Server alarm prediction method and device, computer device and storage medium

Abstract

The application relates to a server alarm prediction method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: obtaining server anomaly monitoring data in a first preset time period before a prediction time point for a target server running a target application; the server anomaly monitoring data comprises a server anomaly alarm number corresponding to at least one time point in the first preset time period; the server anomaly alarm number comprises an alarm number corresponding to at least one server anomaly type; inputting the server anomaly monitoring data into an application alarm prediction model to obtain an application anomaly alarm prediction probability at the prediction time point; if the application anomaly alarm prediction probability is greater than or equal to a preset alarm probability threshold, it is determined that an application anomaly alarm will be generated at the prediction time point. The method can accurately predict the application anomaly alarm in advance, and the monitoring effect of the server running the target application is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a server alarm prediction method and device, computer equipment, storage medium and computer program product. BACKGROUND

[0002] With the development and innovation of computer network technology, people's life and work are more and more inseparable from the support of computer technology. In order to provide a safe and stable application environment, it is necessary to monitor the key indicators in the server in real time through the monitoring system to ensure the security and high availability of the server.

[0003] However, in the process of monitoring the server in the prior art, only when the server is abnormal, the alarm information is generated, and the response cannot be made in time for the abnormality, thereby resulting in poor monitoring effect of the server. SUMMARY

[0004] Therefore, it is necessary to provide a server alarm prediction method and device, computer equipment, computer readable storage medium and computer program product capable of improving the server monitoring effect.

[0005] In a first aspect, the present application provides a server alarm prediction method. The method comprises:

[0006] For a target server running a target application, server abnormality monitoring data in a first preset time period before a prediction time point is obtained; the server abnormality monitoring data comprises a server abnormality alarm number corresponding to at least one time point in the first preset time period; the server abnormality alarm number comprises an alarm number corresponding to at least one server abnormality type;

[0007] The server abnormality monitoring data is input into an application alarm prediction model to obtain an application abnormality alarm prediction probability at the prediction time point; the application abnormality alarm prediction probability is a prediction probability of generating an alarm for the running state of the target application at the prediction time point;

[0008] If the application abnormality alarm prediction probability is greater than or equal to a preset alarm probability threshold, it is determined that an application abnormality alarm will be generated at the prediction time point; the application abnormality alarm is used to represent that the target application is in an application abnormality state at the prediction time point.

[0009] In one embodiment, the server abnormality monitoring data in the first preset time period before the prediction time point is obtained for the target server running the target application, comprising:

[0010] acquire a log file generated for a monitoring system; the monitoring system is a system for monitoring a running state of the target server;

[0011] determine the running state of the target server in the first preset time period according to time information of the log file;

[0012] when the running state of the target server is an abnormal state, determine the number of occurrences of a server abnormality alarm to obtain the number of server abnormality alarms; the server abnormality alarm is an alarm generated for the abnormal state;

[0013] determine the server abnormality monitoring data according to the number of server abnormality alarms.

[0014] In one embodiment, the determination of the running state of the target server in the first preset time period according to the time information of the log file comprises:

[0015] extract the naming suffix name of the log file to obtain the time information of the log file, and determine the actual completion time of the target application according to the time information; the actual completion time is determined according to the end time and the start time of the running of the target application;

[0016] if the actual completion time is greater than or equal to the preset completion time of the target application, it is determined that the running state of the target server is the abnormal state, and the server abnormality alarm is generated;

[0017] if the actual completion time is less than the preset completion time, it is determined that the running state of the target server is a normal state.

[0018] In one embodiment, if the actual completion time is greater than or equal to the preset completion time of the target application, it is determined that the running state of the target server is the abnormal state, and the server abnormality alarm is generated, comprising:

[0019] if the time difference between the actual completion time and the preset completion time is within a first preset time range, a first-level server abnormality alarm is generated;

[0020] if the time difference between the actual completion time and the preset completion time is within a second preset time range, a second-level server abnormality alarm is generated;

[0021] if the time difference between the actual completion time and the preset completion time is within a third preset time range, a third-level server abnormality alarm is generated;

[0022] The first-level server exception alarm, the second-level server exception alarm and the third-level server exception alarm are taken as the server exception alarm; the second-level server exception alarm corresponds to an exception level greater than that of the first-level server exception alarm and less than that of the third-level server exception alarm.

[0023] In one of the embodiments, the at least one server exception type includes memory usage rate exception, CPU utilization rate exception and network speed exception.

[0024] If the time difference between the actual completion time and the preset completion time is within a first preset time range, a first-level server exception alarm is generated, including:

[0025] If the time difference between the actual completion time and the preset completion time is within the first preset time range, a first-level memory usage rate exception alarm, a first-level CPU utilization rate exception alarm and a first-level network speed exception alarm are generated to obtain the first-level server exception alarm.

[0026] If the time difference between the actual completion time and the preset completion time is within a second preset time range, a second-level server exception alarm is generated, including:

[0027] If the time difference between the actual completion time and the preset completion time is within the second preset time range, a second-level memory usage rate exception alarm, a second-level CPU utilization rate exception alarm and a second-level network speed exception alarm are generated to obtain the second-level server exception alarm.

[0028] If the time difference between the actual completion time and the preset completion time is within a third preset time range, a third-level server exception alarm is generated, including:

[0029] If the time difference between the actual completion time and the preset completion time is within the third preset time range, a third-level memory usage rate exception alarm, a third-level CPU utilization rate exception alarm and a third-level network speed exception alarm are generated to obtain the third-level server exception alarm.

[0030] In one of the embodiments, if the application exception alarm prediction probability is greater than or equal to a preset alarm probability threshold, it is determined that an application exception alarm will be generated at the predicted time point, including:

[0031] if the application exception alarm prediction probability is greater than or equal to the preset alarm probability threshold, it is determined that an application runtime length exception alarm will be generated at the predicted time point; the application runtime length exception alarm is used to represent that an application runtime difference is greater than a preset time length threshold at the predicted time point; the application runtime difference is a time difference between a current application runtime length of the target application and an average application runtime length of a second preset time period;

[0032] and / or,

[0033] if the application exception alarm prediction probability is greater than or equal to the preset alarm probability threshold, it is determined that an application restart number exception alarm will be generated at the predicted time point; the application restart number exception alarm is used to represent that, after a restart mechanism of a scheduling submachine is started due to a running failure of the target application, a continuous restart number of tasks of the same submachine is greater than a preset number threshold; the submachine is used to execute a restart task of the target application;

[0034] the application runtime length exception alarm and the application restart number exception alarm are used as the application exception alarm.

