Anomaly detection method, device, equipment, medium and program product

Abstract

The present disclosure provides a method, apparatus, device, medium and program product for detecting anomalies of a master node. The method includes: sending an anomaly detection command to a first slave node; detecting an anomaly of the first slave node according to a return result of the first slave node, wherein the first slave node is used to execute the received anomaly detection command and return a command execution result to the master node; wherein, detecting an anomaly of the first slave node according to the return result of the first slave node includes: determining that the first slave node is abnormal if the command execution result is not received; and detecting an anomaly of the first slave node according to a parsing result of the command execution result if the command execution result is received. The present disclosure also provides a method, apparatus, device, medium and program product for detecting anomalies of a first slave node.

Description

Technical Field

[0001] The present disclosure relates to the field of anomaly detection or the field of financial technology, and more specifically, to an anomaly detection method, device, equipment, medium and program product. Background Art

[0002] As the business increases, the reliability and high availability of the business system can be improved through the multi-point multi-active approach. A large number of machines and equipment will be operated in the multi-point multi-active approach. In order to improve the efficiency of machine operation and maintenance, all machines and equipment are usually managed in the master-slave node approach. For example, one device is designated as the master node, and several devices are designated as several slave nodes. Through the communication connection between the master node and the slave node, the master node can manage the slave node, and the slave node can execute the command issued by the master node.

[0003] The slave node can actively report its status to the master node at regular intervals so that the master node can manage the status of the slave node. If the master node does not receive status information from a slave node for a certain period of time, it will consider the slave node abnormal and will no longer send commands to it.

[0004] In the process of implementing the concept of the embodiments of the present disclosure, the inventors discovered the following problems in the related technology: the current master node can only passively detect the abnormality of the slave node. If an abnormality occurs in the slave node during the interval of reporting status information, the master node cannot detect it and may still send the command to the abnormal slave node, resulting in the command not being processed in time. Summary of the invention

[0005] In view of the above problems, the present disclosure provides an anomaly detection method, apparatus, device, medium and program product by which a master node can actively detect anomalies of slave nodes.

[0006] One aspect of an embodiment of the present disclosure provides an abnormality detection method for a master node, wherein the master node is communicatively connected to N slave nodes, comprising: sending an abnormality detection command to a first slave node, wherein the first slave node is any one of the N slave nodes, and N is an integer greater than or equal to 1; detecting the abnormality of the first slave node according to a return result of the first slave node, wherein the first slave node is used to execute the received abnormality detection command and return the command execution result to the master node; wherein detecting the abnormality of the first slave node according to the return result of the first slave node comprises: determining that the first slave node is abnormal when the command execution result is not received; and detecting the abnormality of the first slave node according to a parsing result of the command execution result when the command execution result is received.

[0007] According to an embodiment of the present disclosure, the master node sends the abnormality detection command through the first communication channel, and before sending the abnormality detection command to the first slave node, it also includes: selecting M first slave nodes from the N slave nodes for detection; wherein, the method also includes: in the case where the command execution results returned by the S first slave nodes are not received, determining that the first communication channel is abnormal, wherein S is a preset threshold, S and M are integers greater than or equal to 1 respectively, and S is less than or equal to M.

[0008] According to an embodiment of the present disclosure, selecting M of the first slave nodes from the N slave nodes for abnormality detection includes: setting the initial value of i to 1, where i is an integer greater than or equal to 1 and i is less than or equal to M, and looping the following operations: sending the abnormality detection command to the i-th first slave node; in the case where the command execution result returned by the i-th first slave node is not received, writing the information of the i-th first slave node into an abnormal list and increasing the value of i by 1; or in the case where the command execution result returned by the i-th first slave node is received, parsing to obtain the execution identifier of the command execution result, if the execution identifier is a normal identifier, writing the information of the i-th first slave node into the normal list and increasing the value of i by 1; if the execution identifier is an abnormal identifier, writing the information of the i-th first slave node into the abnormal list and increasing the value of i by 1.

[0009] According to an embodiment of the present disclosure, the master node includes a Master process, the first slave node includes an Agent process, and the sending of an exception detection command to the first slave node includes: sending the exception detection command to the Agent process through the Master process, wherein the Agent process is used to execute the received exception detection command and return the command execution result to the master node.

[0010] According to an embodiment of the present disclosure, the Master process sends the exception detection command through a first communication channel. When it is determined that the Agent process is abnormal, the method further includes: sending an exception handling command to the first slave node through a second communication channel, wherein the first slave node is used to execute the exception handling command to handle the exception of the Agent process, and the second communication channel is different from the first communication channel.

[0011] According to an embodiment of the present disclosure, after sending the exception handling command to the first slave node through the second communication channel, re-detecting the first slave node for exceptions, and in the case where it is determined that the first slave node is abnormal, the method further includes: sending a process restart command to the first slave node through the second communication channel, wherein the first slave node is used to execute the process restart command to restart the Agent process.

[0012] Another aspect of an embodiment of the present disclosure provides an abnormality detection method for a first slave node, wherein the first slave node is any one of N slave nodes, and the N slave nodes are communicatively connected to a corresponding master node, where N is an integer greater than or equal to 1, and the method comprises: receiving an abnormality detection command sent by the master node; upon receiving the abnormality detection command, executing the abnormality detection command; returning a command execution result of executing the abnormality detection command to the master node; wherein the master node is configured to: determine that the first slave node is abnormal if the command execution result is not received; and detect the abnormality of the first slave node based on a parsing result of the command execution result if the command execution result is received.

