Database monitoring method and device

Abstract

The present invention provides a database monitoring method and device, which belongs to the field of artificial intelligence technology and can be applied to the financial field or other fields. The database monitoring method includes: constructing target session data according to session connection information; performing clustering calculation on the target session data to obtain target clustering results; wherein the target clustering results include target clusters; determining a time threshold according to the average boundary distance of each target cluster and the maximum value of the session duration corresponding to the target cluster; and outputting monitoring alarm information according to the comparison result between the session duration in the session connection information and the time threshold. The present invention supports dynamic monitoring of a large number of database clusters, can improve the timeliness of monitoring, and timely discover abnormal problems in session connection release.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a database monitoring method and device. Background Art

[0002] For application systems with high concurrent transactions, the application obtains the database session connection from the data source connection pool to perform data read and write operations when processing each transaction. After the processing is completed, the database session connection should be released in time so that subsequent transactions can apply for a new database session connection. Since the data source connection pool is generally set with a maximum number of connections, when the database session connection is not released and recycled in time, a large number of new transactions will not be able to apply for the database session connection, resulting in transaction anomalies, which further causes overall systemic failures of the application system.

[0003] The existing database application monitoring methods have the following main problems:

[0004] 1. Poor timeliness. The database connection pool is often found to be full only after an abnormal situation occurs. At this time, the production operation has already had a significant impact, and it is difficult to discover risks and hidden dangers in advance and avoid abnormalities.

[0005] 2. It is difficult to find abnormal problems in conventional tests, and they are highly hidden. In ordinary tests, the transaction volume often does not reach the transaction volume level of the production environment. The unreleased database session connections in the test environment make it difficult for the database connection usage to reach the upper limit and expose abnormal problems. At the same time, conventional tests may be limited by various factors, and stress testing of full-volume transaction scenarios is often not realistic.

[0006] 3. It is impossible to dynamically monitor a large number of database clusters. High-concurrency transaction systems generally use a large number of database clusters, often more than one database. Abnormal monitoring of database session connections that are not released and recycled in time needs to be frequently performed in the database cluster. The application may be restarted frequently in the test environment, and the unreleased database session connections will be released and recycled each time the application is restarted. Summary of the invention

[0007] The main purpose of the embodiments of the present invention is to provide a database monitoring method and device, which support dynamic monitoring of a large number of database clusters, improve the timeliness of monitoring, and promptly discover abnormal problems in session connection release.

[0008] In order to achieve the above object, an embodiment of the present invention provides a database monitoring method, comprising:

[0009] Building target session data according to session connection information;

[0010] Performing clustering calculation on the target session data to obtain a target clustering result; wherein the target clustering result includes a target cluster;

[0011] Determine a time threshold according to the average boundary distance of each target cluster and the maximum value of the session duration corresponding to the target cluster;

[0012] Output monitoring alarm information based on the comparison result between the session duration in the session connection information and the time threshold.

[0013] The embodiment of the present invention further provides a database monitoring device, comprising:

[0014] A target session data building module, used for building target session data according to session connection information;

[0015] A clustering calculation module, used for performing clustering calculation on the target session data to obtain a target clustering result; wherein the target clustering result includes a target cluster;

[0016] A time threshold determination module, used to determine the time threshold according to the average boundary distance of each target cluster and the maximum value of the session duration corresponding to the target cluster;

[0017] The monitoring alarm module is used to output monitoring alarm information according to the comparison result between the session duration in the session connection information and the time threshold.

[0018] An embodiment of the present invention further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor implements the steps of the database monitoring method when executing the computer program.

[0019] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the database monitoring method are implemented.