[0035] In a second aspect, the present application further provides a server alarm prediction device. The device comprises:

[0036] an acquisition module, configured to acquire, for a target server running a target application, server exception monitoring data in a first preset time period before a predicted time point; the server exception monitoring data comprises a server exception alarm number corresponding to at least one time point in the first preset time period; the server exception alarm number comprises an alarm number corresponding to at least one server exception type;

[0037] an input module, configured to input the server exception monitoring data into an application alarm prediction model to obtain an application exception alarm prediction probability at the predicted time point; the application exception alarm prediction probability is a prediction probability of generating an alarm for a running state of the target application at the predicted time point;

[0038] a determination module, configured to, if the application exception alarm prediction probability is greater than or equal to a preset alarm probability threshold, determine that an application exception alarm will be generated at the predicted time point; the application exception alarm is used to represent that the target application is in an application exception state at the predicted time point.

[0039] In a third aspect, the present application further provides a computer device. The computer device comprises a memory and a processor; the memory stores a computer program; and the processor implements the following steps when executing the computer program:

[0040] The server exception monitoring data of a first preset time period before a prediction time point is obtained for a target server running a target application; the server exception monitoring data includes a server exception alarm number corresponding to at least one time point in the first preset time period; the server exception alarm number includes an alarm number corresponding to at least one server exception type;

[0041] The server exception monitoring data is input into an application alarm prediction model to obtain an application exception alarm prediction probability at the prediction time point; the application exception alarm prediction probability is a prediction probability of generating an alarm for a running state of the target application at the prediction time point;

[0042] If the application exception alarm prediction probability is greater than or equal to a preset alarm probability threshold, it is determined that an application exception alarm will be generated at the prediction time point; the application exception alarm is used to represent that the target application is in an application exception state at the prediction time point.

[0043] In a fourth aspect, the present application further provides a computer readable storage medium. The computer readable storage medium has a computer program stored thereon, and the computer program is executed by a processor to implement the following steps:

[0044] The server exception monitoring data of a first preset time period before a prediction time point is obtained for a target server running a target application; the server exception monitoring data includes a server exception alarm number corresponding to at least one time point in the first preset time period; the server exception alarm number includes an alarm number corresponding to at least one server exception type;

[0045] The server exception monitoring data is input into an application alarm prediction model to obtain an application exception alarm prediction probability at the prediction time point; the application exception alarm prediction probability is a prediction probability of generating an alarm for a running state of the target application at the prediction time point;

[0046] If the application exception alarm prediction probability is greater than or equal to a preset alarm probability threshold, it is determined that an application exception alarm will be generated at the prediction time point; the application exception alarm is used to represent that the target application is in an application exception state at the prediction time point.

[0047] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and the computer program is executed by a processor to implement the following steps:

[0048] The server anomaly monitoring data of a target server running a target application is obtained in a first preset time period before a prediction time point; the server anomaly monitoring data includes a server anomaly alarm number corresponding to at least one time point in the first preset time period; the server anomaly alarm number includes an alarm number corresponding to at least one server anomaly type;

[0049] The server anomaly monitoring data is input into an application alarm prediction model to obtain an application anomaly alarm prediction probability at the prediction time point; the application anomaly alarm prediction probability is a prediction probability of generating an alarm for the running state of the target application at the prediction time point;

[0050] If the application anomaly alarm prediction probability is greater than or equal to a preset alarm probability threshold, it is determined that an application anomaly alarm will be generated at the prediction time point; the application anomaly alarm is used to represent that the target application is in an application anomaly state at the prediction time point.

[0051] The server alarm prediction method, device, computer device, storage medium and computer program product described above, by obtaining the server anomaly monitoring data of a target server running a target application in a first preset time period before a prediction time point; wherein the server anomaly monitoring data includes a server anomaly alarm number corresponding to at least one time point in the first preset time period; wherein the server anomaly alarm number includes an alarm number corresponding to at least one server anomaly type; then, the server anomaly monitoring data is input into an application alarm prediction model to obtain an application anomaly alarm prediction probability generated for the running state of the target application at the prediction time point; finally, if the application anomaly alarm prediction probability is greater than or equal to a preset alarm probability threshold, it is determined that an application anomaly alarm will be generated at the prediction time point; wherein the application anomaly alarm is used to represent that the target application is in an application anomaly state at the prediction time point. In this way, by obtaining the server anomaly alarm number corresponding to at least one time point in the first preset time period before the prediction time point, and the server anomaly alarm number includes an alarm number corresponding to at least one server anomaly type, the data aggregation of the server alarm information is realized, avoiding inputting a large amount of redundant alarm information into the application alarm prediction model; and by obtaining the application anomaly alarm prediction probability based on the server anomaly monitoring data corresponding to the historical time points, it can be determined whether the target application will be abnormal at the prediction time point, so that the application anomaly alarm prediction can be accurately made in advance to respond to the abnormal state of the target application in time, and the monitoring effect of the server running the target application is further improved. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 It is a flowchart of a server alarm prediction method in one embodiment;

[0053] Figure 2 This is a flowchart illustrating the steps for obtaining server anomaly detection data in one embodiment;

[0054] Figure 3 This is a flowchart illustrating a server alarm prediction method in another embodiment;

[0055] Figure 4 This is a schematic diagram of the structure of the repeat module in the alarm prediction model in one embodiment;

[0056] Figure 5 This is a schematic diagram of the forget gate structure in an alarm prediction model applied in one embodiment;

[0057] Figure 6(a) is a schematic diagram of the input gate structure in an alarm prediction model applied in one embodiment;

[0058] Figure 6(b) is another structural schematic diagram of the input gate in the alarm prediction model applied in one embodiment;

[0059] Figure 7 This is a schematic diagram of the output gate structure in an alarm prediction model applied in one embodiment;

[0060] Figure 8 This is a structural block diagram of a server alarm prediction device in one embodiment;

[0061] Figure 9 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0063] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein.

[0064] In one embodiment, such as Figure 1 As shown, a server alarm prediction method is provided. Taking the application of this method to a computer device as an example, the computer device can be a terminal, an independent server, or a server cluster composed of multiple servers. The method includes:

[0065] In step S110, server anomaly monitoring data in a first preset time period before the prediction time point is obtained for the target server running the target application.

[0066] The server anomaly monitoring data includes a server anomaly alarm number corresponding to at least one time point in the first preset time period.

[0067] The server anomaly alarm number includes an alarm number corresponding to at least one server anomaly type.

[0068] The server anomaly type can include, but is not limited to, memory anomaly, CPU (central processing unit) anomaly, and network speed anomaly.

[0069] The prediction time point can be any time point after the first preset time period.

[0070] In a specific implementation, the computer device can obtain server anomaly monitoring data in a first preset time period before a prediction time point for a target server running a target application. The server anomaly monitoring data includes a server anomaly alarm number corresponding to at least one time point in the first preset time period, and the server anomaly alarm number includes an alarm number corresponding to at least one server anomaly type, such as an alarm number corresponding to a memory anomaly, an alarm number corresponding to a CPU anomaly, and an alarm number corresponding to a network speed anomaly.

