A monitoring threshold determination and monitoring alarm method, device, equipment and medium

Abstract

The embodiment of the application discloses a kind of monitoring threshold determination and monitoring alarm method, device, equipment and medium, wherein, monitoring threshold determination method includes: obtaining the same equipment as the hardware configuration parameter of monitoring threshold to be determined equipment, historical operating index data when equipment failure occurs;Based on the historical operating index data in the historical operating index data of pre-set proportion and the hardware configuration parameter, establish operating index data vector group;The similarity of historical operating index data except the historical operating index data of pre-set proportion and the operating index data in the operating index data vector group is calculated, and the monitoring threshold of the operating index of the monitoring threshold to be determined equipment is determined based on similarity calculation result.This embodiment technical scheme solves the problem that device operation monitoring threshold setting is not accurate enough, false alarm rate is high, realizes the reasonable setting device operation monitoring threshold, to improve monitoring alarm accuracy, improve user experience.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer technology, and in particular to a method, apparatus, device and medium for determining monitoring thresholds and monitoring alarms. Background Technology

[0002] During the use of computer equipment, a data monitoring threshold is usually set for the relevant performance parameters of the computer equipment during operation. Whenever the monitored data indicators of the equipment exceed the corresponding threshold, an alarm is issued to remind the user of the current usage status of the equipment, thereby preventing equipment failure.

[0003] However, in the process of realizing the present invention, it was found that at least the following technical problems exist in the prior art: the monitoring threshold of the operating parameters of computer equipment is a fixed value set by the user based on experience. Due to the increase in the number of monitored devices and the diversification of monitoring indicators, the fixed experience threshold is not applicable to all devices, which will lead to a large number of false alarms and increase the cost of equipment operation and maintenance. Summary of the Invention

[0004] This invention provides a method, apparatus, device, and medium for determining and alarming monitoring thresholds, thereby achieving more accurate determination of monitoring thresholds and reducing false alarm rates.

[0005] In a first aspect, embodiments of the present invention provide a method for determining a monitoring threshold, the method comprising:

[0006] Acquire historical operational index data of devices with the same hardware configuration parameters as the devices whose monitoring thresholds are to be determined, when device failures occur.

[0007] Based on a preset proportion of historical operational indicator data in the historical operational indicator data and the hardware configuration parameters, an operational indicator data vector group is established.

[0008] Calculate the similarity between historical operating indicator data (excluding the preset proportion of historical operating indicator data) and the operating indicator data in the operating indicator data vector group, and determine the monitoring threshold of the operating indicator of the device to be monitored based on the similarity calculation result.

[0009] Secondly, embodiments of the present invention provide a monitoring and alarm method, the method comprising:

[0010] Acquire real-time operation monitoring data of the monitored equipment and compare the real-time operation monitoring data with a preset monitoring threshold;

[0011] When the monitoring data of any operation indicator in the real-time operation monitoring data is greater than or equal to the corresponding preset monitoring threshold, the data similarity between the real-time operation monitoring data and the operation monitoring data of the monitored equipment within a preset historical time period is calculated.

[0012] When the data similarity is lower than a preset similarity threshold, a threshold monitoring alarm is issued.

[0013] Thirdly, embodiments of the present invention also provide a monitoring threshold determination device, the device comprising:

[0014] The historical monitoring data acquisition module is used to acquire historical operating index data of devices with the same hardware configuration parameters as the devices whose monitoring thresholds are to be determined when a device failure occurs.

[0015] The operation indicator data vector construction module is used to establish an operation indicator data vector group based on a preset proportion of historical operation indicator data in the historical operation indicator data and the hardware configuration parameters;

[0016] The monitoring threshold determination module is used to calculate the similarity between historical operating indicator data (excluding the preset proportion of historical operating indicator data) and the operating indicator data in the operating indicator data vector group, and to determine the monitoring threshold of the operating indicator of the device to be determined based on the similarity calculation result.

[0017] Fourthly, embodiments of the present invention also provide a monitoring and alarm device, the device comprising:

[0018] The threshold comparison module is used to acquire real-time operation monitoring data of the monitored device and compare the real-time operation monitoring data with a preset monitoring threshold, wherein the preset monitoring threshold is a monitoring threshold determined by the monitoring threshold determination method described in any embodiment.