[0013] According to an embodiment of the present disclosure, the master node includes a Master process, the first slave node includes an Agent process, and when the exception detection command is received, executing the exception detection command includes: when the exception detection command sent by the Master process is received, executing the exception detection command through the Agent process.

[0014] According to an embodiment of the present disclosure, the Master process sends the exception detection command through a first communication channel, and the method further includes: receiving an exception handling command sent by the master node through a second communication channel, wherein the second communication channel is different from the first communication channel; and executing the exception handling command to handle the exception of the Agent process.

[0015] According to an embodiment of the present disclosure, the method further includes: receiving a process restart command sent by the master node through the second communication channel; and executing the process restart command to restart the Agent process.

[0016] Another aspect of an embodiment of the present disclosure provides an abnormality detection device, which is used for a master node, and the master node is communicatively connected to N slave nodes, including: a first sending module, which is used to send an abnormality detection command to a first slave node, wherein the first slave node is any one of the N slave nodes, and N is an integer greater than or equal to 1; an abnormality detection module, which is used to detect the abnormality of the first slave node according to the return result of the first slave node, wherein the first slave node is used to execute the received abnormality detection command and return the command execution result to the master node; wherein the abnormality detection module is used to detect the abnormality of the first slave node according to the return result of the first slave node, including: if the command execution result is not received, determining that the first slave node is abnormal; if the command execution result is received, detecting the abnormality of the first slave node according to the parsing result of the command execution result.

[0017] Another aspect of an embodiment of the present disclosure provides an abnormality detection device for a first slave node, wherein the first slave node is any one of N slave nodes, and the N slave nodes are communicatively connected to a corresponding master node, where N is an integer greater than or equal to 1, and the device includes: a command receiving module, for receiving an abnormality detection command sent by the master node; a command execution module, for executing the abnormality detection command when the abnormality detection command is received; a second sending module, for returning a command execution result of executing the abnormality detection command to the master node; wherein the master node is configured to include an abnormality detection module, and the abnormality detection module is used to: determine that the first slave node is abnormal when the command execution result is not received; and detect the abnormality of the first slave node based on the parsing result of the command execution result when the command execution result is received.

[0018] Another aspect of an embodiment of the present disclosure provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the method as described above.

[0019] Another aspect of the embodiments of the present disclosure further provides a computer-readable storage medium having executable commands stored thereon, which, when executed by a processor, causes the processor to execute the method as described above.

[0020] Another aspect of the embodiments of the present disclosure further provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0021] One or more of the above-mentioned embodiments have the following beneficial effects: compared with the method in the prior art in which the master node passively receives the slave node's own status report, the disclosed embodiment can enable the master node to actively perform anomaly detection by sending an anomaly detection command to the first slave node, and performing anomaly detection according to the return result of the first slave node. It is no longer limited to determining the anomaly of the first slave node only when no information reported by the first slave node is received after a certain period of time. The flexibility and timeliness of anomaly detection can be improved, and the faults of the slave nodes can be quickly discovered and handled in a timely manner, thereby effectively improving the efficiency of anomaly handling. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0023] Figure 1 The application scenario diagram of the anomaly detection method according to the embodiment of the present disclosure is schematically shown;

[0024] Figure 2 The flowchart of the abnormality detection method for the master node according to the embodiment of the present disclosure is schematically shown;

[0025] Figure 3 A flowchart of performing abnormality detection on M first slave nodes according to an embodiment of the present disclosure is schematically shown;

[0026] Figure 4 A flowchart of an abnormality detection method for a first slave node according to an embodiment of the present disclosure is schematically shown;

[0027] Figure 5 The flowchart of processing an exception of an Agent process according to an embodiment of the present disclosure is schematically shown;

[0028] Figure 6 The flowchart of restarting the Agent process according to an embodiment of the present disclosure is schematically shown;

[0029] Figure 7 A schematic diagram of an application scenario of an anomaly detection method according to another embodiment of the present disclosure is shown;

[0030] Figure 8 A flowchart of an abnormality detection method according to another embodiment of the present disclosure is schematically shown;

[0031] Fig. 9 The structure block diagram of the abnormality detection device for the master node according to the embodiment of the present disclosure is schematically shown;

[0032] Fig.10 The structure block diagram of the abnormality detection device for the first slave node according to the embodiment of the present disclosure is schematically shown;

[0033] Fig.11 A block diagram of an electronic device suitable for implementing an abnormality detection method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0034] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0035] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0036] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0037] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0038] Taking banks or other financial institutions as an example, the characteristics of financial services determine the need for higher security, reliability, and efficiency. In order to ensure the reliability of business system functions and data security, IT data centers are usually deployed in multiple locations (i.e., multiple points and multiple active), that is, data centers are established in multiple cities, each data center will deploy machinery and equipment, and set up master nodes and slave nodes to ensure system reliability and data security.

[0039] Due to the large size of financial institutions such as banks and the large number of business system applications, the number of machines and equipment operated and maintained in their IT data centers is huge. In the process of daily operation and maintenance, machine abnormalities may occur due to various reasons. When the master node passively waits for the slave node to report information, if the preset time is not exceeded, the slave node will be abnormal. At this time, the master node sends a command to the abnormal slave node, and the command cannot be executed smoothly, which will cause the operation and maintenance work to be unable to proceed. It is necessary to wait for manual disposal to restore the abnormality, which greatly reduces the efficiency of daily operation and maintenance and increases labor costs.