[0071] In actual application, the first preset time period can be a preset continuous time period, such as 10 consecutive minutes from the current time. The prediction time point can be any time point after the first preset time period, such as the 21st minute from the current time. In the process of obtaining the server anomaly monitoring data in the first preset time period, the computer device can directly obtain the server anomaly monitoring data corresponding to each time point in the first preset time period. For example, if the first preset time period is 10 consecutive minutes from the current time, the server anomaly monitoring data corresponding to each time point can be the server anomaly monitoring data corresponding to each minute in the 10 consecutive minutes, so as to realize minute-level data aggregation of the server anomaly monitoring data in the first preset time period.

[0072] In step S120, the server anomaly monitoring data is input into an application alarm prediction model to obtain an application anomaly alarm prediction probability at the prediction time point.

[0073] The application anomaly alarm prediction probability is a prediction probability of generating an alarm for the running state of the target application at the prediction time point.

[0074] The application alarm prediction model can include an input LSTM (Long Short-Term Memory) layer, a dropout layer, a full connection layer, and an output layer.

[0075] In a specific application, the computer device can input the server anomaly monitoring data in the first preset time period before the prediction time point into the pre-trained application alarm prediction model, and obtain the prediction probability of generating an alarm for the running state of the target application at the prediction time point according to the output of the output layer of the pre-trained application alarm prediction model, that is, the application anomaly alarm prediction probability at the prediction time point.

[0076] In actual application, the computer device can perform standardization processing on the server anomaly monitoring data in advance to obtain the server anomaly monitoring data after standardization processing, and then input the server anomaly monitoring data after standardization processing into the pre-trained application alarm prediction model.

[0077] The specific formula of the standardization processing is as follows:

[0078] X* = (x - μ) / σ

[0079] X* represents the server anomaly monitoring data after standardization processing; x represents the server anomaly monitoring data; μ represents the mean; and σ represents the standard deviation.

[0080] In step S130, if the application anomaly alarm prediction probability is greater than or equal to the preset alarm probability threshold, it is determined that an application anomaly alarm will be generated at the prediction time point.

[0081] The application anomaly alarm is used to represent that the target application is in an application anomaly state at the prediction time point.

[0082] In a specific implementation, after determining the application anomaly alarm prediction probability at the prediction time point, the computer device can determine whether an application anomaly alarm will be generated at the prediction time point according to the application anomaly alarm prediction probability. Specifically, if the computer device determines that the application anomaly alarm prediction probability is greater than or equal to the preset alarm probability threshold, it is determined that the target application will be in an application anomaly state at the prediction time point, and an application anomaly alarm corresponding to the application anomaly state will be generated.

[0083] The server alarm prediction method comprises the following steps: obtaining server abnormality monitoring data in a first preset time period before a prediction time point for a target server running a target application, wherein the server abnormality monitoring data comprises a server abnormality alarm number corresponding to at least one time point in the first preset time period, and the server abnormality alarm number comprises an alarm number corresponding to at least one server abnormality type; inputting the server abnormality monitoring data into an application alarm prediction model to obtain an application abnormality alarm prediction probability generated for a running state of the target application at the prediction time point; and determining that an application abnormality alarm will be generated at the prediction time point if the application abnormality alarm prediction probability is greater than or equal to a preset alarm probability threshold, wherein the application abnormality alarm is used to represent that the target application is in an application abnormality state at the prediction time point. In this way, the server alarm information data aggregation is realized by obtaining the server abnormality alarm number corresponding to at least one time point in the first preset time period before the prediction time point, and the server abnormality alarm number comprises the alarm number corresponding to at least one server abnormality type, so that a large amount of redundant alarm information is avoided from being input into the application alarm prediction model. The application abnormality alarm prediction probability obtained based on the server abnormality monitoring data corresponding to the historical time point can be used to determine whether the target application will be abnormal at the prediction time point, so that the application abnormality alarm prediction can be accurately performed in advance to realize the response to the abnormal state of the target application in time, and the monitoring effect of the server running the target application is further improved.

[0084] In another embodiment, as shown in FIG. 1 1, Figure 2 Step S110 comprises:

[0085] Step S210, obtaining a log file generated for a monitoring system.

[0086] The monitoring system is a system for monitoring the running state of the target server, and can include but is not limited to a system monitoring system, a network monitoring system, a hardware monitoring system, and an application monitoring system.

[0087] In a specific implementation, in the process of obtaining the server abnormality monitoring data in the first preset time period before the prediction time point, the computer device can obtain log files generated by various monitoring systems for monitoring the running state of the target server, such as log files generated by a system monitoring system, log files generated by a network monitoring system, log files generated by a hardware monitoring system, and log files generated by an application monitoring system.

[0088] Step S220, determining the running state of the target server in the first preset time period according to the time information of the log file.

[0089] In specific implementation, the computer device can determine the actual completion time of each running of the target application according to the time information carried by the log file, and determine the running state of the target server running the target application in the first preset time period according to the difference between the actual completion time of each running of the target application and the preset completion time.

[0090] In step S230, when the running state of the target server is the abnormal state, the number of occurrences of the server abnormal alarm is determined to obtain the server abnormal alarm number.

[0091] The server abnormal alarm is an alarm generated for the abnormal state.

[0092] In specific implementation, if the computer device determines that the running state of the target server in the first preset time period is the abnormal state according to the difference between the actual completion time of each running of the target application and the preset completion time, then the number of occurrences of the server abnormal alarm corresponding to different server abnormal types is determined according to the server abnormal alarm generated based on the abnormal state to obtain the server abnormal alarm number.

[0093] In step S240, the server abnormal monitoring data is determined according to the server abnormal alarm number.

[0094] In specific implementation, the computer device can determine the server abnormal monitoring data according to the number of occurrences of the server abnormal alarm corresponding to different server abnormal types at each time point in the first preset time period.

[0095] The technical scheme of the embodiment, by obtaining the log file generated by the monitoring system for monitoring the running state of the target server, and determining the running state of the target server in the first preset time period according to the time information of the log file, when the running state of the target server is the abnormal state, the number of occurrences of the server abnormal alarm generated for the abnormal state is determined to obtain the server abnormal alarm number, in this way, the server abnormal monitoring data can be determined according to the above-mentioned server abnormal alarm number; accurate determination of the number of server abnormal alarms corresponding to different server abnormal types based on the time information carried by the log file generated by the monitoring system is realized, so that the server abnormal monitoring data in the first preset time period can be accurately obtained according to the server abnormal alarm number.

[0096] In another embodiment, according to the time information of the log file, the running state of the target server in the first preset time period is determined, including: extracting the naming suffix name of the log file to obtain the time information of the log file, and determining the actual completion time of the target application according to the time information; if the actual completion time is greater than or equal to the preset completion time of the target application, it is determined that the running state of the target server is an abnormal state, and a server abnormality alarm is generated; if the actual completion time is less than the preset completion time, it is determined that the running state of the target server is a normal state.