[0020] The database monitoring method and device of the embodiment of the present invention first constructs target session data according to session connection information, then performs clustering calculation on the target session data to determine a time threshold according to the average boundary distance of each target cluster and the maximum value of the session duration corresponding to the target cluster, and finally outputs monitoring alarm information according to the comparison result of the session duration in the session connection information and the time threshold, supports dynamic monitoring of a large number of database clusters, can improve the timeliness of monitoring, and promptly discover abnormal problems in session connection release. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 is a flow chart of a database monitoring method according to an embodiment of the present invention;

[0023] Figure 2 is a flow chart of S101 in an embodiment of the present invention;

[0024] Figure 3 is a flow chart of S102 in an embodiment of the present invention;

[0025] Figure 4 is a flow chart of S302 in an embodiment of the present invention;

[0026] Figure 5 is a flow chart of S401 in an embodiment of the present invention;

[0027] Figure 6 is a structural block diagram of a database monitoring device in an embodiment of the present invention;

[0028] Figure 7 is a schematic diagram of a database monitoring device in another embodiment of the present invention;

[0029] Figure 8 It is a structural block diagram of a computer device in an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] Those skilled in the art will appreciate that the embodiments of the present invention may be implemented as a system, device, apparatus, method or computer program product. Therefore, the present disclosure may be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0032] In view of the poor timeliness of the prior art, the difficulty in discovering abnormal problems, and the inability to dynamically monitor a large number of database clusters, the embodiment of the present invention provides a database monitoring method and device, which can monitor the abnormalities of database session connections not being released and recovered in a large number of database clusters under a common test environment, and at the same time use the monitoring data results to iteratively optimize the analysis model, which can improve the monitoring timeliness and timely discover the abnormal problems of session connection release. The present invention is described in detail below with reference to the accompanying drawings.

[0033] Figure 1 1 is a flow chart of a database monitoring method according to an embodiment of the present invention. Figure 1 As shown, the database monitoring method includes:

[0034] S101: Construct target session data according to session connection information.

[0035] Before executing S101, the session connection information of the current target database can be collected and stored regularly, and the unique collection batch number is recorded in each collection, and synchronously recorded in the session connection information. The session connection information includes the application to which it belongs, the node to which it belongs, the unique session ID, the session login time, the session duration, the session state, and the DML (Data Manipulation Language) information of the last SQL (Structured Query Language) executed, etc. When executing S101, the session connection analysis program is started to determine the collection batch to be analyzed, and the target session data is constructed according to the session connection information in all the collection batches to be analyzed.

[0036] Figure 2 is a flow chart of S101 in an embodiment of the present invention. Figure 2 As shown, S101 includes:

[0037] S201: Divide the session connection information according to session feature data in the session connection information.

[0038] The session characteristic data includes the application to which it belongs, the node to which it belongs, and the DML information of the last executed SQL. When the session characteristic data of two session connection information are the same, the two session connection information are classified into the same group.

[0039] S202: Determine the number of session connections and the target session duration according to the divided session connection information.

[0040] In one embodiment, determining the target session duration according to the divided session connection information includes: determining a maximum value of the session durations in the divided session connection information as the target session duration.

[0041] In specific implementation, the number of unique session IDs in each group is counted as the number of session connections (session feature data of the same group of session connection information is the same), and the maximum value of the session duration of each group of session connection information is determined as the target session duration of the group.

[0042] S203: Construct target session data according to the number of session connections and the target session duration.

[0043] In specific implementation, the i-th target session data is S i ={n i ,t i},n i is the number of session connections for the i-th target session data, t i is the target session duration of the i-th target session data.

[0044] S102: Perform clustering calculation on the target session data to obtain a target clustering result.

[0045] The target clustering result includes a target cluster.

[0046] Figure 3 is a flow chart of S102 in an embodiment of the present invention. Figure 3 As shown, S102 includes:

[0047] S301: Acquire session feature data in the whitelist, and filter target session data according to the session feature data in the whitelist.

[0048] In specific implementation, when the session feature data of the target session data is consistent with the session feature data in the whitelist, the target session data is deleted; when the session feature data of the target session data is inconsistent with the session feature data in the whitelist, the target session data is retained, so that the new clustering results can converge more quickly.

[0049] S302: Perform clustering calculation on the filtered target conversation data to obtain a target clustering result.

