System abnormality monitoring method, device, equipment and storage medium

Abstract

The present invention relates to monitoring and provides a system anomaly monitoring method, device, equipment, and storage medium. The method can obtain historical anomaly logs of a system to be tested according to a system anomaly monitoring request, parse the historical anomaly logs, obtain an indicator to be tested, convert the indicator to be tested into a time series indicator, obtain a conversion relationship between the indicator to be tested and the time series indicator, locate the log storage directory of the system to be tested, call a container plug-in corresponding to the time series indicator to collect the stored logs in the log storage directory, obtain time series information, calculate the time series information based on the conversion relationship, obtain indicator data, and generate monitoring results based on the indicator data and a preset threshold value. This method can not only avoid the waste of maintenance resources, but also improve the monitoring efficiency of the system to be tested. In addition, the present invention also relates to blockchain technology, and the monitoring results can be stored in the blockchain.

Description

Technical Field

[0001] The present invention relates to the field of monitoring technology, and in particular to a system abnormality monitoring method, device, equipment and storage medium. Background Art

[0002] In the current system anomaly monitoring method, it is usually necessary to directly maintain a centralized log management platform such as ELK and EFK on the system, and then pull logs from the system for anomaly analysis based on the maintained centralized log management platform. However, in this method, it is necessary to maintain a centralized log management platform on the system to be monitored, resulting in a waste of maintenance resources. In addition, this method will also lead to logs being aggregated to the centralized log management platform for statistical analysis, resulting in low system monitoring efficiency. Summary of the Invention

[0003] In view of the above, it is necessary to provide a system abnormality monitoring method, device, equipment and storage medium, which can not only avoid the waste of maintenance resources, but also improve the monitoring efficiency of the system to be tested.

[0004] In one aspect, the present invention provides a system anomaly monitoring method, the system anomaly monitoring method comprising:

[0005] When a system anomaly monitoring request is received, obtaining a historical anomaly log of the system to be tested according to the system anomaly monitoring request;

[0006] Parsing the historical abnormality log to obtain the test indicators of the system under test;

[0007] Converting the indicator to be measured into a time series indicator to obtain a conversion relationship between the indicator to be measured and the time series indicator;

[0008] Locate the log storage directory of the system under test;

[0009] Calling a container plug-in corresponding to the timing indicator to collect the stored logs in the log storage directory to obtain timing information corresponding to the timing indicator;

[0010] Calculate the time series information according to the conversion relationship to obtain indicator data corresponding to the indicator to be measured;

[0011] Generate monitoring results of the system under test based on the indicator data and preset thresholds.

[0012] According to a preferred embodiment of the present invention, obtaining the historical abnormality log of the system to be tested according to the system abnormality monitoring request includes:

[0013] Parsing the message of the system abnormality monitoring request to obtain the data information carried in the message;

[0014] extracting a system identification code from the data information;

[0015] Determine the system corresponding to the system identification code as the system to be tested;

[0016] A historical log corresponding to the abnormal label is obtained from the system to be tested as the historical abnormal log.

[0017] According to a preferred embodiment of the present invention, parsing the historical exception log to obtain the test indicator of the system under test includes:

[0018] Extracting log indicators from the historical abnormal logs based on preset indicators;

[0019] Counting the abnormal frequency of the log indicator in the historical abnormal log;

[0020] The log indicator whose abnormal frequency of the indicator is greater than a preset number of times is determined as the indicator to be measured.

[0021] According to a preferred embodiment of the present invention, generating the monitoring result of the system to be tested according to the indicator data and the preset threshold value includes:

[0022] Calculating the degree of deviation between the indicator data and the preset threshold;

[0023] If the deviation degree is not a configured value, generating a health score of the system under test on the indicator under test according to the deviation degree;

[0024] If the health score is greater than or equal to a first preset score, the monitoring result is determined to be that the system to be tested is normal; or

[0025] If the health score is less than or equal to a second preset score, the monitoring result is determined to be an abnormality of the system under test, and the second preset score is less than the first preset score; or

[0026] If the health score is less than the first preset score and the health score is greater than the second preset score, a target indicator is selected from the log indicators based on the abnormal frequency of the indicator, and the system to be tested is monitored based on the target indicator to obtain the monitoring result, wherein the target indicator is different from the indicator to be tested.

[0027] According to a preferred embodiment of the present invention, generating a health score of the system under test on the indicator under test according to the degree of deviation includes:

[0028] Obtaining the influence weight of the indicator to be measured on the operation of the system to be measured from a preset weight list;

[0029] Generating the health score according to the deviation degree and the impact weight includes:

[0030]

[0031] Wherein, y refers to the health score, x refers to the deviation degree, x>0, and k refers to the influence weight.

[0032] According to a preferred embodiment of the present invention, converting the indicator to be measured into a timing indicator to obtain a conversion relationship between the indicator to be measured and the timing indicator includes:

[0033] Segment the indicator to be measured based on a preset time sequence vocabulary to obtain a plurality of indicator words;

[0034] The indicator words that successfully match the preset time sequence words are determined as the conversion relationships, and the indicator words other than the conversion relationships are determined as the time sequence indicators.