[0097] The actual completion time is determined according to the end time and the start time of the current running of the target application.

[0098] In a specific implementation, after the computer device obtains the log file generated by the monitoring system for monitoring the running state of the target server, the naming suffix name of the log file generated by the monitoring system can be extracted to obtain the time information of the log file, so that the actual completion time of the target application can be determined according to the time information of the log file; wherein the actual completion time of the target application is determined according to the end time and the start time of the current running of the target application. In actual application, the actual completion time of the target application can be determined according to the time information carried by the log file generated by the application monitoring system.

[0099] When the computer device determines that the actual completion time of the target application is greater than or equal to the preset completion time of the target application, it is determined that the running state of the target server is an abnormal state, and a server abnormality alarm corresponding to different server abnormality types is generated; when the computer device determines that the actual completion time of the target application is less than the preset completion time of the target application, it is determined that the running state of the target server is a normal state, and no server abnormality alarm is generated; wherein the preset completion time of the target application can be obtained based on testing of different data amounts in different dimensions of the target server, such as memory usage rate dimension, CPU utilization rate dimension, and network speed dimension. In actual application, different levels of server abnormality alarms can also be set according to the time difference between the actual completion time of the target application and the preset completion time of the target application.

[0100] The technical scheme of the embodiment extracts the naming suffix name of the log file to obtain time information of the log file, and determines the actual completion time of the target application according to the time information; if the actual completion time is greater than or equal to the preset completion time of the target application, it is determined that the running state of the target server is an abnormal state, and a server exception alarm is generated; if the actual completion time is less than the preset completion time, it is determined that the running state of the target server is a normal state; in this way, whether the running state of the target server is an abnormal state can be determined based on the actual completion time of the target application and the preset completion time of the target application, so that the server exception alarm can be accurately generated for the abnormal state of the target server, which is beneficial to accurately determining the number of server exception alarms.

[0101] In another embodiment, if the actual completion time is greater than or equal to the preset completion time of the target application, it is determined that the running state of the target server is an abnormal state, and a server exception alarm is generated, including: if the time difference between the actual completion time and the preset completion time is within a first preset time range, a first-level server exception alarm is generated; if the time difference between the actual completion time and the preset completion time is within a second preset time range, a second-level server exception alarm is generated; if the time difference between the actual completion time and the preset completion time is within a third preset time range, a third-level server exception alarm is generated; the first-level server exception alarm, the second-level server exception alarm and the third-level server exception alarm are taken as the server exception alarm.

[0102] Among them, the abnormal level corresponding to the second-level server exception alarm is greater than the abnormal level corresponding to the first-level server exception alarm, and less than the abnormal level corresponding to the third-level server exception alarm.

[0103] Among them, the first-level server exception alarm can also be named as the primary server exception alarm in actual application; the second-level server exception alarm can also be named as the intermediate server exception alarm in actual application; the third-level server exception alarm can also be named as the high-level server exception alarm in actual application.

[0104] Among them, at least one server exception type includes memory usage rate exception, CPU utilization rate exception and network speed exception.

[0105] Among them, if the time difference between the actual completion time and the preset completion time is within a first preset time range, a first-level memory usage rate exception alarm, a first-level CPU utilization rate exception alarm and a first-level network speed exception alarm are generated to obtain a first-level server exception alarm.

[0106] If the time difference between the actual completion time and the preset completion time is within a second preset time range, a second-level memory usage abnormality alarm, a second-level CPU utilization abnormality alarm and a second-level network speed abnormality alarm are generated to obtain a second-level server abnormality alarm.

[0107] If the time difference between the actual completion time and the preset completion time is within a third preset time range, a third-level memory usage abnormality alarm, a third-level CPU utilization abnormality alarm and a third-level network speed abnormality alarm are generated to obtain a third-level server abnormality alarm.

[0108] In a specific implementation, after determining the actual completion time of the target application, the computer device can determine the time difference between the preset completion time and the actual completion time of the target application, which can be specifically the time delay in seconds generated by the preset completion time and the actual completion time of the target application, and determine whether the running state of the target server is an abnormal state, so as to determine whether to generate a server abnormality alarm.

[0109] When the time difference between the preset completion time and the actual completion time of the target application is within a first preset time range, a first-level server abnormality alarm is generated; the first-level server abnormality alarm can include alarm information corresponding to different server abnormality types, such as a first-level memory usage abnormality alarm, a first-level CPU utilization abnormality alarm and a first-level network speed abnormality alarm.

[0110] When the time difference between the preset completion time and the actual completion time of the target application is within a second preset time range, a second-level server abnormality alarm is generated; the second-level server abnormality alarm can include alarm information corresponding to different server abnormality types, such as a second-level memory usage abnormality alarm, a second-level CPU utilization abnormality alarm and a second-level network speed abnormality alarm.

[0111] When the time difference between the preset completion time and the actual completion time of the target application is within a third preset time range, a third-level server abnormality alarm is generated; the third-level server abnormality alarm can include alarm information corresponding to different server abnormality types, such as a third-level memory usage abnormality alarm, a third-level CPU utilization abnormality alarm and a third-level network speed abnormality alarm.

[0112] When the time difference between the preset completion time and the actual completion time of the target application exceeds the third preset time range, that is, exceeds the preset time delay tolerance threshold, it is determined that the current system environment of the target server is insufficient to support the good running of the target application.

[0113] The abnormality level corresponding to the second-level server abnormality alarm is greater than the abnormality level corresponding to the first-level server abnormality alarm and less than the abnormality level corresponding to the third-level server abnormality alarm. Therefore, the time threshold corresponding to the first-level server abnormality alarm, the time threshold corresponding to the second-level server abnormality alarm, and the time threshold corresponding to the third-level server abnormality alarm increase step by step. For example, the first preset time length range can be 0-20 seconds, the second preset time length range can be 20-40 seconds, and the third preset time length range can be 40-60 seconds.

[0114] In this way, the computer device can regard the first-level server abnormality alarm, the second-level server abnormality alarm, and the third-level server abnormality alarm as server abnormality alarms. Different levels of server abnormality alarms include alarm information corresponding to different server abnormality types. Therefore, the server abnormality monitoring data in the first preset time period at least includes alarm times corresponding to the first-level memory usage abnormality alarm, the first-level CPU utilization abnormality alarm, the first-level network speed abnormality alarm, the second-level memory usage abnormality alarm, the second-level CPU utilization abnormality alarm, the second-level network speed abnormality alarm, the third-level memory usage abnormality alarm, the third-level CPU utilization abnormality alarm, and the third-level network speed abnormality alarm at at least one time point in the first preset time period. Preferably, the server abnormality monitoring data in the first preset time period can be alarm times corresponding to the above nine types of server abnormality alarms at each time point in the first preset time period, such as alarm times corresponding to the above nine types of server abnormality alarms at each minute in the first preset time period.