[0050] The present invention uses K-means clustering algorithm to analyze target session data. Normally established and released session connection information has similar clustering characteristics, while abnormally released session connection information shows large deviation from the class characteristics in sampling statistics. The present invention divides the screened target session data into k clusters, making the dissimilarity between target session data within each cluster as low as possible, while the dissimilarity between target session data in different clusters as high as possible.

[0051] Figure 4 is a flow chart of S302 in an embodiment of the present invention. Figure 4 As shown, S302 includes:

[0052] S401: performing cluster calculation on the filtered target session data according to each hyperparameter to obtain clustering results of each hyperparameter.

[0053] Figure 5 4 is a flow chart of S401 in an embodiment of the present invention. Figure 5 As shown, S401 includes:

[0054] S501: Select a cluster center from the filtered target session data according to the hyperparameters.

[0055] Taking the hyperparameter k1 as an example, k1 target session data are selected from the screened x target session data as the cluster centers of the k1 clusters.

[0056] S502: Obtaining original clustering results according to the dissimilarity between the filtered target conversation data and the centers of each cluster.

[0057] The original clustering results include the original clusters.

[0058] In specific implementation, the dissimilarity can be determined by the following formula:

[0059]

[0060] Among them, d(S i ,S j ) is the difference between the i-th target session data and the j-th cluster center, n i is the number of session connections for the i-th target session data, t i is the target session duration of the i-th target session data, n j is the number of session connections at the jth cluster center, t j is the target session duration of the j-th cluster center.

[0061] When S502 is executed, the dissimilarity between the filtered target conversation data and the cluster center of each original cluster is determined, and the target conversation data is divided into the original cluster corresponding to the minimum value of the dissimilarity to obtain the original clustering result.

[0062] S503: adjusting the cluster center of each original cluster according to the dissimilarity between the target session data of each original cluster and the corresponding cluster center, replacing the cluster center with the adjusted cluster center and then performing corresponding iterative calculation.

[0063] In a specific implementation, the average value of the dissimilarity between the target session data of each original cluster and the corresponding cluster center is determined as the adjusted cluster center of each original cluster.

[0064] S504: When the current iteration number is equal to the preset iteration number, determine the original clustering result of the current iteration as the clustering result.

[0065] In one embodiment, the method further includes: when the original clustering result no longer changes, determining the original clustering result of the current iteration as the clustering result.

[0066] S402: Determine the target clustering result according to the average distance of the dissimilarity of each clustering result.

[0067] In specific implementation, the average value of the dissimilarity between the target session data of each clustering result and the corresponding cluster center is determined as the average dissimilarity distance of each clustering result. For example, the average dissimilarity distance of hyperparameter k1 is y1, the average dissimilarity distance of hyperparameter k2 is y2, the average dissimilarity distance of hyperparameter k3 is y3...; let y1'=y2 / y1, y2'=y3 / y2, y3'=y4 / y3...; z1=y2' / y1', z2=y3' / y2', z3=y4' / y3'..., then determine that the clustering result of the hyperparameter corresponding to the minimum value of z is the target clustering result. For example, if z2 is the minimum value in z, then the clustering result of the hyperparameter k2 corresponding to z2 is the target clustering result.

[0068] S103: Determine a time threshold according to the average boundary distance of each target cluster and the maximum value of the session duration corresponding to the target cluster.

[0069] In one embodiment, it further includes: determining the dissimilarity between the target session data in each target cluster and the cluster center of each target cluster as the average boundary distance of each target cluster.

[0070] In specific implementation, the average value of the average boundary distance of each target cluster is determined as the boundary distance of the target clustering result, and the maximum value of the session duration corresponding to the target cluster is the maximum value of the session duration of the cluster center of multiple target clusters. The time threshold is the difference between the maximum value of the session duration and the boundary distance of the target clustering result.

[0071] S104: Output monitoring alarm information according to the comparison result between the session duration in the session connection information and the time threshold.