[0019] The similarity determination module is used to calculate the data similarity between the real-time operation monitoring data and the operation monitoring data of the monitored equipment within a preset historical time period when the monitoring data of any operation indicator in the real-time operation monitoring data is greater than or equal to the corresponding preset monitoring threshold.

[0020] The monitoring and alarm module is used to issue a threshold monitoring alarm when the data similarity is lower than a preset similarity threshold.

[0021] Fifthly, embodiments of the present invention also provide a computer device, the computer device comprising:

[0022] One or more processors;

[0023] Memory, used to store one or more programs;

[0024] When the one or more programs are executed by the one or more processors, the one or more processors implement a monitoring threshold determination method or a monitoring alarm method as provided in any embodiment of the present invention.

[0025] In a sixth aspect, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a monitoring threshold determination method or a monitoring alarm method as provided in any embodiment of the present invention.

[0026] The embodiments of the above invention have the following advantages or beneficial effects:

[0027] This invention addresses the problem of inaccurate device operation monitoring thresholds and high false alarm rates in existing technologies. It obtains historical operational indicator data of devices with the same hardware configuration parameters as the device whose monitoring threshold is to be determined, based on historical operational indicator data of the same configuration devices at a predetermined proportion and the hardware configuration parameters. Specifically, it establishes an operational indicator data vector group by calculating the similarity between historical operational indicator data (excluding the predetermined proportion) and the operational indicator data in the operational indicator data vector group, and determines the monitoring threshold for the device's operational indicators based on the similarity calculation results. This solves the problem of inaccurate device operation monitoring threshold settings and high false alarm rates in existing technologies. It enables the reasonable setting of device operation monitoring thresholds with reference to device hardware parameters, thereby improving monitoring alarm accuracy, achieving effective device monitoring, and enhancing user experience. Attached Figure Description

[0028] Figure 1 This is a flowchart of a monitoring threshold determination method provided in Embodiment 1 of the present invention;

[0029] Figure 2 This is a flowchart of a monitoring and alarm method provided in Embodiment 2 of the present invention;

[0030] Figure 3 This is a schematic diagram of a monitoring threshold determination device provided in Embodiment 3 of the present invention;

[0031] Figure 4 This is a schematic diagram of a monitoring and alarm device provided in Embodiment 4 of the present invention;

[0032] Figure 5 This is a schematic diagram of the structure of a computer device provided in Embodiment 5 of the present invention. Detailed Implementation

[0033] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present invention, and not all of the structures.

[0034] Example 1

[0035] Figure 1 This is a flowchart of a monitoring threshold determination method provided in Embodiment 1 of the present invention. This embodiment is applicable to determining alarm thresholds for operational indicator data of computer equipment. The method can be executed by a monitoring threshold determination device, which can be implemented in software and / or hardware and integrated into a computer device with application development capabilities.

[0036] like Figure 1 As shown, the method for determining the monitoring threshold includes the following steps:

[0037] S110. Obtain historical operating index data of devices with the same hardware configuration parameters as the device to be determined under the monitoring threshold when a device failure occurs.

[0038] During the hardware testing of server equipment, the operating data of each server device is typically monitored to understand the server's operating status in real time and prevent server equipment failures from affecting the normal operation of the services provided by the server.

[0039] During server operation, operational metrics data can be obtained by setting up a monitoring agent on the server side to collect the relevant operational metrics data. After collecting the data, the agent will send the collected operational metrics data to a preset data queue in the form of a message queue. The monitoring threshold determines the device where the device is located and obtains the operational metrics data of the monitored device in the form of consuming the message queue. Then, the data is stored in a preset database, such as a MySQL database or an Elastic Search database.