[0035] According to a preferred embodiment of the present invention, calling the container plug-in corresponding to the timing indicator to collect the stored logs in the log storage directory to obtain the timing information corresponding to the timing indicator includes:

[0036] Detecting whether the storage log matches the timing indicator based on the container plug-in;

[0037] Determine a storage log that matches the time series indicator as a target log;

[0038] Obtaining the log generation time of the target log from the log storage directory;

[0039] The log identifier of the target log is converted into the time sequence information according to the order of the log generation time from smallest to largest.

[0040] On the other hand, the present invention further provides a system abnormality monitoring device, comprising:

[0041] an acquiring unit, configured to acquire, upon receiving a system anomaly monitoring request, a historical anomaly log of the system to be tested according to the system anomaly monitoring request;

[0042] An analysis unit, configured to analyze the historical abnormality logs to obtain the test indicators of the system under test;

[0043] a conversion unit, configured to convert the indicator to be measured into a timing indicator, and obtain a conversion relationship between the indicator to be measured and the timing indicator;

[0044] A locating unit, configured to locate the log storage directory of the system under test;

[0045] A collection unit, configured to call a container plug-in corresponding to the timing indicator to collect the stored logs in the log storage directory, and obtain timing information corresponding to the timing indicator;

[0046] a calculation unit, configured to calculate the time series information according to the conversion relationship to obtain indicator data corresponding to the indicator to be measured;

[0047] A generating unit is used to generate monitoring results of the system to be tested based on the indicator data and a preset threshold.

[0048] On the other hand, the present invention further provides an electronic device, comprising:

[0049] a memory storing computer-readable instructions; and

[0050] The processor executes the computer-readable instructions stored in the memory to implement the system abnormality monitoring method.

[0051] On the other hand, the present invention further proposes a computer-readable storage medium, in which computer-readable instructions are stored. The computer-readable instructions are executed by a processor in an electronic device to implement the system abnormality monitoring method.

[0052] It can be seen from the above technical solutions that the present invention can accurately locate the indicators to be tested related to the operation of the system to be tested through the historical abnormality logs, can avoid the system to be tested from monitoring irrelevant indicators, and then convert the indicators to be tested into time series indicators, can call the container plug-in to directly generate the time series information, improve the efficiency of generating the indicator data, and further improve the accuracy of the monitoring results by detecting the indicator data through the preset threshold. In addition, the present invention calls the container plug-in to analyze the logs in the log storage directory, and can still monitor the system to be tested without maintaining a centralized log management platform on the system to be tested, thereby avoiding the waste of maintenance resources. In addition, by calling the container plug-in corresponding to the time series indicator to analyze the log, there is no need to summarize and analyze the logs, thereby improving the monitoring efficiency of the system to be tested. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is a flow chart of a preferred embodiment of the system abnormality monitoring method of the present invention.

[0054] Figure 2 It is a functional module diagram of a preferred embodiment of the system abnormality monitoring device of the present invention.

[0055] Figure 3 It is a structural diagram of an electronic device according to a preferred embodiment of the present invention for implementing a method for monitoring system abnormalities. DETAILED DESCRIPTION

[0056] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0057] like Figure 1 FIG. 1 is a flow chart of a preferred embodiment of the system abnormality monitoring method of the present invention. According to different requirements, the order of the steps in the flow chart can be changed, and some steps can be omitted.

[0058] The system anomaly monitoring method can acquire and process relevant data based on artificial intelligence technology. Artificial Intelligence (AI) is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results.

[0059] Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interaction systems, and mechatronics. AI software technologies primarily encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0060] The system anomaly monitoring method is applied to one or more electronic devices, which are devices that can automatically perform numerical calculations and / or information processing according to pre-set or stored computer-readable instructions. Their hardware includes but is not limited to microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0061] The electronic device can be any electronic product that can interact with a user, such as a personal computer, a tablet computer, a smart phone, a personal digital assistant (PDA), a game console, an interactive network television (IPTV), a smart wearable device, etc.

[0062] The electronic device may include a network device and / or a user device, wherein the network device includes, but is not limited to, a single network electronic device, a group of electronic devices consisting of multiple network electronic devices, or a cloud based on cloud computing consisting of a large number of hosts or network electronic devices.

[0063] The network where the electronic device is located includes, but is not limited to: the Internet, a wide area network, a metropolitan area network, a local area network, a virtual private network (VPN), etc.

[0064] S10 , when a system abnormality monitoring request is received, obtaining a historical abnormality log of the system to be tested according to the system abnormality monitoring request.

[0065] In at least one embodiment of the present invention, the system anomaly monitoring request may be triggered by an operation and maintenance user of the system under test. The system anomaly monitoring request carries a system identification code of the system under test.

[0066] The historical exception log refers to a log generated when a request in the system under test runs abnormally.