[0072] In a specific implementation, when the session duration in the session connection information is greater than a time threshold, the session connection information is determined to be abnormal, and monitoring alarm information including the session connection information is output.

[0073] Figure 1 The execution subject of the database monitoring method shown can be a computer. Figure 1As can be seen from the process shown, the database monitoring method of the embodiment of the present invention first constructs target session data based on session connection information, then performs clustering calculation on the target session data to determine the time threshold based on the average boundary distance of each target cluster and the maximum value of the session duration corresponding to the target cluster, and finally outputs monitoring alarm information based on the comparison result of the session duration in the session connection information and the time threshold. It supports dynamic monitoring of a large number of database clusters, can improve the timeliness of monitoring, and promptly discover abnormal problems in session connection release.

[0074] The specific process of the embodiment of the present invention is as follows:

[0075] 1. Divide the session connection information according to the session feature data in the session connection information.

[0076] 2. Determine the number of session connections and the target session duration based on the divided session connection information.

[0077] 3. Build target session data based on the number of session connections and target session duration.

[0078] 4. Obtain the session feature data in the whitelist, and filter the target session data according to the session feature data in the whitelist.

[0079] 5. Perform clustering calculation on the filtered target session data according to each hyperparameter to obtain the clustering results of each hyperparameter.

[0080] 6. Determine the target clustering result based on the average distance of the dissimilarity of each clustering result.

[0081] 7. Determine the time threshold according to the average boundary distance of each target cluster and the maximum value of the session duration corresponding to the target cluster.

[0082] 8. Output monitoring alarm information based on the comparison result between the session duration in the session connection information and the time threshold.

[0083] In summary, the present invention overcomes the deficiencies in the prior art and can monitor the anomalies of unreleased and unrecovered database session connections in a large number of database clusters in a common test environment, while using the monitoring data results to iteratively optimize the analysis model.

[0084] The present invention can achieve the following inventive effects:

[0085] 1. Improve monitoring timeliness. Risks can be discovered in advance by covering a small amount of transactions during the testing phase to avoid abnormalities during production operation.

[0086] 2. During routine functional testing, monitoring revealed abnormal session connection release issues.

[0087] 3. Support dynamic monitoring of a large number of database clusters.

[0088] Based on the same inventive concept, an embodiment of the present invention further provides a database monitoring device. Since the principle of solving the problem by the device is similar to that of the database monitoring method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0089] Figure 6 It is a structural block diagram of a database monitoring device in an embodiment of the present invention. Figure 7 FIG. 1 is a schematic diagram of a database monitoring device in another embodiment of the present invention. Figure 6-Figure 7 As shown, the database monitoring device includes:

[0090] A target session data building module, used for building target session data according to session connection information;

[0091] A clustering calculation module, used for performing clustering calculation on the target session data to obtain a target clustering result; wherein the target clustering result includes a target cluster;

[0092] A time threshold determination module, used to determine the time threshold according to the average boundary distance of each target cluster and the maximum value of the session duration corresponding to the target cluster;

[0093] The monitoring alarm module is used to output monitoring alarm information according to the comparison result between the session duration in the session connection information and the time threshold.

[0094] like Figure 7 As shown, in actual application, the database monitoring device includes a data acquisition module, a task management module, a data processing and analysis module and a monitoring and alarm module.

[0095] The data acquisition module is responsible for acquiring the session connection information in a single database, and includes a task instruction processing unit, a session connection information acquisition unit and an information storage unit.

[0096] The task instruction processing unit is used to receive the data collection instruction issued by the task management module and initialize the session connection information of the current target database.

[0097] The session connection information collection unit is used to collect the session connection information of the database, including the application, node, unique session ID, session login time, session duration, session status, and DML information of the last SQL execution, etc. The unique collection batch number is recorded each time the collection is performed and synchronously recorded in the session connection information.

[0098] The information storage unit is used to store the collected current session information and session connection information in a database.

[0099] The task management module includes an information entry unit, a task instruction compilation unit and a task instruction allocation unit.