[0040] An embodiment of the present disclosure provides an abnormality detection method for a master node, wherein the master node is communicatively connected to N slave nodes. The method comprises: sending an abnormality detection command to a first slave node, wherein the first slave node is any one of the N slave nodes, and N is an integer greater than or equal to 1. According to the return result of the first slave node, the abnormality of the first slave node is detected, wherein the first slave node is used to execute the received abnormality detection command and return the command execution result to the master node.

[0041] Detecting the abnormality of the first slave node according to the return result of the first slave node includes: determining that the first slave node is abnormal when no command execution result is received, or detecting the abnormality of the first slave node according to the analysis result of the command execution result when the command execution result is received.

[0042] Compared with the prior art method in which the master node passively receives status reports from the slave node, the disclosed embodiment can enable the master node to actively perform anomaly detection by sending an anomaly detection command to the first slave node and performing anomaly detection according to the return result of the first slave node. It is no longer limited to determining the anomaly of the first slave node only when no information reported by the first slave node is received after a certain period of time. The flexibility and timeliness of anomaly detection can be improved, and faults of slave nodes can be quickly discovered and handled in a timely manner, effectively improving the efficiency of handling anomalies of machine equipment under multi-point and multi-active conditions.

[0043] Figure 1 The application scenario diagram of the anomaly detection method according to an embodiment of the present disclosure is schematically shown.

[0044] like Figure 1As shown, the application scenario 100 of this embodiment may include terminal devices 111, 112, 113, a network 120, an A master node server 130, and a B master node server 140. Among them, the A master node server 130 is communicatively connected to one or more slave node servers, such as an A1 slave node server 131, an A2 slave node server 132, and an A3 slave node server 133. The B master node server 140 is also communicatively connected to one or more slave node servers, such as a B1 slave node server 141, a B2 slave node server 142, and a B3 slave node server 143. The network 120 is used to provide a medium for a communication link between the terminal devices 111, 112, 113 and the A master node server 130, or the B master node server 140. The network 120 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc. The network 120 may be set between the A master node server 130 and the slave node server, and between the B master node server 130 and the slave node server to achieve a communication connection ( Figure 1 not shown).

[0045] The user can use the terminal devices 111, 112, 113 to interact with the A master node server 130 or the B master node server 140 through the network 120 to receive or send messages, etc. Various communication client applications can be installed on the terminal devices 111, 112, 113, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0046] The terminal devices 111 , 112 , and 113 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0047] Figure 1 Any of the servers may be servers that provide various services, such as a background management server (only an example) that provides support for websites browsed by users using terminal devices 111, 112, and 113. The background management server may analyze and process received data such as user requests, and feed back processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0048] It should be understood that Figure 1 The number of terminal devices, networks, master node servers and slave node servers in the embodiment is only for illustration. According to the implementation requirements, there may be any number of terminal devices, networks, master node servers and slave node servers.

[0049] The following will be based on Figure 1 The application scenario described by Figure 2 to Figure 8The anomaly detection method of the embodiment of the present disclosure is described in detail.

[0050] Figure 2 A flowchart of an abnormality detection method for a master node according to an embodiment of the present disclosure is schematically shown.

[0051] like Figure 2 As shown, the abnormality detection method of this embodiment includes operations S210 to S240.

[0052] In operation S210, an abnormality detection command is sent to a first slave node, wherein the first slave node is any slave node among N slave nodes, and N is an integer greater than or equal to 1. The first slave node is used to execute the received abnormality detection command and return the command execution result to the master node.

[0053] The anomaly detection command may be a command specifically used to detect anomalies, or may be a general command, as long as the slave node can execute it.

[0054] Reference Figure 1 When the master node is the A master node server 130 , the first slave node can be any one of the A1 slave node server 131 , the A2 slave node server 132 , and the A3 slave node server 133 .

[0055] According to the return result of the first slave node, the abnormality of the first slave node is detected, and the details may refer to operations S220 to S240.

[0056] In operation S220, it is determined whether the command execution result is received. If not, operation S230 is performed. If yes, operation S240 is performed.

[0057] The returned result may include whether the command execution result returned by the first slave node is received, and whether the received command execution result can indicate that the slave node is in an abnormal state.

[0058] In operation S230 , in a case where the command execution result is not received, it is determined that the first slave node is abnormal.

[0059] In operation S240, when the command execution result is received, an abnormality of the first slave node is detected according to a parsing result of the command execution result.

[0060] According to the embodiments of the present disclosure, the master node can be made to actively perform anomaly detection by sending an anomaly detection command to the first slave node, and performing anomaly detection based on the return result of the first slave node. It is no longer limited to determining the anomaly of the first slave node only when no information reported by the first slave node is received after a certain period of time. The flexibility and timeliness of anomaly detection can be improved, and faults of slave nodes can be quickly discovered and handled in a timely manner, effectively improving the efficiency of handling anomalies of machine equipment under multi-point and multi-active conditions.

[0061] According to an embodiment of the present disclosure, the master node sends an abnormality detection command through the first communication channel, and before executing operation S210 to send the abnormality detection command to the first slave node, M first slave nodes may be selected from the N slave nodes for abnormality detection. The abnormality detection method of this embodiment also includes, in the case where the command execution results returned by the S first slave nodes are not received, determining that the first communication channel is abnormal, wherein S is a preset threshold, S and M are integers greater than or equal to 1, respectively, and S is less than or equal to M.

[0062] The first communication channel may be in the form of a message middleware, for example, providing a message queue service through MQ (Message Queue) message middleware, Kafka or Redis database.

