2. The method according to claim 1, characterized in that: Analyzing the time series change characteristics of the memory abnormality log according to a preset time period based on the memory abnormality log in the abnormality log includes: Set multiple time windows; Use the memory exception log template to filter the corresponding type of memory exception log from the exception log; Count the number of different types of memory exception logs for each time window; A preset statistical algorithm is used to calculate statistical values ​​of the number of memory exception logs in the multiple time windows to obtain the time series change characteristics.

3. The method according to claim 2, characterized in that Use the memory exception log template to filter the corresponding types of memory exception logs from the exception logs, including: Determining an exception log template according to the content of the exception log, wherein the exception log template is used to structurally represent the content of the exception log; Filtering a memory exception log template from the exception log templates using the memory exception log marked in the exception log; A log that meets the memory exception log template is searched from the exception logs as the memory exception log.

4. The method according to claim 3, characterized in that the step of determining the abnormal log template according to the content of the abnormal log comprises: Screening the abnormal logs according to preset categories; Determine the type of the filtered abnormal log by using a parse tree, wherein the parse tree is used to segment the abnormal log according to the hierarchical preset rules and the log content, the root node and the internal nodes of the parse tree are used for searching, the leaf nodes are used for storing logs, and each leaf node corresponds to a type; Matching log templates according to the type; Clustering is performed according to the similarities between the log templates to obtain the abnormal log template corresponding to the abnormal log.

5. The method according to claim 4, characterized in that The method of using the parse tree to determine the type of the filtered abnormal log includes: Determine the similarity between the content of the existing logs of the type and the content of the abnormal log; If the similarity is greater than a threshold, the abnormal log is assigned to a leaf node corresponding to the type; If the similarity is less than or equal to the threshold, a new leaf node is created, and the type corresponding to the leaf node is determined according to the content of the exception log.

6. The method according to claim 3, characterized in that Filtering a memory exception log template from the exception log template using the memory exception log marked in the exception log includes: Obtaining a sequence type of the abnormal log template, wherein the sequence type includes a discrete sequence and a continuous sequence; If it is a discrete sequence, a chi-square test is used according to the content of the marked memory exception log to determine whether the exception log template is a memory exception log template; If it is a continuous sequence, a KS test is performed based on the distribution of the annotated memory exception log in the same type of exception log to determine whether the exception log template is a memory exception log template.

7. The method according to claim 1, characterized in that The operation status characteristics of the memory in the device are counted based on the address information of the memory error in the abnormal log, including: Extract the address information of the memory error from the exception log according to the preset time window; Counting abnormal memory particles in the device memory according to the address information; The operating status characteristics of the device memory are counted according to the abnormal memory particles and preset indicators.

8. The method according to claim 7, characterized in that The preset time window includes a current time window and a historical time window; and counting abnormal memory particles in the device memory according to the address information includes: Determine as weak particles the memory particles corresponding to at least two pieces of the same address information in the current time window and the memory particles corresponding to at least one piece of the same address information in both the current time window and the historical time window; Determine a memory row or a memory column containing at least one of the weak particles and a memory row or a memory column having at least one address information in the same memory row or column in a current time window and a historical time window as a weak memory row or a weak memory column; According to the determined weak memory row or weak memory column, searching for address information existing in the current time window within a preset range, and determining the memory cell corresponding to the address information as a neighboring weak cell; The weak grain, weak memory row, weak memory column, and adjacent weak grain are determined as abnormal memory grains.

9. The method according to claim 8, characterized in that The preset indicators include: scatter, row error, column error, small area error, and single bit error; Among them, the scatter is the number of weak particles, the row error is the number of address information existing in the weak memory row, the column error is the number of address information existing in the weak memory column, the small area error is the number of adjacent weak particles, and the single-bit error is the number of memory particles in which the number of address information existing in the weak particles is greater than a threshold.

10. The method according to any one of claims 1 to 9, characterized in that The time series change characteristics and the operation status characteristics are integrated into memory fault warning characteristics, including: Vectorizing the time series variation characteristics and the operation status characteristics; The vectors corresponding to the time series variation feature and the operation status feature are concatenated to obtain the memory fault warning feature.

11. The method according to claim 1, characterized in that: The method further comprises: Extract the memory temperature abnormality log from the abnormality log to obtain the temperature abnormality feature corresponding to the memory; The temperature anomaly feature, the timing change feature, and the operating status feature are integrated into a memory fault warning feature.

12. The method according to claim 1, characterized in that The method further comprises: Determine a target memory with a failure risk and a corresponding failure optimization strategy according to the memory warning information of the device; The target memory is optimized according to the fault optimization strategy.

13. The method according to claim 12, characterized in that The method further comprises: Display memory warning information of the device in the fault alarm interface; The corresponding optimization processing button is displayed in the fault alarm interface according to the memory warning information selected by the user, and the optimization processing button is used to execute the fault optimization strategy corresponding to the memory warning information.

14. The method according to claim 13, characterized in that The method further comprises: After the optimization process for the target memory is completed, the corresponding memory warning information in the fault alarm interface is deleted.

15. A memory failure warning device, comprising: An acquisition unit, used to acquire abnormal logs of a device; A first determining unit, configured to analyze a time series variation feature of the memory abnormality log according to a preset time period based on the memory abnormality log in the abnormality log obtained by the acquiring unit; A second determining unit, configured to collect statistics on operating status characteristics of the memory in the device based on address information of memory errors in the abnormal log obtained by the acquiring unit; a fusion unit, configured to fuse the time series variation feature obtained by the first determination unit and the operation status feature obtained by the second determination unit into a memory fault warning feature; The early warning unit is used to process the memory fault early warning characteristics obtained by the fusion unit by using the early warning model to obtain the memory early warning information of the device.

16. A processor, characterized in that: The processor is used to run a program, wherein the program, when running, executes the memory failure early warning method described in any one of claims 1 to 14.

Images