[0115] In actual applications, the memory usage abnormality threshold, the CPU utilization abnormality threshold, and the network speed abnormality threshold can be obtained by testing the target server in different dimensions with different data volumes. Specifically, when the time difference between the actual completion time of the application and the preset completion time exceeds or reaches 60 seconds, it is considered that the time difference exceeds the maximum delay tolerance limit (i.e., the preset delay tolerance threshold). Therefore, it is determined that the current system environment is insufficient to support the good operation of the application. Therefore, the time difference of 60 seconds can be regarded as the maximum delay tolerance limit.

[0116] In the abnormal threshold setting process for the memory usage rate exception, the average memory usage rate of the server is 84% when the first preset time range is 0-20 seconds, i.e., the time difference between the actual completion time of the application and the preset completion time is greater than or equal to 0 seconds and less than 20 seconds; the average memory usage rate of the server is 87% when the second preset time range is 20-40 seconds, i.e., the time difference between the actual completion time of the application and the preset completion time is greater than or equal to 20 seconds and less than 40 seconds; and the average memory usage rate of the server is 91% when the third preset time range is 40-60 seconds, i.e., the time difference between the actual completion time of the application and the preset completion time is greater than or equal to 40 seconds and less than 60 seconds.

[0117] In the abnormal threshold setting process for the CPU utilization rate exception, the average CPU utilization rate of the server is 65% when the first preset time range is 0-20 seconds, i.e., the time difference between the actual completion time of the application and the preset completion time is greater than or equal to 0 seconds and less than 20 seconds; the average CPU utilization rate of the server is 67% when the second preset time range is 20-40 seconds, i.e., the time difference between the actual completion time of the application and the preset completion time is greater than or equal to 20 seconds and less than 40 seconds; and the average CPU utilization rate of the server is 70% when the third preset time range is 40-60 seconds, i.e., the time difference between the actual completion time of the application and the preset completion time is greater than or equal to 40 seconds and less than 60 seconds.

[0118] In the abnormal threshold setting process for the network speed exception, the average network speed of the server is 162 k / s when the first preset time range is 0-20 seconds, i.e., the time difference between the actual completion time of the application and the preset completion time is greater than or equal to 0 seconds and less than 20 seconds; the average network speed of the server is 127 k / s when the second preset time range is 20-40 seconds, i.e., the time difference between the actual completion time of the application and the preset completion time is greater than or equal to 20 seconds and less than 40 seconds; and the average network speed of the server is 73 k / s when the third preset time range is 40-60 seconds, i.e., the time difference between the actual completion time of the application and the preset completion time is greater than or equal to 40 seconds and less than 60 seconds.

[0119] It can be understood that the preset delay tolerance threshold can also be other time, and therefore the first preset time range, the second preset time range and the third preset time range are not limited to the above settings; in addition, a person skilled in the art can also set different preset time ranges according to actual needs to obtain more or less levels of server anomaly alarms, and are not limited to the above three levels of server anomaly alarms.

[0120] The technical scheme of the embodiment, if the time difference between the actual completion time and the preset completion time is within the first preset time range, generates a first-level memory usage rate anomaly alarm, a first-level CPU utilization rate anomaly alarm and a first-level network speed anomaly alarm to obtain a first-level server anomaly alarm; if the time difference between the actual completion time and the preset completion time is within the second preset time range, generates a second-level memory usage rate anomaly alarm, a second-level CPU utilization rate anomaly alarm and a second-level network speed anomaly alarm to obtain a second-level server anomaly alarm; if the time difference between the actual completion time and the preset completion time is within the third preset time range, generates a third-level memory usage rate anomaly alarm, a third-level CPU utilization rate anomaly alarm and a third-level network speed anomaly alarm to obtain a third-level server anomaly alarm; in this way, the first-level server anomaly alarm, the second-level server anomaly alarm and the third-level server anomaly alarm can be used as the server anomaly alarm, so that the server anomaly monitoring data input to the application alarm prediction model is different types of server anomaly alarm information that directly affect the running of the target application, without the need to input all server anomaly type corresponding anomaly alarm information, thereby realizing the redundancy of the server alarm information; and since the server anomaly monitoring data contains different dimensions and different levels of server anomaly alarm times, more comprehensive server anomaly monitoring data can be input to the application alarm prediction model, and more accurate application anomaly alarm prediction results can be obtained.

[0121] In another embodiment, if the application anomaly alarm prediction probability is greater than or equal to the preset alarm probability threshold, it is determined that an application anomaly alarm will be generated at the predicted time point, including: if the application anomaly alarm prediction probability is greater than or equal to the preset alarm probability threshold, it is determined that an application running time length anomaly alarm will be generated at the predicted time point; and / or, if the application anomaly alarm prediction probability is greater than or equal to the preset alarm probability threshold, it is determined that an application restart number anomaly alarm will be generated at the predicted time point; the application running time length anomaly alarm and the application restart number anomaly alarm are used as the application anomaly alarm.

[0122] The application running time length anomaly alarm is used to represent that the application running time difference at the predicted time point is greater than the preset time threshold; the application running time difference is the time difference between the current application running time length of the target application and the average application running time length of the second preset time period.

[0123] The application restart number of times abnormal alarm is used to represent that when the target application fails to run, the task of the same submachine is restarted for more than a preset number of times threshold after starting the submachine restart mechanism.

[0124] The submachine is used to execute the restart task of the target application.

[0125] In the specific implementation, the application abnormal alarm includes an application running time length abnormal alarm and an application restart number of times abnormal alarm. When the application running time length of the target application is abnormal and / or the application restart number of times of the target application is abnormal, the application abnormal alarm is generated. Specifically, if the application abnormal alarm prediction probability is greater than or equal to a preset alarm probability threshold, the computer device can determine that the time difference between the current application running time length of the target application at the prediction time point and the average application running time length of the second preset time period will be greater than a preset time length threshold, and the application running time length abnormal alarm will be generated at the prediction time point.

[0126] In actual application, the average application running time length of the second preset time period can be the average application running time length of the past N historical days, such as the average application running time length of the past 30 days; and the preset time length threshold can be 60 seconds, which is not limited herein.

[0127] Further, if the application abnormal alarm prediction probability is greater than or equal to the preset alarm probability threshold, the computer device can determine that the target application fails to run and starts the submachine restart mechanism at the prediction time point, and the task of the same submachine is restarted for more than a preset number of times threshold, and the application restart number of times abnormal alarm will be generated at the prediction time point. Specifically, when the application fails to run, the task restart mechanism is started, and the task restart mechanism has a corresponding task restart number of times threshold. When the task restart number of times exceeds the task restart number of times threshold, the submachine restart mechanism is started, and the restart task of the application is redistributed to other submachines for execution through the submachine restart mechanism. The submachine restart mechanism has a corresponding submachine restart number of times threshold. When the submachine restart number of times exceeds the submachine restart number of times threshold, the application fails to run. If the task of the same submachine is restarted for more than a preset number of times threshold, it is determined that the application restart number of times is abnormal, and the application restart number of times abnormal alarm is generated.