[0067] In at least one embodiment of the present invention, the electronic device obtaining a historical abnormality log of the system under test according to the system abnormality monitoring request includes:

[0068] Parsing the message of the system abnormality monitoring request to obtain the data information carried in the message;

[0069] extracting a system identification code from the data information;

[0070] Determine the system corresponding to the system identification code as the system to be tested;

[0071] A historical log corresponding to the abnormal label is obtained from the system to be tested as the historical abnormal log.

[0072] The data information includes the system identification code and other information related to the monitoring operation of the system to be tested.

[0073] The exception tag is used to indicate that the request execution failed. For example, the exception tag may be error.

[0074] The historical log refers to the log information generated by the system under test before receiving the system abnormality monitoring request.

[0075] By parsing the message, the system identification code can be quickly extracted, and then the historical exception log can be accurately extracted based on the exception tag.

[0076] S11, parsing the historical abnormality log to obtain the indicators to be tested of the system to be tested.

[0077] In at least one embodiment of the present invention, the indicator to be measured refers to indicator information that needs to be monitored in the system to be measured.

[0078] In at least one embodiment of the present invention, the electronic device parsing the historical abnormality log to obtain the measured indicator of the system under test includes:

[0079] Extracting log indicators from the historical abnormal logs based on preset indicators;

[0080] Counting the abnormal frequency of the log indicator in the historical abnormal log;

[0081] The log indicator whose abnormal frequency of the indicator is greater than a preset number of times is determined as the indicator to be measured.

[0082] The preset indicators are pre-set indicators used to monitor the operating conditions of the system under test.

[0083] The indicator abnormal frequency refers to the number of times the log indicator appears in the historical abnormal log within a certain period of time.

[0084] The preset number of times is set according to actual needs.

[0085] The preset indicators can comprehensively extract the log indicators from the historical abnormal logs, and then based on the abnormal frequency of the indicators, the indicators to be tested related to the operation of the system to be tested can be accurately screened out, thereby avoiding the monitoring of irrelevant indicators by the system to be tested.

[0086] S12: Convert the indicator to be measured into a timing indicator to obtain a conversion relationship between the indicator to be measured and the timing indicator.

[0087] In at least one embodiment of the present invention, the timing indicator refers to an indicator related to time. For example, the timing indicator may be the occurrence of a timeout exception.

[0088] The conversion relationship refers to the conversion relationship between the indicator to be measured and the timing indicator.

[0089] In at least one embodiment of the present invention, the electronic device converts the indicator to be measured into a timing indicator, and obtaining the conversion relationship between the indicator to be measured and the timing indicator includes:

[0090] Segment the indicator to be measured based on a preset time sequence vocabulary to obtain a plurality of indicator words;

[0091] The indicator words that successfully match the preset time sequence words are determined as the conversion relationships, and the indicator words other than the conversion relationships are determined as the time sequence indicators.

[0092] The preset time sequence vocabulary refers to vocabulary information related to time sequence.

[0093] For example, the preset timing vocabulary includes: frequency, and the indicator to be measured is: timeout exception frequency. After segmentation, the multiple indicator words obtained include: timeout exception occurrence, frequency. After matching, the conversion relationship obtained is: frequency, and the timing indicator is: timeout exception occurrence.

[0094] By segmenting the indicator to be measured through the preset timing vocabulary, the multiple indicator vocabulary can be quickly obtained, and then the conversion relationship and the timing indicator can be accurately determined according to the matching relationship between the multiple indicator vocabulary and the preset timing vocabulary.

[0095] S13, locating the log storage directory of the system under test.

[0096] In at least one embodiment of the present invention, the log storage directory stores the generation time of all logs in the system under test.

[0097] S14 , calling a container plug-in corresponding to the timing indicator to collect the stored logs in the log storage directory, and obtaining timing information corresponding to the timing indicator.

[0098] In at least one embodiment of the present invention, the container plug-in is capable of detecting whether the storage log matches the timing indicator.

[0099] The time series information includes log identifiers corresponding to multiple storage logs that match the time series indicators.

[0100] In at least one embodiment of the present invention, the electronic device calling the container plug-in corresponding to the timing indicator to collect the stored logs in the log storage directory, and obtaining the timing information corresponding to the timing indicator includes:

[0101] Detecting whether the storage log matches the timing indicator based on the container plug-in;

[0102] Determine a storage log that matches the time series indicator as a target log;

[0103] Obtaining the log generation time of the target log from the log storage directory;

[0104] The log identifier of the target log is converted into the time sequence information according to the order of the log generation time from smallest to largest.

[0105] The log generation time refers to the time when the target log is written into the log storage directory.

[0106] The container plug-in can accurately detect the target log that matches the timing indicator, and then accurately generate the timing information according to the log generation time of the target log.

[0107] S15, calculating the timing information according to the conversion relationship to obtain indicator data corresponding to the indicator to be measured.

[0108] In at least one embodiment of the present invention, the indicator data refers to data information corresponding to the indicator to be measured in the system to be measured.