[0063] Taking the multi-active deployment in different locations of an IT data center as an example, M first slave nodes can be selected based on dimensions such as device serial number, deployment unit, and application system. Figure 1 Among them, A1 slave node server 131 and A2 slave node server 132 are used to provide support for the savings application system, and A3 slave node server 133 is used to provide support for the loan application system (only as an example). At this time, the savings application system can be used as the detection unit, and A1 slave node server 131 and A2 slave node server 132 can be selected for detection.

[0064] After issuing the anomaly detection command, the master node sends the command to the message middleware. The message middleware can encapsulate the command as a message in the message queue. Finally, the first slave node obtains the message corresponding to the command and executes the command. If the message middleware fails, the anomaly detection command may not reach the first slave node, and the master node will naturally not receive the command execution result returned by the first slave node.

[0065] Reference Figure 1 , each slave node is an independent server. If each slave node is the minimum detection unit, the probability of a large-scale abnormality is small. If the message middleware is abnormal, a large range of slave nodes will not return command execution results, which will be considered abnormal. Therefore, when the number of the first slave nodes with abnormalities is greater than or equal to the preset threshold S (such as 60% of M), it can be determined that the message middleware is in an abnormal state.

[0066] In the related art, the master node can only detect whether the slave node is in an abnormal state by the active reporting time of the slave node, but cannot sense whether the message channel between the master node and the slave node is abnormal. According to the embodiments of the present disclosure, when detecting the abnormality of the slave node, the abnormality of the message channel can be actively sensed, and relevant personnel can be notified in time for processing.

[0067] Figure 3 The flowchart of performing abnormality detection on M first slave nodes according to an embodiment of the present disclosure is schematically shown.

[0068] like Figure 3 As shown, in this embodiment, selecting M first slave nodes from N slave nodes for abnormality detection may include operations S310 to S370.

[0069] Let the initial value of i be 1, where i is an integer greater than or equal to 1 and i is less than or equal to M, and loop through operations S310 to S370 until all M first slave nodes are traversed.

[0070] In operation S310 , an abnormality detection command is sent to an i-th first slave node.

[0071] In operation S320, it is determined whether the command execution result returned by the i-th first slave node is received. If yes, operation S330 is executed. If no, operation S360 is executed.

[0072] In operation S330, when the command execution result returned by the i-th first slave node is received, the execution identifier of the command execution result is obtained by parsing.

[0073] The command execution result may include an execution status code, such as a status code of "0" or "success" for successful execution, a status code of "1" or "failure" for failed execution, and a status code of "2" or "other" for other problems (for example only). Execution failure may mean that the command was executed but not successfully, and other problems may mean that the command was not started, such as the command content is missing, the slave node device does not meet the execution conditions, and insufficient execution data is not obtained.

[0074] In operation S340, it is determined whether the execution flag is an abnormal flag. If so, operation S350 is performed. If not, operation S360 is performed.

[0075] If the status code indicates successful execution, it is not considered an exception. If the status code indicates failure or other problems, it can be considered an exception.

[0076] In operation S350, if the execution flag is a normal flag, the information of the i-th first slave node is written into the normal list.

[0077] The information of the first slave node may include at least one of the following information: a slave node device serial number, a slave node device name, a data center name, a deployment unit, an application system, and the like.

[0078] In operation S360, if the execution flag is an abnormal flag, the information of the i-th first slave node is written into the abnormal list.

[0079] If the number of first slave nodes in the abnormal list is greater than or equal to S, it can be determined that the first communication channel is abnormal, and the current cycle ends.

[0080] In operation S370, it is determined whether i is less than M. If so, the value of i is incremented by 1 and operation S310 is executed. If not, this loop is terminated.

[0081] According to the embodiments of the present disclosure, abnormal or normal slave nodes are recorded in the form of a list, which can facilitate the overall management of the machine equipment running in a multi-point multi-active mode by relevant personnel. In addition, when processing user requests, the master node can use the slave nodes in the normal list as a basis to send commands to the slave nodes for execution, thereby improving processing efficiency and avoiding the situation where the user request cannot be processed in time due to the abnormal slave node being sent to the slave node.

[0082] According to an embodiment of the present disclosure, the master node includes a Master process, the first slave node includes an Agent process, and sending an exception detection command to the first slave node includes: sending an exception detection command to the Agent process through the Master process, wherein the Agent process is used to execute the received exception detection command and return the command execution result to the master node.

[0083] Reference Figure 1 In order to improve the efficiency of daily machine operation and maintenance, data centers can use automated operation and maintenance tools (such as puppet, ansible, etc.) to manage all machines and equipment. Automated operation and maintenance tools can be implemented based on the Master / Agent architecture mode. A Master process is started on the A1 master node server and the B1 master node server respectively, and an Agent process is started on each slave node machine. The Master process sends commands to the Agent process, and the Agent process executes the received commands on the slave node server device. When sending commands between the Master process and the Agent process, the command is encapsulated into a message, and the message middleware is used to pass the message to the Agent process.

[0084] In the related art, in the Master / Agent architecture mode, the Agent process actively reports the status of the Agent process to the Master process, and the Master process manages the status information of the Agent process. If the Master does not receive the status information of the Agent process for a certain period of time, it will consider that the Agent process is offline and will not actively start the Agent process.

[0085] According to the embodiments of the present disclosure, the abnormality of the Agent process can be actively detected when the Agent process stops unexpectedly or is suspended. The abnormality of the Agent process can no longer be determined only when no information reported by the Agent process is received after a certain period of time, thereby improving the flexibility and timeliness of abnormality detection.