[0100] The information entry unit is used to provide an operation interface. The operation management personnel enter and modify the database information that needs to be monitored, the data collection cycle frequency and the data processing and analysis cycle frequency through the information entry unit.

[0101] The task instruction compilation unit is used to regularly compile and generate data acquisition task instructions according to the entered database information and the data acquisition cycle frequency, and to regularly compile and generate data processing and analysis task instructions according to the entered database information and the data processing and analysis cycle frequency.

[0102] The task instruction allocation unit is used to issue the data collection task instruction to the data collection module when the task planning time arrives, and to issue the data processing and analysis task instruction to the data processing and analysis module when the task planning time arrives.

[0103] The data processing and analysis module includes a task instruction processing unit, a session connection information statistics unit, an intelligent analysis unit and an abnormality monitoring unit.

[0104] The task instruction processing unit is used to receive the data processing and analysis tasks issued by the task management module, initialize the statistical information of the number of session connections and the target session duration of the target database, initialize the clustering features and thresholds, start the session connection analysis program, and call the session connection information statistics unit and the intelligent analysis unit for processing.

[0105] The session connection information statistics unit includes a target session data construction module, which is used to count the session connection information in the database in the specified time period of the statistical processing and analysis task, and count the distribution of the same session feature data.

[0106] The intelligent analysis unit includes a clustering calculation module, a time threshold determination module and a monitoring alarm module, which are used to use a clustering algorithm to analyze the target session data output by the session connection information statistics unit. The session connection information normally established and released based on the connection pool has similar clustering characteristics, while the session connection information that cannot be released normally shows a large deviation from the class characteristics in the sampling statistics, and the session connection information with abnormal characteristics is obtained.

[0107] The abnormal monitoring unit is used to send the session connection information of the session duration greater than the threshold to the monitoring alarm module.

[0108] After receiving the abnormal monitoring data from the data processing and analysis module, the monitoring and alarm module notifies the operator to pay attention through a preset monitoring and alarm method, including an abnormal monitoring unit, a notification message unit and a processing feedback unit.

[0109] The abnormal monitoring unit is used to initialize the monitoring alarm notification mode and the list of operation management personnel to be notified, and receive the abnormal session connection information sent by the data processing and analysis module.

[0110] The notification message unit is used to notify the operation management personnel of the abnormal session connection information received by the abnormal monitoring unit in a preset manner.

[0111] The processing feedback unit is used to provide an abnormal information processing feedback operation interface. The operation management personnel use the operation interface to process the abnormal session connection information and set the confirmed non-abnormal session connection information into the normal session connection whitelist.

[0112] In summary, the database monitoring device of the embodiment of the present invention first constructs target session data according to the session connection information, and then performs clustering calculation on the target session data to determine the time threshold according to the average boundary distance of each target cluster and the maximum value of the session duration corresponding to the target cluster, and finally outputs monitoring alarm information according to the comparison result of the session duration in the session connection information and the time threshold, supports dynamic monitoring of a large number of database clusters, can improve the timeliness of monitoring, and promptly discover abnormal problems in session connection release.

[0113] The embodiment of the present invention also provides a specific implementation of a computer device that can implement all the steps in the database monitoring method in the above embodiment. Figure 8 is a block diagram of a computer device in an embodiment of the present invention, see Figure 8 , the computer equipment specifically includes the following contents:

[0114] Processor (processor) 801 and memory (memory) 802.

[0115] The processor 801 is used to call the computer program in the memory 802. When the processor executes the computer program, all steps in the database monitoring method in the above embodiment are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0116] Building target session data according to session connection information;

[0117] Performing clustering calculation on the target session data to obtain a target clustering result; wherein the target clustering result includes a target cluster;

[0118] Determine a time threshold according to the average boundary distance of each target cluster and the maximum value of the session duration corresponding to the target cluster;

[0119] Output monitoring alarm information based on the comparison result between the session duration in the session connection information and the time threshold.