[0040] For a device whose monitoring threshold needs to be determined, operational indicator data can be pre-collected from devices with the same hardware configuration parameters as the device whose monitoring threshold needs to be determined, showing the device's operational indicators when a fault occurs during operation. The monitoring threshold is then determined based on the collected data. Since different devices typically have different thresholds, in this embodiment, the determination of the monitoring threshold is based on the hardware configuration parameters of the monitoring device, fully considering the device's hardware conditions to obtain a more reasonable threshold result. This avoids false alarms caused by unreasonable monitoring threshold settings. For example, if a server only has 4GB of memory, but the Java Virtual Machine (JVM) is directly allocated 3.5GB of memory, this will easily exceed the threshold, resulting in invalid alarms and increasing the possibility of false alarms.

[0041] Furthermore, the equipment's operational metrics typically include data from two dimensions: CPU (Central Processing Unit) and disk. Examples include disk I / O volume, replication latency, database connection count, CPU utilization, and CPU load.

[0042] S120. Based on a preset proportion of historical operating indicator data in the historical operating indicator data and the hardware configuration parameters, establish an operating indicator data vector group.

[0043] Specifically, the operational indicator data vector group established in this step is composed of a certain proportion of the collected historical operational indicator data, and serves as a numerical reference vector group for setting the final threshold.

[0044] In establishing the operational indicator data vector group, firstly, based on the requirements, the monitoring threshold is determined, the hardware configuration parameters of the equipment are set, and the preset upper and lower limits of each operational indicator are determined. Then, according to the preset distribution order of the operational indicators, maximum and minimum value row vectors are formed respectively. For example, if the CPU's memory capacity is 8GB, and the monitored operational indicator includes CPU memory usage, then the maximum value of this indicator is 8GB, and the minimum value is 0GB. Assuming that four operational indicator data points are collected during equipment monitoring, denoted as A, B, and C, then the maximum value row vector can be represented as... The minimum value row vector can be represented as .

[0045] Then, from all the collected historical operational indicator data, a preset proportion of the historical operational indicator data is arranged in ascending or descending order, forming an ascending or descending row vector for each operational indicator data. For example, if 100 operational indicator data points are collected, 95 of them are used as reference data for threshold determination, representing 95% of the total. Each data point can be represented as a vector. Where i represents the data entry number, the value of which depends on the amount of data. Therefore, the increasing row vector of each operational indicator data can be represented as: ,in, and The subscripts indicate the order of numerical values; the larger the subscript value, the larger the value of indicator A (and vice versa for decreasing row vectors). Indicators B and C are treated similarly. Furthermore, the increasing or decreasing row vectors are arranged according to the preset distribution order of the operational indicators, and the arrangement result, along with the transpose of the maximum and minimum value row vectors, forms an operational indicator data vector group. The operational indicator data vector group can ultimately be represented as... It should be noted that the order of A, B, and C is not limited, and the order of the column vectors in the array can also be adjusted. The key is to calculate the similarity between the other five operational indicators (not used as reference data) and the column vectors in this data set, ensuring that the values ​​of the same indicators are used.

[0046] S130. Calculate the similarity between the historical operating indicator data (excluding the historical operating indicator data of the preset ratio) and the operating indicator data in the operating indicator data vector group, and determine the monitoring threshold of the operating indicator of the device to be determined based on the similarity calculation result.

[0047] Specifically, historical operating indicator data excluding the preset proportion of historical operating indicator data can be represented as follows: Where i represents the number of the data entry, and its value depends on the amount of data. In this step, each vector is calculated. The similarity vector is obtained by comparing the data with the operational indicator data in each column of the operational indicator data vector group, and is represented as follows: Where n represents the number of columns in the operational indicator data vector group. The number of similarity vectors is the same as the number of historical operational indicator data entries excluding the preset proportion of historical operational indicator data. The similarity can be calculated using the cosine similarity formula, which can be expressed as: x and y represent the corresponding operational index data in the two vectors.

[0048] Furthermore, the average value of the column vectors in the operational indicator data vector group corresponding to the element with the highest similarity value in each similarity vector is calculated, and the result is used as the monitoring threshold for the operational indicator of the device to be monitored. In other words, this step finds the threshold data that is most similar to the historical operational indicator data excluding the preset proportion of historical operational indicator data, and then calculates the average of the multiple threshold data, taking the result with the highest similarity as the monitoring threshold for each operational indicator.