[0086] According to an embodiment of the present disclosure, the Master process sends an exception detection command through a first communication channel. When it is determined that the Agent process is abnormal, it also includes: sending an exception handling command to the first slave node through a second communication channel, wherein the first slave node is used to execute the exception handling command to handle the exception of the Agent process, and the second communication channel is different from the first communication channel.

[0087] The second communication channel can be a channel such as an ssh channel, a pssh channel, a telnet channel, etc., or a message middleware independent of the first communication channel. The difference between the first communication channel and the second communication channel means that the two are independent communication channels. The function of the first communication channel is to realize the communication between the Master process and the Agent process. If an exception occurs in the Agent process, it may not be determined whether it is the Agent process itself that is abnormal, the slave node device that is abnormal, or the first communication channel that is abnormal, so the second communication channel is used to realize the transmission of the exception handling command.

[0088] Taking the ssh channel as an example, you can execute the ssh command on the Master machine to remotely log in to the slave node device, and execute exception handling commands on the slave node device, such as executing the ntpdate command for synchronizing the system time of the operating system, updating the current time of the slave node device, and refreshing the time configuration information of the Agent process.

[0089] According to the embodiments of the present disclosure, when the Agent process is confirmed to be abnormal, the Agent process can be automatically handled for abnormality, meeting the needs of large data centers for rapid discovery and automatic handling of server process failures. In addition, considering the possibility of abnormality in the first communication channel, an abnormality handling command is sent through the second communication channel.

[0090] According to an embodiment of the present disclosure, after sending an exception handling command to the first slave node through the second communication channel, re-detecting anomalies on the first slave node, and when it is determined that the first slave node is abnormal, the method also includes: sending a process restart command to the first slave node through the second communication channel, wherein the first slave node is used to execute the process restart command to restart the Agent process.

[0091] The exception handling command may include one or more. After each exception handling command is sent to the first slave node and the first slave node executes it, operations S210 to S240 may be performed to re-detect the first slave node for exceptions. If the first slave node is still abnormal after all exception handling commands are sent, for example, the ssh command may be executed on the Master device to log in to the slave node device and the command systemctl restart mcollective may be executed to restart the Agent process.

[0092] According to the embodiments of the present disclosure, restarting the process may have a certain impact on the business, so first, by sending one or more exception handling commands, the exception handling of the Agent process is implemented. If the Agent process is still abnormal after sending one or more exception handling commands, in order to improve the processing efficiency, the Agent process can be restarted so that it can provide services normally after restarting.

[0093] Figure 4 The flowchart of the abnormality detection method for the first slave node according to the embodiment of the present disclosure is schematically shown.

[0094] like Figure 4 As shown, the abnormality detection method of this embodiment is used for the first slave node, the first slave node is any one of N slave nodes, the N slave nodes are communicated and connected to the corresponding master node, N is an integer greater than or equal to 1, and the method may include operations S410 to S430.

[0095] In operation S410, an abnormality detection command sent by a master node is received.

[0096] In operation S420, in case the abnormality detection command is received, the abnormality detection command is executed.

[0097] In operation S430, a command execution result of executing the abnormality detection command is returned to the master node.

[0098] The master node is configured to: determine that the first slave node is abnormal when the command execution result is not received, or detect the abnormality of the first slave node according to the analysis result of the command execution result when the command execution result is received.

[0099] The master node may not receive the command execution result because the slave node does not receive the command. It may also be that after executing operation S430, the execution result returned by the slave node does not reach the master node.

[0100] According to an embodiment of the present disclosure, the master node includes a Master process, the first slave node includes an Agent process, and when an abnormality detection command is received, executing the abnormality detection command includes: when an abnormality detection command sent by the Master process is received, executing the abnormality detection command through the Agent process.

[0101] Reference Figure 1 Taking A1 slave node server 131 as an example, after the Agent process on the server receives the abnormality detection command sent by the Master process in A master node server 130, the Agent process can execute the command.

[0102] Figure 5 The flowchart of processing an exception of an Agent process according to an embodiment of the present disclosure is schematically shown.

[0103] like Figure 5 As shown, when the Agent process is abnormal, the abnormality detection method of this embodiment may further include operations S510 to S520 on the basis of including operations S410 to S430. The Master process sends an abnormality detection command through the first communication channel.

[0104] In operation S510, an exception handling command sent by a master node through a second communication channel is received, wherein the second communication channel is different from the first communication channel.

[0105] In operation S520, an exception handling command is executed to handle the exception of the Agent process.

[0106] Reference Figure 1 , taking the A1 slave node server 131 as an example, the Agent process and the Master process may have inconsistent time, which may cause the Agent process to be unable to execute commands. Specifically, after receiving the detection command, the Agent process can verify the creation time and the time interval of the corresponding message. Messages with too long intervals will be discarded by the Agent. The A1 slave node server 131 can receive the exception handling command for synchronizing time sent by the A master node server 130 through the ssh channel, and execute the command to handle the exception caused by the inconsistency between the Agent process and the Master process.

[0107] Figure 6 The flowchart of restarting the Agent process according to an embodiment of the present disclosure is schematically shown.

[0108] like Figure 6 As shown, restarting the Agent process in this embodiment may include operations S610 to S620.

[0109] In operation S610, a process restart command sent by the master node through the second communication channel is received.

[0110] In operation S620, a process restart command is executed to restart the Agent process.

[0111] Reference Figure 1 , the A1 slave node server 131 can receive a command to restart the Agent process sent by the A master node server 130 through the ssh channel to restart the Agent process on the device.

[0112] Figure 7 The following schematically shows an application scenario diagram of an anomaly detection method according to another embodiment of the present disclosure.