[0120] In summary, the computer device of the embodiment of the present invention first constructs the target session data according to the session connection information, and then performs clustering calculation on the target session data to determine the time threshold according to the average boundary distance of each target cluster and the maximum value of the session duration corresponding to the target cluster, and finally outputs the monitoring alarm information according to the comparison result of the session duration in the session connection information and the time threshold, supports dynamic monitoring of a large number of database clusters, can improve the timeliness of monitoring, and promptly discover abnormal problems in session connection release.

[0121] The embodiment of the present invention also provides a computer-readable storage medium capable of implementing all the steps in the database monitoring method in the above embodiment. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, all the steps of the database monitoring method in the above embodiment are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0122] Building target session data according to session connection information;

[0123] Performing clustering calculation on the target session data to obtain a target clustering result; wherein the target clustering result includes a target cluster;

[0124] Determine a time threshold according to the average boundary distance of each target cluster and the maximum value of the session duration corresponding to the target cluster;

[0125] Output monitoring alarm information based on the comparison result between the session duration in the session connection information and the time threshold.

[0126] In summary, the computer-readable storage medium of the embodiment of the present invention first constructs the target session data according to the session connection information, and then performs clustering calculation on the target session data to determine the time threshold according to the average boundary distance of each target cluster and the maximum value of the session duration corresponding to the target cluster, and finally outputs the monitoring alarm information according to the comparison result of the session duration in the session connection information and the time threshold, supports dynamic monitoring of a large number of database clusters, can improve the timeliness of monitoring, and promptly discover abnormal problems in session connection release.

[0127] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

[0128] Those skilled in the art may also understand that the various illustrative logical blocks, units, and steps listed in the embodiments of the present invention may be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly demonstrate the interchangeability of hardware and software, the various illustrative components, units, and steps described above have generally described their functions. Whether such functions are implemented by hardware or software depends on the specific application and the design requirements of the entire system. Those skilled in the art may use various methods to implement the described functions for each specific application, but such implementation should not be understood as exceeding the scope of protection of the embodiments of the present invention.

[0129] The various illustrative logic blocks, or units, or devices described in the embodiments of the present invention can be implemented or operated by a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic, a discrete hardware component, or any combination of the above. The general-purpose processor can be a microprocessor, and optionally, the general-purpose processor can also be any conventional processor, controller, microcontroller or state machine. The processor can also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, a plurality of microprocessors, one or more microprocessors combined with a digital signal processor core, or any other similar configuration.

[0130] The steps of the method or algorithm described in the embodiments of the present invention can be directly embedded in hardware, a software module executed by a processor, or a combination of the two. The software module can be stored in a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a removable disk, a CD-ROM, or other storage media of any form in the art. Exemplarily, the storage medium can be connected to the processor so that the processor can read information from the storage medium and can write information to the storage medium. Optionally, the storage medium can also be integrated into the processor. The processor and the storage medium can be arranged in an ASIC, and the ASIC can be arranged in a user terminal. Optionally, the processor and the storage medium can also be arranged in different components in the user terminal.

[0131] In one or more exemplary designs, the above functions described in the embodiments of the present invention can be implemented in hardware, software, firmware or any combination of the three. If implemented in software, these functions can be stored on a computer-readable medium, or transmitted in the form of one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media that facilitate the transfer of computer programs from one place to another. The storage medium can be any available medium that can be accessed by any general or special computer. For example, such computer-readable media can include but are not limited to RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store program codes in the form of instructions or data structures and other forms that can be read by general or special computers, or general or special processors. In addition, any connection can be appropriately defined as a computer-readable medium, for example, if the software is transmitted from a website site, server or other remote resource through a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL) or wirelessly, such as infrared, wireless and microwave, it is also included in the defined computer-readable medium. The disk and disc include compact disk, laser disk, optical disk, DVD, floppy disk and blue-ray disk. Disks usually copy data magnetically, while discs usually copy data optically with lasers. The above combination can also be included in computer readable media.