[0049] The technical solution of this embodiment obtains historical operating indicator data of devices with the same hardware configuration parameters as the device whose monitoring threshold is to be determined, when the device malfunctions. Specifically, it establishes an operating indicator data vector group based on a preset proportion of historical operating indicator data from devices with the same configuration and the hardware configuration parameters. It calculates the similarity between the historical operating indicator data (excluding the preset proportion) and the operating indicator data in the operating indicator data vector group, and determines the monitoring threshold for the operating indicator of the device whose monitoring threshold is to be determined based on the similarity calculation result. This solves the problem of inaccurate device operation monitoring threshold settings and high false alarm rates in existing technologies. It enables the reasonable setting of device operation monitoring thresholds with reference to device hardware parameters, thereby improving monitoring alarm accuracy, achieving effective device monitoring, and enhancing user experience.

[0050] Example 2

[0051] Figure 2 This is a flowchart of a monitoring and alarm method provided in Embodiment 2 of the present invention. This embodiment belongs to the same inventive concept as the monitoring threshold determination method in the above embodiments, and further describes the process of generating an operational status alarm based on the operating status of the monitored equipment. This method can be executed by a monitoring and alarm device, which can be implemented in software and / or hardware and integrated into a computer device with application development capabilities.

[0052] like Figure 2 As shown, the monitoring and alarm method includes the following steps:

[0053] S210. Obtain real-time operation monitoring data of the monitored device and compare the real-time operation monitoring data with a preset monitoring threshold, wherein the preset monitoring threshold is a monitoring threshold determined by the monitoring threshold determination method described in any embodiment.

[0054] During the process of device operation monitoring, the threshold monitoring and alarm system will timely collect the device operation index data, which usually includes data in two dimensions, namely the CPU (Central Processing Unit) dimension and the disk dimension. For example, indicators such as disk input / output volume, replication latency time, number of database connections, CPU usage rate, and CPU load. Then, the real-time operation monitoring data is compared with the preset monitoring threshold. In particular, the preset monitoring threshold is the monitoring threshold determined by the monitoring threshold determination method described in any embodiment. On the premise of referring to the device hardware parameters, the monitoring threshold for device operation is reasonably set.

[0055] S220. When the monitoring data of any one operation index in the real-time operation monitoring data is greater than or equal to the corresponding preset monitoring threshold, calculate the data similarity between the real-time operation monitoring data and the operation monitoring data of the monitored device within a preset historical time period.

[0056] In this embodiment, after it is detected that the real-time operation data of the monitored device reaches the preset threshold, an alarm will not be issued immediately. Instead, calculate the data similarity between the data reaching the preset threshold and the operation monitoring data of the monitored device itself within a preset historical time period, and further confirm whether the operation data when reaching the preset threshold is abnormal data.

[0057] Specifically, a preset number of operation monitoring data of the monitored device within a preset historical time period can be randomly selected. For example, randomly select 100 operation monitoring data of the monitored device in the recent month; calculate the cosine similarity between the real-time operation monitoring data reaching the preset threshold and the 100 selected operation monitoring data respectively; and then calculate the average value of each cosine similarity as the data similarity.

[0058] S230. When the data similarity is lower than the preset similarity threshold, issue a threshold monitoring alarm.

[0059] Exemplarily, the calculated data similarity is expressed as , if the data similarity value (0.8 < Similarity(x, y) < 1), no alarm will be given. If the final average similarity value (0 < Similarity(x, y) < 0.8), an alarm will be given to notify the engineer of the alarm information so as to check the device status in time.

[0060] The technical solution of this embodiment determines a reasonable monitoring threshold based on the operating data of devices with similar hardware configurations. When any operating indicator monitoring data of the monitored device is greater than or equal to the corresponding operating indicator monitoring threshold, the similarity between the current operating indicator monitoring data and the operating indicator monitoring data of the monitored device within a preset historical time period is calculated. A threshold monitoring alarm is only issued when the similarity is lower than the preset similarity threshold. Based on setting a reasonable alarm threshold, the operating indicator data when the monitoring threshold is reached is further compared with the normal operating state of the device itself, establishing a dual judgment mechanism. This solves the problem of high false alarm rates caused by unreasonable monitoring threshold settings, improves the accuracy of device monitoring alarms, achieves effective device monitoring, and enhances the user experience.