[0113] Reference Figure 1 and Figure 7 , device A and device B correspond to A master node server 130 and B master node server 140 respectively. Correspondingly, device A1, device A2, and device A3 may correspond to A1 slave node server 131, A2 slave node server 132, and A3 slave node server 133 respectively. Device B1, device B2, and device B3 may correspond to B1 slave node server 141, B2 slave node server 142, and B3 slave node server 143 respectively.

[0114] The user can write an exception detection program through the terminal devices 111, 112, and 113. The exception detection program can generate scheduled detection tasks and automatic handling tasks, such as determining the slave node device for exception detection, sending an exception detection command, sending an exception handling command, and a process restart command. Device A, device A1, device A2, and device A3 can be devices in the data center of A, and the message queue A provided by the message middleware A is used as the first communication channel. Device B, device B1, device B2, and device B3 can be devices in the data center of B, and the message queue B provided by the message middleware B is used as the first communication channel.

[0115] In some embodiments, the Quartz open source framework can be used as a task scheduling framework to detect and handle the scheduling of tasks. The communication between the Master process and the Agent process is based on the ActiveMQ message middleware, and other task scheduling frameworks and message middleware can also be used. When the Agent process is abnormal or the communication between the Master and the Agent is abnormal and the message middleware cannot send messages directly, the disposal command is sent and executed through a third-party channel, such as ssh, pssh, telnet, etc. Further, combined with Figure 1 and Figure 7 ,pass Figure 8 An abnormality detection method according to another embodiment of the present disclosure is described.

[0116] Figure 8 A flowchart of an abnormality detection method according to another embodiment of the present disclosure is schematically shown.

[0117] like Figure 8 As shown, the abnormality detection method of this embodiment may include operations S801 to S814.

[0118] In operation S801 , a timed detection task and an automatic handling task are started.

[0119] For example, you can determine the automated detection cycle based on the number of devices, deployment units, and application systems in the data center, set the execution cycle of scheduled detection and disposal tasks, and start them on time.

[0120] In operation S802, information of a device to be detected is obtained.

[0121] The equipment information of the data center can be stored in a database, such as an Oracle database. Limitations can be set from dimensions such as equipment, deployment units, and application systems to determine which equipment needs to be tested. Specifically, the database can be queried according to the set limitations to obtain a list of equipment to be tested. When the detection and disposal tasks are executed, the equipment information is tested according to the obtained list of equipment to be tested.

[0122] In operation S803, abnormality detection commands are issued to the devices to be detected in batches.

[0123] For example, the devices in the list of devices to be detected can be divided into batches according to the location of the data center (only as an example), and the Master process sends anomaly detection commands to the Agent process in batches. The Agent process executes the commands on the slave node devices and returns the command execution results after the execution is completed. The execution results may include the execution status code of the command and the output result of the command.

[0124] In operation S804, detection commands are cyclically sent to the devices of the current batch, and command execution results are received.

[0125] In operation S805, it is determined whether the Agent process on the current slave node device is abnormal. If so, operation S806 is executed. If not, operation S807 is executed.

[0126] If the Master process can normally receive the execution result of the Agent process, then the detection command is normally executed by the Agent process on the slave node device and the result is successfully returned, indicating that the Agent process on the device can normally process the received command and the message channel between the Master process and the Agent process is also unobstructed. If the Master does not receive the execution result of the detection command within the specified time, it is considered that there is a problem in the execution process of the detection command, which may be a message channel problem or a problem of the Agent process itself that causes the command to fail to execute.

[0127] In operation S806, the detected current slave node device information is saved to an exception list.

[0128] In operation S807, the detected current slave node device information is saved to a normal list.

[0129] In operation S808, it is determined whether the number of devices in the abnormal list is greater than S, where S is a preset threshold. If yes, operation S809 is executed. If no, operation S810 is executed.

[0130] In operation S809, a message queue exception notification is sent.

[0131] If the number of devices in the abnormal list is greater than the threshold S set by the user, it is considered that there is an abnormality in the message channel of the data center corresponding to the abnormal device. An abnormal reminder can be sent to the user through the integrated mailbox or instant messaging technology to end the detection and disposal task.

[0132] In operation S810, it is determined whether automatic processing is performed. If so, operation S811 is performed. If not, operation S814 is performed.

[0133] The user can set whether to handle the Agent process of the current slave node device in the automatic handling task. If automatic handling is not performed, the detection result of the next device will be processed, otherwise the next step will be executed.

[0134] In some embodiments, the timing detection task and the automatic handling task can be processed in parallel, that is, after executing S806, the automatic handling task is executed at the same time, and operation S814 is executed at the same time to determine whether to perform abnormality detection on the next slave node device.

[0135] In operation S811, the Agent process configuration information in the current slave node device is refreshed through ssh, such as synchronization time information.

[0136] In operation S812, it is determined whether the Agent process in the current slave node device being processed is abnormal. Operations S804 and S805 can be re-executed. If yes, operation S813 is executed. If no, operation S807 is executed.

[0137] In operation S813, the Agent process in the current slave node device being processed is restarted through ssh.

[0138] In operation S814, it is determined whether the detection of the devices in the current batch is complete. If so, the cyclic detection of the devices in the batch is terminated. If not, operation S804 is executed to detect the next slave node device.

[0139] Based on the above anomaly detection method, the present disclosure also provides an anomaly detection device for a master node and an anomaly detection device for a first slave node. Fig. 9 and Fig.10 The device is described in detail.

[0140] Fig. 9 The structural block diagram of an abnormality detection device 900 for a master node according to an embodiment of the present disclosure is schematically shown.