[0109] For example, the conversion relationship is: frequency, then the indicator data may refer to the total number in the time series information.

[0110] S16: Generate monitoring results of the system to be tested based on the indicator data and a preset threshold.

[0111] It should be emphasized that in order to further ensure the privacy and security of the above monitoring results, the above monitoring results can also be stored in a blockchain node.

[0112] In at least one embodiment of the present invention, the preset threshold refers to the minimum indicator requirement on the indicator to be measured when the system to be measured operates normally.

[0113] In at least one embodiment of the present invention, the electronic device generating a monitoring result of the system under test according to the indicator data and a preset threshold value includes:

[0114] Calculating the degree of deviation between the indicator data and the preset threshold;

[0115] If the deviation degree is not a configured value, generating a health score of the system under test on the indicator under test according to the deviation degree;

[0116] If the health score is greater than or equal to a first preset score, the monitoring result is determined to be that the system to be tested is normal; or

[0117] If the health score is less than or equal to a second preset score, the monitoring result is determined to be an abnormality of the system under test, and the second preset score is less than the first preset score; or

[0118] If the health score is less than the first preset score and the health score is greater than the second preset score, a target indicator is selected from the log indicators based on the abnormal frequency of the indicator, and the system to be tested is monitored based on the target indicator to obtain the monitoring result, wherein the target indicator is different from the indicator to be tested.

[0119] The degree of deviation refers to the deviation between the indicator data and the preset threshold value, and the degree of deviation may be the difference between the indicator data and the preset threshold value.

[0120] The configuration value is usually set to 0.

[0121] The second preset score and the first preset score are set according to actual needs.

[0122] By setting the first preset score and the second preset score, it is possible to avoid certain errors in generating the health score, which may cause inaccurate monitoring results. Furthermore, when the health score is less than the first preset score and the health score is greater than the second preset score, the system to be tested is further monitored based on the target indicator to improve the accuracy of the monitoring results.

[0123] Specifically, the electronic device generating a health score of the system under test on the indicator under test according to the deviation degree includes:

[0124] Obtaining the influence weight of the indicator to be measured on the operation of the system to be measured from a preset weight list;

[0125] Generating the health score according to the deviation degree and the impact weight includes:

[0126]

[0127] Wherein, y refers to the health score, x refers to the deviation degree, x>0, and k refers to the influence weight.

[0128] The preset weight list stores the degree of influence of the preset indicators on the operation of multiple systems.

[0129] The influence weight can be accurately obtained through the preset weight list, thereby improving the accuracy of generating the health score.

[0130] In at least one embodiment of the present invention, if the deviation degree is the configured value, the health score is determined to be any value greater than or equal to the first preset score.

[0131] In this embodiment, since the degree of deviation is the configuration value, it indicates that the indicator data is equal to the preset threshold value. Therefore, when the degree of deviation is the configuration value, the health score is determined to be any value greater than or equal to the first preset score, thereby improving the accuracy of the monitoring results.

[0132] In at least one embodiment of the present invention, the manner in which the electronic device monitors the system under test based on the target indicator is similar to the manner in which the electronic device monitors the system under test based on the indicator under test, and the present invention will not elaborate on this.

[0133] It can be seen from the above technical solutions that the present invention can accurately locate the indicators to be tested related to the operation of the system to be tested through the historical abnormality logs, can avoid the system to be tested from monitoring irrelevant indicators, and then convert the indicators to be tested into time series indicators, can call the container plug-in to directly generate the time series information, improve the efficiency of generating the indicator data, and further improve the accuracy of the monitoring results by detecting the indicator data through the preset threshold. In addition, the present invention calls the container plug-in to analyze the logs in the log storage directory, and can still monitor the system to be tested without maintaining a centralized log management platform on the system to be tested, thereby avoiding the waste of maintenance resources. In addition, by calling the container plug-in corresponding to the time series indicator to analyze the log, there is no need to summarize and analyze the logs, thereby improving the monitoring efficiency of the system to be tested.

[0134] like Figure 2 , which is a functional block diagram of a preferred embodiment of the system anomaly monitoring device of the present invention. The system anomaly monitoring device 11 includes an acquisition unit 110, a parsing unit 111, a conversion unit 112, a positioning unit 113, a collection unit 114, a calculation unit 115, and a generation unit 116. As used herein, a module / unit refers to a series of computer-readable instruction segments that can be acquired by the processor 13 and perform a fixed function, and is stored in the memory 12. In this embodiment, the functions of each module / unit will be described in detail in subsequent embodiments.

[0135] When a system abnormality monitoring request is received, the acquiring unit 110 acquires the historical abnormality log of the system to be tested according to the system abnormality monitoring request.

[0136] In at least one embodiment of the present invention, the system anomaly monitoring request may be triggered by an operation and maintenance user of the system under test. The system anomaly monitoring request carries a system identification code of the system under test.

[0137] The historical exception log refers to a log generated when a request in the system under test runs abnormally.