[0061] Example 3

[0062] Figure 3 This is a schematic diagram of the monitoring threshold determination device provided in Embodiment 3 of the present invention. This embodiment can be applied to the situation of determining the alarm threshold of the operating index data of computer equipment. The device can be implemented by software and / or hardware and integrated into a computer equipment with application development functions.

[0063] like Figure 3 As shown, the monitoring threshold determination device includes: a historical monitoring data acquisition module 310, a threshold matching vector construction module 320, and a monitoring threshold determination module 330.

[0064] The historical monitoring data acquisition module 310 is used to acquire historical operating indicator data of devices with the same hardware configuration parameters as the device whose monitoring threshold is to be determined, when a device failure occurs; the operating indicator data vector construction module 320 is used to establish an operating indicator data vector group based on a preset proportion of historical operating indicator data in the historical operating indicator data and the hardware configuration parameters; the monitoring threshold determination module 330 is used to calculate the similarity between historical operating indicator data excluding the preset proportion of historical operating indicator data and the operating indicator data in the operating indicator data vector group, and determine the monitoring threshold of the operating indicator of the device whose monitoring threshold is to be determined based on the similarity calculation result.

[0065] The technical solution of this embodiment obtains historical operating indicator data of devices with the same hardware configuration parameters as the device whose monitoring threshold is to be determined, when the device malfunctions. Specifically, it establishes an operating indicator data vector group based on a preset proportion of historical operating indicator data from devices with the same configuration and the hardware configuration parameters. It calculates the similarity between the historical operating indicator data (excluding the preset proportion) and the operating indicator data in the operating indicator data vector group, and determines the monitoring threshold for the operating indicator of the device whose monitoring threshold is to be determined based on the similarity calculation result. This solves the problem of inaccurate device operation monitoring threshold settings and high false alarm rates in existing technologies. It enables the reasonable setting of device operation monitoring thresholds with reference to device hardware parameters, thereby improving monitoring alarm accuracy, achieving effective device monitoring, and enhancing user experience.

[0066] Optionally, the operational indicator data vector construction module 320 specifically includes:

[0067] The first vector determination submodule is used to determine the preset upper limit and preset lower limit values ​​of each operating indicator according to the hardware configuration parameters, and to form the maximum value row vector and the minimum value row vector respectively according to the preset operating indicator distribution order.

[0068] The second vector determination submodule is used to arrange the values ​​of each operating indicator in the historical operating indicator data of the preset ratio in an increasing or decreasing manner to form an increasing row vector or a decreasing row vector of each operating indicator data.

[0069] The vector group composition submodule is used to arrange the increasing or decreasing row vectors according to the preset operating index distribution order, and to form the operating index data vector group by combining the arrangement result with the transpose of the maximum value row vector and the transpose of the minimum value row vector.

[0070] Optionally, the monitoring threshold determination module 330 includes:

[0071] The monitoring data vector determination submodule is used to form monitoring data row vectors for each group of historical operating indicator data, excluding the historical operating indicator data of the preset proportion, according to the preset operating indicator distribution order.

[0072] The similarity vector determination submodule is used to calculate the similarity between each monitoring data row vector and each column vector of the threshold matching vector group to obtain a similarity vector;

[0073] The monitoring threshold determination submodule is used to calculate the average value of the column vector values ​​in the operation indicator data vector group corresponding to the element with the highest similarity value in each similarity vector, and use the calculation result as the monitoring threshold of the operation indicator of the device to be determined.

[0074] Optionally, the similarity vector determination submodule is specifically used for:

[0075] Calculate the cosine similarity between the row vector of the monitoring data and each column vector of the operational indicator data vector group to obtain a similarity vector.