[0128] The preset alarm probability threshold can be 0.5, the preset number of times threshold can be 8 times, the task restart number of times threshold can be 4 times, and the submachine restart number of times threshold can be 3 times, which are not limited herein.

[0129] The technical solution of the embodiment can determine that an application runtime length abnormality alarm will be generated at the predicted time point if the application abnormality alarm prediction probability is greater than or equal to the preset alarm probability threshold, and / or determine that an application restart number abnormality alarm will be generated at the predicted time point if the application abnormality alarm prediction probability is greater than or equal to the preset alarm probability threshold. The application runtime length abnormality alarm and the application restart number abnormality alarm are used as the application abnormality alarm. In this way, whether the application abnormality alarm prediction probability is greater than or equal to the preset alarm probability threshold can be determined based on the application abnormality alarm prediction probability output by the application alarm prediction model, so that whether the application runtime length abnormality alarm and / or the application restart number abnormality alarm, that is, the application abnormality alarm, will be generated at the predicted time point can be determined. The application abnormality alarm can be predicted in advance and accurately, so that the abnormal state of the target application can be responded to in a timely manner, and the monitoring effect of the server running the target application is improved.

[0130] In another embodiment, as shown in Figure 3 a server alarm prediction method is provided, comprising the following steps:

[0131] In step S310, a log file generated for a monitoring system is obtained. The monitoring system is a system for monitoring the running state of a target server running a target application.

[0132] In step S320, a naming suffix name of the log file is extracted to obtain time information of the log file, and the actual completion time of the target application is determined according to the time information.

[0133] In step S330, if the actual completion time is greater than or equal to a preset completion time of the target application, it is determined that the running state of the target server is an abnormal state, and a server abnormality alarm is generated.

[0134] In step S340, the number of occurrences of the server abnormality alarm is determined to obtain a server abnormality alarm number.

[0135] In step S350, server abnormality monitoring data is determined according to the server abnormality alarm number.

[0136] In step S360, the server abnormality monitoring data is input into an application alarm prediction model to obtain an application abnormality alarm prediction probability at a predicted time point.

[0137] In step S370, if the application abnormality alarm prediction probability is greater than or equal to a preset alarm probability threshold, it is determined that an application runtime length abnormality alarm and / or an application restart number abnormality alarm will be generated at the predicted time point.

[0138] It should be noted that the specific limitations of the above steps can be referred to the specific limitations of the server alarm prediction method described above.

[0139] In an application example, a structure of an application alarm prediction model is provided, which comprises the following layers in sequence: an input layer LSTM layer, a first dropout layer, a first full connection layer, a second dropout layer, a second full connection layer, a third dropout layer, a third full connection layer, a fourth dropout layer, a fourth full connection layer, and an output layer. The input layer LSTM layer, the first full connection layer, the second full connection layer, the third full connection layer, the fourth full connection layer, and the output layer each have a corresponding number of neurons, and the number of neurons can be set by a user or selected by a grid search method. The method of setting the number of neurons and the specific number are not limited herein. The first dropout layer, the second dropout layer, the third dropout layer, and the fourth dropout layer each have a corresponding preset parameter, which is used to determine the probability of neurons being retained in the neural network.

[0140] In actual application, the number of neurons of the input layer LSTM layer can be 800; the first preset parameter corresponding to the first dropout layer can be 0.5; the number of neurons of the first full connection layer can be 1000; the second preset parameter corresponding to the second dropout layer can be 0.8; the number of neurons of the second full connection layer can be 1200; the third preset parameter corresponding to the third dropout layer can be 0.8; the number of neurons of the third full connection layer can be 1000; the fourth preset parameter corresponding to the fourth dropout layer can be 0.8; the number of neurons of the fourth full connection layer can be 800; and the number of neurons of the output layer can be 1.

[0141] In the training process of the application alarm prediction model having the above-mentioned layer structure, 100,000 training data samples can be divided into a training set and a validation set according to a 7:3 ratio. The application alarm prediction model is trained by using the training set and the accuracy of the application alarm prediction model is verified by using the validation set. Binary cross-entropy (binary_crossentropy) can be selected as the loss function. In the training process, if an application runtime abnormal alarm or an application restart number abnormal alarm occurs in a certain minute, it is determined that an application abnormal alarm occurs in the current minute, and is marked as 1, otherwise, it is marked as 0. When the preset alarm probability threshold is set to 0.5, if the application abnormal alarm prediction probability is greater than or equal to 0.5, it is determined that the prediction is a positive judgment, and it is predicted that an application abnormal alarm will be generated at the prediction time point. The verification accuracy of the application alarm prediction model is 95%.

[0142] For the convenience of those skilled in the art, Figure 4 A structural diagram of a certain repetitive module in the input layer LSTM layer is provided. The input layer LSTM layer comprises a plurality of repetitive modules (i.e.Figure 4 The repeating module is used to cyclically process the server anomaly monitoring data of the preset time period according to the long-term memory characteristics of the LSTM layer. Wherein, σ represents a sigmoid activation function, tanh represents a tanh activation function, x t-1 represents input data of a t-1 time period, x t represents input data of a t time period, x t+1 represents input data of a t+1 time period, h t-1 represents output data of a t-1 time period, h t represents output data of a t time period, h t+1 represents output data of a t+1 time period.

[0143] Each repeating module in the LSTM layer includes a forget gate, an input gate, and an output gate. The forget gate determines the information that needs to be discarded from the previous repeating module through a forget gate parameter. For example, the forget gate parameter calculation formula is as follows:

[0144] f t = σ (W f *[h t-1 , x t ]+b f )

[0145] Wherein, f t represents a forget gate parameter of a t time period (size is between 0-1, 1 represents "complete retention", and 0 represents "complete discard), W f is a weight matrix of the forget gate parameter, and b f represents a bias term of the forget gate parameter. In order to facilitate those skilled in the art to understand, Figure 5 a structural diagram of the forget gate is provided.

[0146] The input gate determines the information stored in the state of the repeating module through an input gate parameter, and the input gate parameter is composed of two parts. One part is composed of a sigmoid function σ, which is used to determine the information that needs to be updated; the other part is composed of a tanh function, which is used to determine the alternative update information to be stored in the state. The input gate parameter calculation formula is as follows:

[0147] i t = σ (W i *[h t-1 , x t ]+b i )

[0148]

[0149] Wherein, it and two-part parameter representing the input gate parameter of the t-th time period, W i weight matrix of the input gate parameter i t bias term of the input gate parameter i i weight matrix of the input gate parameter i t bias term of the input gate parameter i c weight matrix of the input gate parameter bias term of the input gate parameter C weight matrix of the input gate parameter bias term of the input gate parameter.