[0138] In at least one embodiment of the present invention, the acquiring unit 110 acquires the historical abnormality log of the system under test according to the system abnormality monitoring request, including:

[0139] Parsing the message of the system abnormality monitoring request to obtain the data information carried in the message;

[0140] extracting a system identification code from the data information;

[0141] Determine the system corresponding to the system identification code as the system to be tested;

[0142] A historical log corresponding to the abnormal label is obtained from the system to be tested as the historical abnormal log.

[0143] The data information includes the system identification code and other information related to the monitoring operation of the system to be tested.

[0144] The exception tag is used to indicate that the request execution failed. For example, the exception tag may be error.

[0145] The historical log refers to the log information generated by the system under test before receiving the system abnormality monitoring request.

[0146] By parsing the message, the system identification code can be quickly extracted, and then the historical exception log can be accurately extracted based on the exception tag.

[0147] The parsing unit 111 parses the historical abnormality logs to obtain the indicators to be tested of the system to be tested.

[0148] In at least one embodiment of the present invention, the indicator to be measured refers to indicator information that needs to be monitored in the system to be measured.

[0149] In at least one embodiment of the present invention, the parsing unit 111 parses the historical exception log to obtain the test indicator of the system under test, including:

[0150] Extracting log indicators from the historical abnormal logs based on preset indicators;

[0151] Counting the abnormal frequency of the log indicator in the historical abnormal log;

[0152] The log indicator whose abnormal frequency of the indicator is greater than a preset number of times is determined as the indicator to be measured.

[0153] The preset indicators are pre-set indicators used to monitor the operating conditions of the system under test.

[0154] The indicator abnormality frequency refers to the number of times the log indicator appears in the historical abnormality log within a certain period of time.

[0155] The preset number of times is set according to actual needs.

[0156] The preset indicators can comprehensively extract the log indicators from the historical abnormal logs, and then based on the abnormal frequency of the indicators, the indicators to be tested related to the operation of the system to be tested can be accurately screened out, thereby avoiding the monitoring of irrelevant indicators by the system to be tested.

[0157] The conversion unit 112 converts the indicator to be measured into a timing indicator to obtain a conversion relationship between the indicator to be measured and the timing indicator.

[0158] In at least one embodiment of the present invention, the timing indicator refers to an indicator related to time. For example, the timing indicator may be the occurrence of a timeout exception.

[0159] The conversion relationship refers to the conversion relationship between the indicator to be measured and the timing indicator.

[0160] In at least one embodiment of the present invention, the conversion unit 112 converts the indicator to be measured into a timing indicator, and obtaining the conversion relationship between the indicator to be measured and the timing indicator includes:

[0161] Segment the indicator to be measured based on a preset time sequence vocabulary to obtain a plurality of indicator words;

[0162] The indicator words that successfully match the preset time sequence words are determined as the conversion relationships, and the indicator words other than the conversion relationships are determined as the time sequence indicators.

[0163] The preset time sequence vocabulary refers to vocabulary information related to time sequence.

[0164] For example, the preset timing vocabulary includes: frequency, and the indicator to be measured is: timeout exception frequency. After segmentation, the multiple indicator words obtained include: timeout exception occurrence, frequency. After matching, the conversion relationship obtained is: frequency, and the timing indicator is: timeout exception occurrence.

[0165] By segmenting the indicator to be measured through the preset timing vocabulary, the multiple indicator vocabulary can be quickly obtained, and then the conversion relationship and the timing indicator can be accurately determined according to the matching relationship between the multiple indicator vocabulary and the preset timing vocabulary.

[0166] The locating unit 113 locates the log storage directory of the system under test.

[0167] In at least one embodiment of the present invention, the log storage directory stores the generation time of all logs in the system under test.

[0168] The collecting unit 114 calls the container plug-in corresponding to the timing indicator to collect the stored logs in the log storage directory to obtain the timing information corresponding to the timing indicator.

[0169] In at least one embodiment of the present invention, the container plug-in is capable of detecting whether the storage log matches the timing indicator.

[0170] The time series information includes log identifiers corresponding to multiple storage logs that match the time series indicators.

[0171] In at least one embodiment of the present invention, the collection unit 114 calls the container plug-in corresponding to the timing indicator to collect the stored logs in the log storage directory, and the obtained timing information corresponding to the timing indicator includes:

[0172] Detecting whether the storage log matches the timing indicator based on the container plug-in;

[0173] Determine a storage log that matches the time series indicator as a target log;

[0174] Obtaining the log generation time of the target log from the log storage directory;

[0175] The log identifier of the target log is converted into the time sequence information according to the order of the log generation time from smallest to largest.

[0176] The log generation time refers to the time when the target log is written into the log storage directory.

[0177] The container plug-in can accurately detect the target log that matches the timing indicator, and then accurately generate the timing information according to the log generation time of the target log.

[0178] The calculation unit 115 calculates the time series information according to the conversion relationship to obtain indicator data corresponding to the indicator to be measured.