[0076] The monitoring threshold determination device provided in the embodiments of the present invention can execute the monitoring threshold determination method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0077] Example 4

[0078] Figure 4 This is a schematic diagram of the monitoring and alarm device provided in Embodiment 4 of the present invention. This embodiment can be applied to situations where an alarm is triggered based on the operating status of the monitored equipment. The device can be implemented by software and / or hardware and integrated into a computer device with application development capabilities.

[0079] like Figure 4 As shown, the monitoring and alarm device includes: a threshold comparison module 410, a similarity determination module 420, and a monitoring and alarm module 430.

[0080] The threshold comparison module 410 is used to acquire real-time operation monitoring data of the monitored device and compare the real-time operation monitoring data with a preset monitoring threshold, wherein the preset monitoring threshold is a monitoring threshold determined by the monitoring threshold determination method described in any embodiment; the similarity determination module 420 is used to calculate the data similarity between the real-time operation monitoring data and the operation monitoring data of the monitored device within a preset historical time period when the monitoring data of any operation indicator in the real-time operation monitoring data is greater than or equal to the corresponding preset monitoring threshold; the monitoring alarm module 430 is used to issue a threshold monitoring alarm when the data similarity is lower than a preset similarity threshold.

[0081] The technical solution of this embodiment determines a reasonable monitoring threshold based on the operating data of devices with similar hardware configurations. When any operating indicator monitoring data of the monitored device is greater than or equal to the corresponding operating indicator monitoring threshold, the similarity between the current operating indicator monitoring data and the operating indicator monitoring data of the monitored device within a preset historical time period is calculated. A threshold monitoring alarm is only issued when the similarity is lower than the preset similarity threshold. Based on setting a reasonable alarm threshold, the operating indicator data when the monitoring threshold is reached is further compared with the normal operating state of the device itself, establishing a dual judgment mechanism. This solves the problem of high false alarm rates caused by unreasonable monitoring threshold settings, improves the accuracy of device monitoring alarms, achieves effective device monitoring, and enhances the user experience.

[0082] Optionally, the similarity determination module 420 is specifically used for:

[0083] Randomly select a preset number of operational monitoring data of the monitored equipment within the preset historical time period;

[0084] Calculate the cosine similarity between the real-time operation monitoring data and the operation monitoring data of the monitored equipment within each of the selected preset number of preset historical time periods;

[0085] The mean of the calculated cosine similarities is used as the data similarity.

[0086] The monitoring and alarm device provided in the embodiments of the present invention can execute the monitoring and alarm method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0087] Example 5

[0088] Figure 5 This is a schematic diagram of the structure of a computer device provided in Embodiment 5 of the present invention. Figure 5 A block diagram of an exemplary computer device 12 suitable for implementing embodiments of the present invention is shown. Figure 5 The computer device 12 shown is merely an example and should not be construed as limiting the functionality or scope of the embodiments of the present invention. The computer device 12 can be any terminal device with computing capabilities, such as intelligent controllers and servers, mobile phones, and other terminal devices.

[0089] like Figure 5 As shown, the computer device 12 is represented in the form of a general-purpose computing device. The components of the computer device 12 may include, but are not limited to: one or more processors or processing units 16, system memory 28, and a bus 18 connecting different system components (including system memory 28 and processing unit 16).

[0090] Bus 18 represents one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the various bus architectures. For example, these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0091] Computer device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by computer device 12, including volatile and non-volatile media, removable and non-removable media.

[0092] System memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Computer device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be used to read and write non-removable, non-volatile magnetic media (…). Figure 5 Not shown; usually referred to as a "hard drive"). Although Figure 5 As not shown, disk drives for reading and writing to removable non-volatile disks (e.g., "floppy disks") and optical disc drives for reading and writing to removable non-volatile optical discs (e.g., CD-ROMs, DVD-ROMs, or other optical media) may be provided. In these cases, each drive may be connected to bus 18 via one or more data media interfaces. System memory 28 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of the present invention.

[0093] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28. Such program modules 42 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 42 typically perform the functions and / or methods described in the embodiments of the present invention.