[0141] like Fig. 9 As shown, the abnormality detection device 900 of this embodiment includes a first sending module 910 and an abnormality detection module 920. The master node is communicatively connected to N slave nodes.

[0142] The first sending module 910 may perform operation S210 to send an abnormality detection command to a first slave node, where the first slave node is any one of N slave nodes, and N is an integer greater than or equal to 1.

[0143] The abnormality detection module 920 may perform operations S220 to S240 to detect abnormalities of the first slave node according to the return result of the first slave node, wherein the first slave node is used to execute the received abnormality detection command and return the command execution result to the master node.

[0144] The abnormality detection module is used to detect the abnormality of the first slave node according to the return result of the first slave node, which may include executing operation S230 or operation S240, and determining that the first slave node is abnormal when the command execution result is not received. When the command execution result is received, the abnormality of the first slave node is detected according to the parsing result of the command execution result.

[0145] Fig.10 The structure block diagram of an abnormality detection device 1000 for a first slave node according to an embodiment of the present disclosure is schematically shown.

[0146] like Fig.10 As shown, the abnormality detection device 1000 of this embodiment includes a command receiving module 1010 , a command execution module 1020 and a second sending module 1030 .

[0147] The command receiving module 1010 may perform operation S410 to receive an abnormality detection command sent by the master node.

[0148] The command execution module 1020 may perform operation S420 for executing the abnormality detection command when the abnormality detection command is received.

[0149] The second sending module 1030 may perform operation S430 to return a command execution result of executing the abnormality detection command to the master node.

[0150] The master node is configured to include an abnormality detection module, which is used to: determine that the first slave node is abnormal when the command execution result is not received, and detect the abnormality of the first slave node according to the analysis result of the command execution result when the command execution result is received.

[0151] According to an embodiment of the present disclosure, any multiple modules in the abnormality detection device 900 or the abnormality detection device 1000 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module.

[0152] According to an embodiment of the present disclosure, at least one module in the anomaly detection device 900 or the anomaly detection device 1000 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or may be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one module in the anomaly detection device 900 or the anomaly detection device 1000 may be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function may be executed.

[0153] Fig.11 A block diagram of an electronic device suitable for implementing an abnormality detection method according to an embodiment of the present disclosure is schematically shown.

[0154] like Fig.11As shown, the electronic device 1100 according to an embodiment of the present disclosure includes a processor 1101, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1102 or a program loaded from a storage part 1108 to a random access memory (RAM) 1103. The processor 1101 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1101 may also include an onboard memory for caching purposes. The processor 1101 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0155] In RAM 1103, various programs and data required for the operation of electronic device 1100 are stored. Processor 1101, ROM 1102 and RAM 1103 are connected to each other through bus 1104. Processor 1101 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 1102 and / or RAM 1103. It should be noted that the program can also be stored in one or more memories other than ROM 1102 and RAM 1103. Processor 1101 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in one or more memories.

[0156] According to an embodiment of the present disclosure, the electronic device 1100 may further include an input / output (I / O) interface 1105, which is also connected to the bus 1104. The electronic device 1100 may further include one or more of the following components connected to the I / O interface 1105: an input portion 1106 including a keyboard, a mouse, etc. An output portion 1107 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc. A storage portion 1108 including a hard disk, etc. And a communication portion 1109 including a network interface card such as a LAN card, a modem, etc. The communication portion 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to the I / O interface 1105 as needed. A removable medium 1111, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1110 as needed, so that the computer program read therefrom is installed into the storage portion 1108 as needed.

[0157] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments. It may also exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0158] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1102 and / or RAM 1103 described above and / or one or more memories other than ROM 1102 and RAM 1103.

[0159] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the item recommendation method provided by the embodiment of the present disclosure.

[0160] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 1101. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0161] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 1109, and / or installed from a removable medium 1111. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0162] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1109, and / or installed from the removable medium 1111. When the computer program is executed by the processor 1101, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0163] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0164] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0165] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0166] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. An anomaly detection method is used for each master node server in different local data centers, each of which is connected to N slave node servers in communication. The method includes using a task scheduling framework to schedule detection tasks, specifically including: Each of the master node servers sends an abnormality detection command to a first slave node server, wherein the first slave node server is any one of the N slave node servers, and N is an integer greater than or equal to 1; Each of the master node servers detects an abnormality of the first slave node server according to a return result of the first slave node server, wherein the first slave node server is used to execute the received abnormality detection command and return the command execution result to the master node server; Wherein, detecting the abnormality of the first slave node server according to the return result of the first slave node server includes: In the case where the command execution result is not received, determining that the first slave node server is abnormal; When receiving the command execution result, parsing and obtaining the execution identifier of the command execution result to detect an abnormality of the first slave node server; The method further includes utilizing the task scheduling framework to be responsible for scheduling of processing tasks, specifically including: Each of the master node servers sends an exception handling command for synchronizing time to the first slave node server through a second communication channel, wherein the first slave node server is used to execute the exception handling command to handle the exception caused by the time inconsistency between the Agent process in the first slave node server and the Master process in the master node server, and the second communication channel is different from the first communication channel, and the first communication channel is used to send the exception detection command.

2. The method according to claim 1, wherein: Each of the master node servers sends the anomaly detection command through the first communication channel, Before sending the abnormality detection command to the first slave node server, the method further includes: Selecting M of the first slave node servers from the N slave node servers for detection; Wherein, the method further comprises: When the command execution results returned by the S first slave node servers are not received, the first communication channel is determined to be abnormal, where S is a preset threshold, S and M are integers greater than or equal to 1 respectively, and S is less than or equal to M.