[0179] In at least one embodiment of the present invention, the indicator data refers to data information corresponding to the indicator to be measured in the system to be measured.

[0180] For example, the conversion relationship is: frequency, then the indicator data may refer to the total number in the time series information.

[0181] The generating unit 116 generates a monitoring result of the system to be tested according to the indicator data and a preset threshold value.

[0182] It should be emphasized that in order to further ensure the privacy and security of the above monitoring results, the above monitoring results can also be stored in a blockchain node.

[0183] In at least one embodiment of the present invention, the preset threshold refers to the minimum indicator requirement on the indicator to be measured when the system to be measured operates normally.

[0184] In at least one embodiment of the present invention, the generating unit 116 generates the monitoring result of the system under test according to the indicator data and the preset threshold value, including:

[0185] Calculating the degree of deviation between the indicator data and the preset threshold;

[0186] If the deviation degree is not a configured value, generating a health score of the system under test on the indicator under test according to the deviation degree;

[0187] If the health score is greater than or equal to a first preset score, the monitoring result is determined to be that the system to be tested is normal; or

[0188] If the health score is less than or equal to a second preset score, the monitoring result is determined to be an abnormality of the system under test, and the second preset score is less than the first preset score; or

[0189] If the health score is less than the first preset score and the health score is greater than the second preset score, a target indicator is selected from the log indicators based on the abnormal frequency of the indicator, and the system to be tested is monitored based on the target indicator to obtain the monitoring result, wherein the target indicator is different from the indicator to be tested.

[0190] The degree of deviation refers to the deviation between the indicator data and the preset threshold value, and the degree of deviation may be the difference between the indicator data and the preset threshold value.

[0191] The configuration value is usually set to 0.

[0192] The second preset score and the first preset score are set according to actual needs.

[0193] By setting the first preset score and the second preset score, it is possible to avoid certain errors in generating the health score, which may cause inaccurate monitoring results. Furthermore, when the health score is less than the first preset score and the health score is greater than the second preset score, the system to be tested is further monitored based on the target indicator to improve the accuracy of the monitoring results.

[0194] Specifically, the generating unit 116 generates the health score of the system under test on the indicator under test according to the deviation degree, including:

[0195] Obtaining the influence weight of the indicator to be measured on the operation of the system to be measured from a preset weight list;

[0196] Generating the health score according to the deviation degree and the impact weight includes:

[0197]

[0198] Wherein, y refers to the health score, x refers to the deviation degree, x>0, and k refers to the influence weight.

[0199] The preset weight list stores the degree of influence of the preset indicators on the operation of multiple systems.

[0200] The influence weight can be accurately obtained through the preset weight list, thereby improving the accuracy of generating the health score.

[0201] In at least one embodiment of the present invention, if the deviation degree is the configured value, the generating unit 116 determines the health score to be any value greater than or equal to the first preset score.

[0202] In this embodiment, since the degree of deviation is the configuration value, it indicates that the indicator data is equal to the preset threshold value. Therefore, when the degree of deviation is the configuration value, the health score is determined to be any value greater than or equal to the first preset score, thereby improving the accuracy of the monitoring results.

[0203] In at least one embodiment of the present invention, the manner in which the generation unit 116 monitors the system under test based on the target indicator is similar to the manner in which the generation unit 116 monitors the system under test based on the indicator under test, and the present invention will not elaborate on this.

[0204] It can be seen from the above technical solutions that the present invention can accurately locate the indicators to be tested related to the operation of the system to be tested through the historical abnormality logs, can avoid the system to be tested from monitoring irrelevant indicators, and then convert the indicators to be tested into time series indicators, can call the container plug-in to directly generate the time series information, improve the efficiency of generating the indicator data, and further improve the accuracy of the monitoring results by detecting the indicator data through the preset threshold. In addition, the present invention calls the container plug-in to analyze the logs in the log storage directory, and can still monitor the system to be tested without maintaining a centralized log management platform on the system to be tested, thereby avoiding the waste of maintenance resources. In addition, by calling the container plug-in corresponding to the time series indicator to analyze the log, there is no need to summarize and analyze the logs, thereby improving the monitoring efficiency of the system to be tested.

[0205] like Figure 3 FIG. 1 is a schematic diagram of the structure of an electronic device according to a preferred embodiment of the present invention for implementing a method for monitoring system abnormalities.

[0206] In one embodiment of the present invention, the electronic device 1 includes, but is not limited to, a memory 12, a processor 13, and computer-readable instructions stored in the memory 12 and executable on the processor 13, such as a system anomaly monitoring program.

[0207] Those skilled in the art will understand that the schematic diagram is merely an example of the electronic device 1 and does not constitute a limitation on the electronic device 1. The electronic device 1 may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device 1 may also include input and output devices, network access devices, buses, etc.

[0208] The processor 13 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor 13 is the computing core and control center of the electronic device 1, connecting various parts of the entire electronic device 1 using various interfaces and lines, and executing the operating system of the electronic device 1 as well as various installed applications, program codes, etc.