[0094] Computer device 12 can also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, etc.), and with one or more devices that enable a user to interact with the computer device 12, and / or with any device that enables the computer device 12 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed via input / output (I / O) interface 22. Furthermore, computer device 12 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 20. As shown, network adapter 20 communicates with other modules of computer device 12 via bus 18. It should be understood that, although... Figure 5 As not shown, it can be used in conjunction with computer device 12 with other hardware and / or software modules, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0095] Processing unit 16 executes various functional applications and data processing by running programs stored in system memory 28, such as implementing the monitoring threshold determination method provided in this embodiment, which includes:

[0096] Acquire historical operational index data of devices with the same hardware configuration parameters as the devices whose monitoring thresholds are to be determined, when device failures occur.

[0097] Based on a preset proportion of historical operational indicator data in the historical operational indicator data and the hardware configuration parameters, an operational indicator data vector group is established.

[0098] Calculate the similarity between historical operating indicator data (excluding the preset proportion of historical operating indicator data) and the operating indicator data in the operating indicator data vector group, and determine the monitoring threshold of the operating indicator of the device to be monitored based on the similarity calculation result.

[0099] Alternatively, the monitoring and alarm method provided in this embodiment can be implemented, the method comprising:

[0100] Acquire real-time operation monitoring data of the monitored device, and compare the real-time operation monitoring data with a preset monitoring threshold, wherein the preset monitoring threshold is a monitoring threshold determined by the monitoring threshold determination method described in any embodiment;

[0101] When the monitoring data of any operation indicator in the real-time operation monitoring data is greater than or equal to the corresponding preset monitoring threshold, the data similarity between the real-time operation monitoring data and the operation monitoring data of the monitored equipment within a preset historical time period is calculated.

[0102] When the data similarity is lower than a preset similarity threshold, a threshold monitoring alarm is issued.

[0103] Example 6

[0104] This sixth embodiment provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the program implements the monitoring threshold determination method as provided in any embodiment of the present invention. The method includes:

[0105] Acquire historical operational index data of devices with the same hardware configuration parameters as the devices whose monitoring thresholds are to be determined, when device failures occur.

[0106] Based on a preset proportion of historical operational indicator data in the historical operational indicator data and the hardware configuration parameters, an operational indicator data vector group is established.

[0107] Calculate the similarity between historical operating indicator data (excluding the preset proportion of historical operating indicator data) and the operating indicator data in the operating indicator data vector group, and determine the monitoring threshold of the operating indicator of the device to be monitored based on the similarity calculation result.

[0108] Alternatively, the monitoring and alarm method provided in this embodiment can be implemented, the method comprising:

[0109] Acquire real-time operation monitoring data of the monitored device, and compare the real-time operation monitoring data with a preset monitoring threshold, wherein the preset monitoring threshold is a monitoring threshold determined by the monitoring threshold determination method described in any embodiment;

[0110] When the monitoring data of any operation indicator in the real-time operation monitoring data is greater than or equal to the corresponding preset monitoring threshold, the data similarity between the real-time operation monitoring data and the operation monitoring data of the monitored equipment within a preset historical time period is calculated.

[0111] When the data similarity is lower than a preset similarity threshold, a threshold monitoring alarm is issued.

[0112] The computer storage medium of this invention can be any combination of one or more computer-readable media. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0113] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0114] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0115] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0116] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computing device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0117] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.

Claims

1. A method of monitoring threshold determination, characterized by, The method includes: Acquire historical operational index data of devices with the same hardware configuration parameters as the devices whose monitoring thresholds are to be determined, when device failures occur. Based on a preset proportion of historical operational indicator data in the historical operational indicator data and the hardware configuration parameters, an operational indicator data vector group is established. Each set of historical operating indicator data, excluding the preset proportion of historical operating indicator data, is arranged into a monitoring data row vector according to the preset operating indicator distribution order. For each monitoring data row vector, the similarity between the monitoring data row vector and each column vector of the operation indicator data vector group is calculated to obtain a similarity vector. The monitoring threshold is determined based on the similarity calculation result; the similarity vector is the similarity calculation result.