3. The method according to claim 2, wherein: Selecting M of the first slave node servers from the N slave node servers to perform anomaly detection includes: Let the initial value of i be 1, where i is an integer greater than or equal to 1 and i is less than or equal to M, and loop to perform the following operations: Sending the abnormality detection command to the i-th first slave node server; In the case where the command execution result returned by the i-th first slave node server is not received, the information of the i-th first slave node server is written into the exception list, and the value of i is increased by 1; or In the case of receiving the command execution result returned by the i-th first slave node server, parsing and obtaining the execution identifier of the command execution result includes: If the execution flag is a normal flag, the information of the i-th first slave node server is written into the normal list, and the value of i is increased by 1; If the execution identifier is an exception identifier, the information of the i-th first slave node server is written into the exception list, and the value of i is increased by 1.

4. The method according to claim 1, wherein: Each of the master node servers includes a Master process, and the first slave node server includes an Agent process, and sending an abnormality detection command to the first slave node server includes: The abnormality detection command is sent to the Agent process through the Master process, wherein the Agent process is used to execute the received abnormality detection command and return the command execution result to the master node server.

5. The method according to claim 4, wherein: The Master process sends the abnormality detection command through the first communication channel, and when it is determined that the Agent process is abnormal, each of the master node servers sends an abnormality handling command for synchronizing time to the first slave node server through the second communication channel, including: The Master process sends an exception handling command for synchronizing time to the first slave node server through the second communication channel, wherein the first slave node server is used to execute the exception handling command to handle the exception of the Agent process.

6. The method according to claim 5, wherein: After sending the exception handling command to the first slave node server through the second communication channel, re-detecting the first slave node server for exceptions, and when determining that the first slave node server is abnormal, the method further includes: A process restart command is sent to the first slave node server through the second communication channel, wherein the first slave node server is used to execute the process restart command to restart the Agent process.

7. An abnormality detection method, used for the first slave node server according to any one of claims 1 to 6, wherein the first slave node server is any one of N slave node servers, the N slave node servers are communicatively connected to the corresponding master node server, N is an integer greater than or equal to 1, and the method comprises: Receiving an anomaly detection command sent by the master node server; In case of receiving the abnormality detection command, executing the abnormality detection command; Returning a command execution result of executing the anomaly detection command to the master node server; Wherein, the master node server is configured as: In the case where the command execution result is not received, determining that the first slave node server is abnormal; When the command execution result is received, the execution identifier of the command execution result is obtained by parsing to detect an abnormality of the first slave node server.

8. The method according to claim 7, wherein: The master node server includes a Master process, the first slave node server includes an Agent process, and when the abnormality detection command is received, executing the abnormality detection command includes: When the abnormality detection command sent by the Master process is received, the abnormality detection command is executed by the Agent process.

9. The method according to claim 8, wherein: The Master process sends the abnormality detection command through the first communication channel, and the method further includes: Receiving an exception handling command sent by the master node server through a second communication channel, wherein the second communication channel is different from the first communication channel; The exception handling command is executed to handle the exception of the Agent process.

10. The method according to claim 9, wherein: The method further comprises: Receiving a process restart command sent by the master node server through the second communication channel; Execute the process restart command to restart the Agent process.

11. An anomaly detection device, used for each master node server in different local data centers, each of the master node servers is connected to N slave node servers in communication, and the device uses a task scheduling framework to schedule detection tasks, specifically including: A first sending module, configured to enable each of the master node servers to send an abnormality detection command to a first slave node server, wherein the first slave node server is any one of the N slave node servers, and N is an integer greater than or equal to 1; an abnormality detection module, used to enable each of the master node servers to detect abnormalities of the first slave node server according to the return result of the first slave node server, wherein the first slave node server is used to execute the received abnormality detection command and return the command execution result to the master node server; The abnormality detection module is used to detect the abnormality of the first slave node server according to the return result of the first slave node server, including: In the case where the command execution result is not received, determining that the first slave node server is abnormal; When receiving the command execution result, parsing and obtaining the execution identifier of the command execution result to detect an abnormality of the first slave node server; The device also utilizes the task scheduling framework to be responsible for the scheduling of processing tasks, specifically including: Each of the master node servers sends an exception handling command for synchronizing time to the first slave node server through a second communication channel, wherein the first slave node server is used to execute the exception handling command to handle the exception caused by the time inconsistency between the Agent process in the first slave node server and the Master process in the master node server, and the second communication channel is different from the first communication channel, and the first communication channel is used to send the exception detection command.

12. An abnormality detection device, used for the first slave node server according to any one of claims 1 to 6, wherein the first slave node server is any one of N slave node servers, the N slave node servers are communicatively connected to the corresponding master node server, N is an integer greater than or equal to 1, and the device comprises: A command receiving module, used to receive an anomaly detection command sent by the master node server; A command execution module, configured to execute the abnormality detection command upon receiving the abnormality detection command; A second sending module, used for returning a command execution result of executing the abnormality detection command to the master node server; Wherein, the master node server is configured to include an anomaly detection module, and the anomaly detection module is used to: In the case where the command execution result is not received, determining that the first slave node server is abnormal; When the command execution result is received, the execution identifier of the command execution result is obtained by parsing to detect an abnormality of the first slave node server.

13. An electronic device, comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 10.

14. A computer-readable storage medium having executable commands stored thereon, which, when executed by a processor, cause the processor to execute the method according to any one of claims 1 to 10.

15. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images