[0209] Exemplarily, the computer-readable instructions may be divided into one or more modules / units, which are stored in the memory 12 and executed by the processor 13 to implement the present invention. The one or more modules / units may be a series of computer-readable instruction segments capable of performing specific functions, which describe the execution process of the computer-readable instructions in the electronic device 1. For example, the computer-readable instructions may be divided into an acquisition unit 110, a parsing unit 111, a conversion unit 112, a positioning unit 113, a collection unit 114, a calculation unit 115, and a generation unit 116.

[0210] The memory 12 can be used to store the computer-readable instructions and / or modules. The processor 13 implements the various functions of the electronic device 1 by running or executing the computer-readable instructions and / or modules stored in the memory 12 and calling the data stored in the memory 12. The memory 12 can mainly include a program storage area and a data storage area. The program storage area can store an operating system and at least one application required for a function (such as a sound playback function, an image playback function, etc.); the data storage area can store data created based on the use of the electronic device. The memory 12 can include non-volatile and volatile memory, such as a hard disk, internal memory, a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card, at least one disk storage device, a flash memory device, or other storage devices.

[0211] The memory 12 may be an external memory and / or an internal memory of the electronic device 1. Furthermore, the memory 12 may be a physical memory, such as a memory stick, a TF card (Trans-flash Card), and the like.

[0212] If the modules / units integrated in the electronic device 1 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the present invention can also implement all or part of the processes in the above-mentioned embodiment methods by instructing related hardware through computer-readable instructions. The computer-readable instructions can be stored in a computer-readable storage medium. When the computer-readable instructions are executed by a processor, the steps of each of the above-mentioned method embodiments can be implemented.

[0213] The computer-readable instructions include computer-readable instruction codes, which may be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium may include any entity or device capable of carrying the computer-readable instruction codes, a recording medium, a USB flash drive, a mobile hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), or a random access memory (RAM).

[0214] The blockchain referred to in this article is a novel application model for computer technologies such as distributed system anomaly monitoring, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Blockchain is essentially a decentralized database, a series of data blocks generated using cryptographic methods. Each block contains information about a batch of online transactions, which is used to verify the validity of this information (to prevent counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, the platform product service layer, and the application service layer.

[0215] Combine Figure 1 The memory 12 in the electronic device 1 stores computer-readable instructions to implement a system abnormality monitoring method, and the processor 13 can execute the computer-readable instructions to implement:

[0216] When a system anomaly monitoring request is received, obtaining a historical anomaly log of the system to be tested according to the system anomaly monitoring request;

[0217] Parsing the historical abnormality log to obtain the test indicators of the system under test;

[0218] Converting the indicator to be measured into a time series indicator to obtain a conversion relationship between the indicator to be measured and the time series indicator;

[0219] Locate the log storage directory of the system under test;

[0220] Calling a container plug-in corresponding to the timing indicator to collect the stored logs in the log storage directory to obtain timing information corresponding to the timing indicator;

[0221] Calculate the time series information according to the conversion relationship to obtain indicator data corresponding to the indicator to be measured;

[0222] Generate monitoring results of the system under test based on the indicator data and preset thresholds.

[0223] Specifically, the specific implementation method of the processor 13 for the above computer readable instructions can refer to Figure 1 The description of the relevant steps in the corresponding embodiments will not be repeated here.

[0224] In the several embodiments provided herein, it should be understood that the disclosed systems, devices, and methods may be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the module division is merely a logical functional division, and actual implementation may employ other division methods.

[0225] The computer-readable storage medium stores computer-readable instructions, wherein the computer-readable instructions, when executed by the processor 13, are used to implement the following steps:

[0226] When a system anomaly monitoring request is received, obtaining a historical anomaly log of the system to be tested according to the system anomaly monitoring request;

[0227] Parsing the historical abnormality log to obtain the test indicators of the system under test;

[0228] Converting the indicator to be measured into a time series indicator to obtain a conversion relationship between the indicator to be measured and the time series indicator;

[0229] Locate the log storage directory of the system under test;

[0230] Calling a container plug-in corresponding to the timing indicator to collect the stored logs in the log storage directory to obtain timing information corresponding to the timing indicator;

[0231] Calculate the time series information according to the conversion relationship to obtain indicator data corresponding to the indicator to be measured;

[0232] Generate monitoring results of the system under test based on the indicator data and preset thresholds.

[0233] The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed across multiple network elements. Some or all of the modules may be selected to achieve the purpose of the solution of this embodiment according to actual needs.

[0234] In addition, the functional modules in various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or hardware plus software functional modules.

[0235] Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims rather than the foregoing description, and all changes that come within the meaning and range of equivalents of the claims are intended to be embraced therein. Any reference to a figure in a claim should not be construed as limiting the claim to which it relates.

[0236] Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. The multiple units or devices described may also be implemented by a single unit or device through software or hardware. Terms such as first and second are used to indicate names and do not imply any particular order.