[0150] The cell state of one time period of the output of the repetition module is determined by the forget gate parameter and the input gate parameter, and the calculation formula of the cell state is as follows:

[0151]

[0152] wherein C t represents the cell state of the repetition module in the t-th time period, C t-1 represents the cell state of the repetition module in the t-1-th time period. In order to facilitate those skilled in the art to understand, FIG. 6(a) and FIG. 6(b) provide a structural schematic diagram of the input gate.

[0153] The output gate determines the output of the repetition module through the output gate parameter, and the output gate parameter is also composed of a sigmoid function, and the specific calculation formula is as follows:

[0154] o t = σ(W o [h t-1 , x t ]+b o )

[0155] wherein o t represents the output gate parameter of the repetition module in the t-th time period, which determines how much cell state information is retained in the t-th time period, and the value is 0-1, 0 indicates complete discard, and 1 represents complete retention, W o represents the weight matrix of the output gate parameter, and b o represents the bias term of the output gate parameter.

[0156] The final output value of the repetition module is determined by the output gate and the cell state, and the calculation formula of the final output value is as follows:

[0157] h t = o t *tanh(C t )

[0158] wherein h tThe final output value of the repetition module in the t th time period can be used to represent the output hidden state of the t th time period. For the convenience of those skilled in the art, Figure 7 A structural diagram of the output gate is provided.

[0159] The technical scheme of the embodiment sets corresponding parameters for each layer structure in the application alarm prediction model to be trained, and divides a large number of training data samples into a training set and a verification set according to a certain proportion to train the application alarm prediction model to be trained, so that the prediction accuracy of the application alarm prediction model can be improved.

[0160] It should be understood that, although each step in the flowchart involved in each embodiment as described above is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0161] Based on the same inventive concept, the embodiments of the present application also provide a server alarm prediction device for implementing the above-mentioned server alarm prediction method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more server alarm prediction device embodiments provided below can refer to the limitations of the server alarm prediction method in the above text, and will not be repeated here.

[0162] In one embodiment, as shown in Figure 8 A server alarm prediction device is provided, comprising: an acquisition module 810, an input module 820, and a determination module 830, wherein:

[0163] The acquisition module 810 is configured to acquire, for a target server running a target application, server anomaly monitoring data in a first preset time period before a prediction time point; the server anomaly monitoring data includes a server anomaly alarm number corresponding to at least one time point in the first preset time period; and the server anomaly alarm number includes an alarm number corresponding to at least one server anomaly type.

[0164] The input module 820 is configured to input the server exception monitoring data into an application alarm prediction model to obtain an application exception alarm prediction probability at the prediction time point. The application exception alarm prediction probability is a prediction probability of generating an alarm for a running state of the target application at the prediction time point.

[0165] The determination module 830 is configured to determine that an application exception alarm will be generated at the prediction time point if the application exception alarm prediction probability is greater than or equal to a preset alarm probability threshold. The application exception alarm is used to represent that the target application is in an application exception state at the prediction time point.

[0166] In one of the embodiments, the obtaining module 810 is specifically configured to obtain a log file generated for a monitoring system. The monitoring system is a system for monitoring a running state of the target server. The running state of the target server in the first preset time period is determined according to time information of the log file. When the running state of the target server is an exception state, the number of occurrences of a server exception alarm is determined to obtain the server exception alarm number. The server exception alarm is an alarm generated for the exception state. The server exception monitoring data is determined according to the server exception alarm number.

[0167] In one of the embodiments, the obtaining module 810 is specifically configured to extract a naming suffix name of the log file to obtain time information of the log file, and determine an actual completion time of the target application according to the time information. The actual completion time is determined according to an end time and a start time of a current running of the target application. If the actual completion time is greater than or equal to a preset completion time of the target application, it is determined that the running state of the target server is the exception state, and the server exception alarm is generated. If the actual completion time is less than the preset completion time, it is determined that the running state of the target server is a normal state.

[0168] In one of the embodiments, the obtaining module 810 is specifically configured to generate a first-level server exception alarm if a time difference between the actual completion time and the preset completion time is within a first preset time range. A second-level server exception alarm is generated if the time difference between the actual completion time and the preset completion time is within a second preset time range. A third-level server exception alarm is generated if the time difference between the actual completion time and the preset completion time is within a third preset time range. The first-level server exception alarm, the second-level server exception alarm, and the third-level server exception alarm are used as the server exception alarm.

[0169] In one of the embodiments, the at least one server exception type includes a memory usage rate exception, a CPU utilization rate exception, and a network speed exception; the obtaining module 810 is specifically configured to generate a first-level memory usage rate exception alarm, a first-level CPU utilization rate exception alarm, and a first-level network speed exception alarm to obtain the first-level server exception alarm if the time difference between the actual completion time and the preset completion time is within the first preset time range; generate a second-level memory usage rate exception alarm, a second-level CPU utilization rate exception alarm, and a second-level network speed exception alarm to obtain the second-level server exception alarm if the time difference between the actual completion time and the preset completion time is within the second preset time range; and generate a third-level memory usage rate exception alarm, a third-level CPU utilization rate exception alarm, and a third-level network speed exception alarm to obtain the third-level server exception alarm if the time difference between the actual completion time and the preset completion time is within the third preset time range.

[0170] In one of the embodiments, the determining module 830 is specifically configured to determine that an application runtime length exception alarm will be generated at the predicted time point if the application exception alarm prediction probability is greater than or equal to the preset alarm probability threshold; the application runtime length exception alarm is used to represent that an application runtime difference is greater than a preset time threshold at the predicted time point; the application runtime difference is a time difference between a current application runtime length of the target application and an average application runtime length of a second preset time period; and / or determine that an application restart number exception alarm will be generated at the predicted time point if the application exception alarm prediction probability is greater than or equal to the preset alarm probability threshold; the application restart number exception alarm is used to represent that a continuous restart number of a task of a same submachine is greater than a preset number threshold after a restart mechanism of the submachine is started to restart the target application; the submachine is used to execute a restart task of the target application; and the application runtime length exception alarm and the application restart number exception alarm are used as the application exception alarm.

[0171] The above-mentioned modules in the server alarm prediction apparatus can be all or partially realized by software, hardware, and a combination thereof. The above-mentioned modules can be embedded in or independent of a processor in a computer device in a hardware form, or can be stored in a memory in a computer device in a software form, so as to be called and executed by a processor to perform operations corresponding to the above-mentioned modules.

[0172] In one embodiment, a computer device, which can be a server, is provided, and an internal structure diagram of the computer device can be as shown in FIG. 1. Figure 9As shown in the figure. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store server anomaly monitoring data. The network interface of the computer device is used to communicate with external terminals through network connection. The computer program is executed by the processor to implement a server alarm prediction method.