2. The method according to claim 1, characterized in that, The step of establishing an operation indicator data vector group based on a preset proportion of historical operation indicator data and the hardware configuration parameters includes: Based on the hardware configuration parameters, the preset upper limit and preset lower limit values ​​of each operating indicator are determined, and the maximum value row vector and the minimum value row vector are formed respectively according to the preset operating indicator distribution order. The values ​​of each operating indicator in the historical operating indicator data of the preset ratio are arranged in an increasing or decreasing manner to form an increasing row vector or a decreasing row vector of each operating indicator data. The increasing or decreasing row vectors are arranged according to the preset distribution order of the operating indicators, and the arrangement result, together with the transpose of the maximum value row vector and the transpose of the minimum value row vector, forms the operating indicator data vector group.

3. The method according to claim 2, characterized in that, The process of determining the monitoring thresholds for the operating indicators of the device to be determined based on similarity calculation results includes: The average value of the column vector values ​​in the operational indicator data vector group corresponding to the element with the highest similarity value in each similarity vector is calculated, and the calculation result is used as the monitoring threshold of the operational indicator of the device to be determined.

4. The method according to claim 3, characterized in that, The step of calculating the similarity between the row vector of the monitoring data and each column vector of the operational indicator data vector group to obtain a similarity vector includes: Calculate the cosine similarity between the row vector of the monitoring data and each column vector of the operational indicator data vector group to obtain a similarity vector.

5. A monitoring and alarm method, characterized in that, The method includes: Acquire real-time operation monitoring data of the monitored device, and compare the real-time operation monitoring data with a preset monitoring threshold, wherein the preset monitoring threshold is a monitoring threshold determined by any of the monitoring threshold determination methods described in claims 1-4; When the monitoring data of any operation indicator in the real-time operation monitoring data is greater than or equal to the corresponding preset monitoring threshold, the data similarity between the real-time operation monitoring data and the operation monitoring data of the monitored equipment within a preset historical time period is calculated. When the data similarity is lower than a preset similarity threshold, a threshold monitoring alarm is issued.

6. The method according to claim 5, characterized in that, The calculation of the data similarity between the real-time operation monitoring data and the operation monitoring data of the monitored equipment within a preset historical time period includes: Randomly select a preset number of operational monitoring data of the monitored equipment within the preset historical time period; Calculate the cosine similarity between the real-time operation monitoring data and the operation monitoring data of the monitored equipment within each of the selected preset number of preset historical time periods; The mean of the calculated cosine similarities is used as the data similarity.

7. A monitoring threshold determination device, characterized in that, The device includes: The historical monitoring data acquisition module is used to acquire historical operating index data of devices with the same hardware configuration parameters as the devices whose monitoring thresholds are to be determined when a device failure occurs. The operation indicator data vector construction module is used to establish an operation indicator data vector group based on a preset proportion of historical operation indicator data in the historical operation indicator data and the hardware configuration parameters; The monitoring threshold determination module is used to form monitoring data row vectors for each group of historical operating indicator data (excluding the preset proportion of historical operating indicator data) according to the preset operating indicator distribution order; for each monitoring data row vector, the similarity of the monitoring data row vector with each column vector of the operating indicator data vector group is calculated to obtain a similarity vector; based on the similarity calculation result, the monitoring threshold of the operating indicator of the device to be determined is determined; the similarity vector is the similarity calculation result.

8. A monitoring and alarm device, characterized in that, The device includes: The threshold comparison module is used to acquire real-time operation monitoring data of the monitored device and compare the real-time operation monitoring data with a preset monitoring threshold, wherein the preset monitoring threshold is a monitoring threshold determined by any of the monitoring threshold determination methods described in claims 1-4. The similarity determination module is used to calculate the data similarity between the real-time operation monitoring data and the operation monitoring data of the monitored equipment within a preset historical time period when the monitoring data of any operation indicator in the real-time operation monitoring data is greater than or equal to the corresponding preset monitoring threshold. The monitoring and alarm module is used to issue a threshold monitoring alarm when the data similarity is lower than a preset similarity threshold.

9. A computer device, characterized in that, The computer device includes: One or more processors; Memory, used to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the monitoring threshold determination method or monitoring alarm method as described in any one of claims 1-6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the monitoring threshold determination method or monitoring alarm method as described in any one of claims 1-6.

Images