[0237] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A system abnormality monitoring method, characterized in that: The system abnormality monitoring method includes: When a system anomaly monitoring request is received, obtaining a historical anomaly log of the system to be tested according to the system anomaly monitoring request; Parsing the historical abnormality log to obtain the test indicators of the system under test; Converting the indicator to be measured into a time series indicator to obtain a conversion relationship between the indicator to be measured and the time series indicator, wherein the time series indicator refers to an indicator related to time; Locate the log storage directory of the system under test; Calling a container plug-in corresponding to the timing indicator to collect the stored logs in the log storage directory to obtain timing information corresponding to the timing indicator; Calculate the time series information according to the conversion relationship to obtain indicator data corresponding to the indicator to be measured; Generate monitoring results of the system under test based on the indicator data and preset thresholds.

2. The system abnormality monitoring method according to claim 1, characterized in that: Obtaining the historical abnormality log of the system to be tested according to the system abnormality monitoring request includes: Parsing the message of the system abnormality monitoring request to obtain the data information carried in the message; extracting a system identification code from the data information; Determine the system corresponding to the system identification code as the system to be tested; A historical log corresponding to the abnormal label is obtained from the system to be tested as the historical abnormal log.

3. The system abnormality monitoring method according to claim 1, wherein: The analyzing the historical abnormality log to obtain the measured indicators of the system under test includes: Extracting log indicators from the historical abnormal logs based on preset indicators; Counting the abnormal frequency of the log indicator in the historical abnormal log; The log indicator whose abnormal frequency of the indicator is greater than a preset number of times is determined as the indicator to be measured.

4. The system abnormality monitoring method according to claim 3, characterized in that: Generating the monitoring result of the system to be tested according to the indicator data and the preset threshold value includes: Calculating the degree of deviation between the indicator data and the preset threshold; If the deviation degree is not a configured value, generating a health score of the system under test on the indicator under test according to the deviation degree; If the health score is greater than or equal to a first preset score, the monitoring result is determined to be that the system to be tested is normal; or If the health score is less than or equal to a second preset score, the monitoring result is determined to be an abnormality of the system under test, and the second preset score is less than the first preset score; or If the health score is less than the first preset score and the health score is greater than the second preset score, a target indicator is selected from the log indicators based on the abnormal frequency of the indicator, and the system to be tested is monitored based on the target indicator to obtain the monitoring result, wherein the target indicator is different from the indicator to be tested.

5. The system abnormality monitoring method according to claim 4, characterized in that: Generating the health score of the system under test on the indicator under test according to the deviation degree includes: Obtaining the influence weight of the indicator to be measured on the operation of the system to be measured from a preset weight list; Generating the health score according to the deviation degree and the impact weight includes: ； in, refers to the health score, refers to the degree of deviation, , Refers to the influence weight.

6. The system abnormality monitoring method according to claim 1, characterized in that: The converting the indicator to be measured into a timing indicator to obtain a conversion relationship between the indicator to be measured and the timing indicator includes: Segment the indicator to be measured based on a preset time sequence vocabulary to obtain a plurality of indicator words; The indicator words that successfully match the preset time sequence words are determined as the conversion relationships, and the indicator words other than the conversion relationships are determined as the time sequence indicators.

7. The system abnormality monitoring method according to claim 1, wherein: The calling of the container plug-in corresponding to the timing indicator to collect the stored logs in the log storage directory to obtain the timing information corresponding to the timing indicator includes: Detecting whether the storage log matches the timing indicator based on the container plug-in; Determine a storage log that matches the time series indicator as a target log; Obtaining the log generation time of the target log from the log storage directory; The log identifier of the target log is converted into the time sequence information according to the order of the log generation time from smallest to largest.

8. A system abnormality monitoring device, characterized in that: The system abnormality monitoring device includes: an acquiring unit, configured to, upon receiving a system anomaly monitoring request, acquire a historical anomaly log of the system to be tested according to the system anomaly monitoring request; An analysis unit, configured to analyze the historical abnormality logs to obtain the test indicators of the system under test; a conversion unit, configured to convert the indicator to be measured into a time series indicator, and obtain a conversion relationship between the indicator to be measured and the time series indicator, wherein the time series indicator refers to an indicator associated with time; A locating unit, configured to locate the log storage directory of the system under test; A collection unit, configured to call a container plug-in corresponding to the timing indicator to collect the stored logs in the log storage directory, and obtain timing information corresponding to the timing indicator; a calculation unit, configured to calculate the time series information according to the conversion relationship to obtain indicator data corresponding to the indicator to be measured; A generating unit is used to generate monitoring results of the system to be tested based on the indicator data and a preset threshold.

9. An electronic device, characterized in that: The electronic device comprises: a memory storing computer-readable instructions; and A processor executes computer-readable instructions stored in the memory to implement the system abnormality monitoring method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions are executed by a processor in an electronic device to implement the system abnormality monitoring method according to any one of claims 1 to 7.

Images