[0173] Those skilled in the art can understand that, Figure 9 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0174] In one embodiment, a computer device is also provided, including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps in each of the method embodiments described above.

[0175] In one embodiment, a computer readable storage medium is provided, which stores a computer program, and the computer program is executed by a processor to implement the steps in each of the method embodiments described above.

[0176] In one embodiment, a computer program product is provided, which includes a computer program, and the computer program is executed by a processor to implement the steps in each of the method embodiments described above.

[0177] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties.

[0178] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric memory (Ferroelectric Random Access Memory, FRAM), phase change memory (Phase Change Memory, PCM), graphene memory, etc. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0179] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0180] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be noted that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A server alarm prediction method, characterized in that, The method includes: For a target server running a target application, acquire server anomaly monitoring data for a first preset time period prior to the predicted time point; the server anomaly monitoring data includes the number of server anomaly alarms corresponding to at least one time point in the first preset time period; the number of server anomaly alarms includes the number of alarms corresponding to at least one type of server anomaly. The server anomaly monitoring data is input into the application alarm prediction model to obtain the application anomaly alarm prediction probability at the prediction time point; the application anomaly alarm prediction probability is the prediction probability of generating an alarm for the running status of the target application at the prediction time point. If the predicted probability of the application anomaly alarm is greater than or equal to a preset alarm probability threshold, it is determined that an application anomaly alarm will be generated at the predicted time point; the application anomaly alarm is used to indicate that the target application is in an application anomaly state at the predicted time point.

2. The method according to claim 1, characterized in that, The step of acquiring server anomaly monitoring data for a first preset time period prior to the predicted time point for the target server running the target application includes: Obtain the log files generated by the monitoring system; the monitoring system is a system that monitors the operating status of the target server. Based on the time information in the log file, determine the operating status of the target server during the first preset time period; When the target server is in an abnormal operating state, the number of times the server abnormal alarm occurs is determined to obtain the server abnormal alarm count; the server abnormal alarm is an alarm generated in response to the abnormal state. The server anomaly monitoring data is determined based on the number of server anomaly alarms.

3. The method according to claim 2, characterized in that, Determining the operating status of the target server within the first preset time period based on the time information of the log file includes: Extract the file name extension of the log file to obtain the time information of the log file, and determine the actual completion time of the target application based on the time information; the actual completion time is determined based on the end time and start time of the current run of the target application. If the actual completion time is greater than or equal to the preset completion time of the target application, the running status of the target server is determined to be the abnormal state, and a server abnormal alarm is generated. If the actual completion time is less than the preset completion time, the target server is determined to be in a normal operating state.

4. The method according to claim 3, characterized in that, If the actual completion time is greater than or equal to the preset completion time of the target application, then the operating state of the target server is determined to be the abnormal state, and a server abnormality alarm is generated, including: If the time difference between the actual completion time and the preset completion time is within the first preset duration, a first-level server anomaly alarm is generated. If the time difference between the actual completion time and the preset completion time is within the second preset duration, a second-level server anomaly alarm will be generated. If the time difference between the actual completion time and the preset completion time is within the third preset duration, a third-level server anomaly alarm will be generated. The first-level server anomaly alarm, the second-level server anomaly alarm, and the third-level server anomaly alarm are collectively referred to as the server anomaly alarm; wherein, the anomaly level corresponding to the second-level server anomaly alarm is greater than the anomaly level corresponding to the first-level server anomaly alarm, but less than the anomaly level corresponding to the third-level server anomaly alarm.

5. The method according to claim 4, characterized in that, The at least one type of server anomaly includes abnormal memory usage, abnormal CPU utilization, and abnormal network speed. If the time difference between the actual completion time and the preset completion time is within a first preset duration, a first-level server anomaly alarm is generated, including: If the time difference between the actual completion time and the preset completion time is within the first preset duration, a first-level memory usage abnormality alarm, a first-level CPU utilization abnormality alarm, and a first-level network speed abnormality alarm are generated, resulting in a first-level server abnormality alarm. If the time difference between the actual completion time and the preset completion time is within a second preset duration, a second-level server anomaly alarm is generated, including: If the time difference between the actual completion time and the preset completion time is within the second preset duration, a second-level memory usage abnormal alarm, a second-level CPU utilization abnormal alarm, and a second-level network speed abnormal alarm are generated, resulting in a second-level server abnormal alarm. If the time difference between the actual completion time and the preset completion time is within a third preset duration, a third-level server anomaly alarm is generated, including: If the time difference between the actual completion time and the preset completion time is within the third preset duration, a third-level memory usage abnormality alarm, a third-level CPU utilization abnormality alarm, and a third-level network speed abnormality alarm are generated, thus obtaining the third-level server abnormality alarm.

6. The method according to claim 1, characterized in that, If the predicted probability of the application anomaly alarm is greater than or equal to a preset alarm probability threshold, it is determined that an application anomaly alarm will be generated at the predicted time point, including: If the predicted probability of the application anomaly alarm is greater than or equal to the preset alarm probability threshold, it is determined that an application runtime anomaly alarm will be generated at the predicted time point; the application runtime anomaly alarm is used to indicate that the application runtime difference at the predicted time point is greater than the preset runtime threshold; the application runtime difference is the time difference between the current application runtime of the target application and the average application runtime of the second preset time period. And / or, If the predicted probability of the application anomaly alarm is greater than or equal to the preset alarm probability threshold, it is determined that an application restart count anomaly alarm will be generated at the predicted time point; the application restart count anomaly alarm is used to indicate that when the target application fails to run, after the scheduling sub-machine restart mechanism is started, the number of consecutive restarts of the task on the same sub-machine is greater than the preset number threshold; the sub-machine is used to execute the restart task of the target application; The application runtime abnormality alarm and the application restart number abnormality alarm are regarded as application abnormality alarms.

7. A server alarm prediction device, characterized in that, The device includes: The acquisition module is used to acquire server anomaly monitoring data for a target server running a target application within a first preset time period before the predicted time point; the server anomaly monitoring data includes the number of server anomaly alarms corresponding to at least one time point in the first preset time period; the number of server anomaly alarms includes the number of alarms corresponding to at least one type of server anomaly. The input module is used to input the server anomaly monitoring data into the application alarm prediction model to obtain the application anomaly alarm prediction probability at the prediction time point; the application anomaly alarm prediction probability is the prediction probability of generating an alarm for the running status of the target application at the prediction time point. The determination module is used to determine that if the predicted probability of the application anomaly alarm is greater than or equal to a preset alarm probability threshold, an application anomaly alarm will be generated at the predicted time point; the application anomaly alarm is used to indicate that the target application is in an application anomaly state at the predicted time point.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images