Claims

1. A database monitoring method, characterized in that: include: Building target session data according to session connection information; Performing clustering calculation on the target session data to obtain a target clustering result; wherein the target clustering result includes a target cluster; Determine a time threshold according to the average boundary distance of each target cluster and the maximum value of the session duration corresponding to the target cluster; Outputting monitoring alarm information according to a comparison result between the session duration in the session connection information and the time threshold; Constructing target session data based on session connection information includes: dividing the session connection information according to the session characteristic data in the session connection information; Determine the number of session connections and the target session duration according to the divided session connection information; constructing the target session data according to the number of session connections and the target session duration; Performing clustering calculation on the target session data to obtain a target clustering result includes: Acquire session characteristic data in the whitelist, and filter the target session data according to the session characteristic data in the whitelist; Perform clustering calculation on the filtered target session data to obtain a target clustering result; The target clustering results obtained by clustering the filtered target session data include: Perform clustering calculation on the filtered target session data according to each hyperparameter to obtain the clustering results of each hyperparameter; Determine the target clustering result according to the average distance of the dissimilarity of each clustering result; The clustering results of each hyperparameter obtained by clustering the filtered target session data according to each hyperparameter include: Selecting a cluster center from the filtered target session data according to the hyperparameter; Obtaining an original clustering result according to the dissimilarity between the filtered target session data and the centers of each cluster; wherein the original clustering result includes the original cluster; The cluster center of each original cluster is adjusted according to the dissimilarity between the target session data of each original cluster and the corresponding cluster center, and the cluster center is replaced with the adjusted cluster center and then the corresponding iterative calculation is performed; When the current iteration number is equal to the preset iteration number, the original clustering result of the current iteration is determined to be the clustering result.

2. The database monitoring method according to claim 1, characterized in that: Determining the target session duration based on the divided session connection information includes: The maximum value of the session duration in the divided session connection information is determined as the target session duration.

3. The database monitoring method according to claim 1, characterized in that: Also includes: The dissimilarity between the target conversation data in each target cluster and the cluster center of each target cluster is determined as the average boundary distance of each target cluster.

4. A database monitoring device, characterized in that: include: A target session data building module, used for building target session data according to session connection information; A clustering calculation module, used for performing clustering calculation on the target session data to obtain a target clustering result; wherein the target clustering result includes a target cluster; A time threshold determination module, used to determine the time threshold according to the average boundary distance of each target cluster and the maximum value of the session duration corresponding to the target cluster; A monitoring alarm module, configured to output monitoring alarm information according to a comparison result between the session duration in the session connection information and the time threshold; The target session data construction module is specifically used for: dividing the session connection information according to the session characteristic data in the session connection information; Determine the number of session connections and the target session duration according to the divided session connection information; constructing the target session data according to the number of session connections and the target session duration; The clustering calculation module is specifically used for: Acquire session characteristic data in the whitelist, and filter the target session data according to the session characteristic data in the whitelist; Perform clustering calculation on the filtered target session data to obtain a target clustering result; The target clustering results obtained by clustering the filtered target session data include: Perform clustering calculation on the filtered target session data according to each hyperparameter to obtain the clustering results of each hyperparameter; Determine the target clustering result according to the average distance of the dissimilarity of each clustering result; The clustering results of each hyperparameter obtained by clustering the filtered target session data according to each hyperparameter include: Selecting a cluster center from the filtered target session data according to the hyperparameter; Obtaining an original clustering result according to the dissimilarity between the filtered target session data and the centers of each cluster; wherein the original clustering result includes the original cluster; The cluster center of each original cluster is adjusted according to the dissimilarity between the target session data of each original cluster and the corresponding cluster center, and the cluster center is replaced with the adjusted cluster center and then the corresponding iterative calculation is performed; When the current iteration number is equal to the preset iteration number, the original clustering result of the current iteration is determined to be the clustering result.

5. A computer device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of the database monitoring method according to any one of claims 1 to 3 are implemented.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the database monitoring method according to any one of claims 1 to 3 are implemented.

Images