A monitoring method, device, electronic device and storage medium

Abstract

The embodiments of the present invention provide a monitoring method, device, electronic device and storage medium. The present invention relates to the field of computer technology, in particular to the fields of monitoring, cloud computing containers, etc., and specifically includes: obtaining at least one unified tag, wherein the unified tag is obtained by converting the tag fingerprint of the monitored object, and the keywords of the unified tags corresponding to different monitored objects are the same; for at least one unified tag, based on the unified tag, through the pre-established correspondence between the unified tag and the monitoring information in multiple monitoring systems, obtaining the monitoring information for the monitored object in multiple monitoring systems corresponding to the unified tag. The present invention can realize associated monitoring, and can also be understood as being able to realize multi-dimensional associated monitoring.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, in particular to the fields of monitoring, cloud computing containers, and more specifically to a monitoring method, device, electronic device, and storage medium. Background Art

[0002] A complete monitoring system usually includes multiple independent systems, that is, monitoring is achieved through multiple independent systems. However, the multiple independent systems are scattered and cannot be monitored in a related manner. For example, a complete monitoring system includes an indicator monitoring system, a log monitoring system, and an alarm system. Usually, these three systems are independent of each other, that is, the indicator monitoring system, the log monitoring system, and the alarm system are scattered systems, and no association relationship can be established between the three systems, that is, it is impossible to achieve multi-dimensional monitoring association analysis. Summary of the invention

[0003] The purpose of the embodiments of the present invention is to provide a monitoring method, device, electronic device and storage medium to achieve associated monitoring. The specific technical solution is as follows:

[0004] In a first aspect, an embodiment of the present invention provides a monitoring method, including:

[0005] Acquire at least one unified label, wherein the unified label is obtained by converting the label fingerprint of the monitored object, and the keywords of the unified labels corresponding to different monitored objects are the same;

[0006] For the at least one unified tag, based on the unified tag, the monitoring information of the monitored object in the multiple monitoring systems corresponding to the unified tag is obtained through the pre-established correspondence between the unified tag and the monitoring information in the multiple monitoring systems.

[0007] Optionally, the step of pre-establishing a correspondence between a unified tag and monitoring information in multiple monitoring systems includes:

[0008] For multiple monitoring systems, respectively obtain monitoring information for at least one monitoring object in each monitoring system;

[0009] Obtaining a unified label corresponding to the at least one monitored object;

[0010] For the at least one monitored object, a corresponding relationship between the unified tag and the monitoring information for the at least one monitored object in each monitoring system is established.

[0011] Optionally, the multiple monitoring systems include an indicator monitoring system, a log monitoring system and an alarm system;

[0012] The obtaining, based on the unified tag, monitoring information on the monitoring object in the multiple monitoring systems corresponding to the unified tag through a pre-established correspondence between the unified tag and the monitoring information in the multiple monitoring systems includes:

[0013] Based on the unified tag, through the pre-established correspondence between the unified tag and the monitoring information in multiple monitoring systems, the performance indicator information in the indicator monitoring system corresponding to the unified tag, the log entries in the log monitoring system corresponding to the unified tag, and the alarm information in the alarm system corresponding to the unified tag are obtained.

[0014] Optionally, for a plurality of monitoring systems, respectively acquiring monitoring information for at least one monitoring object in each monitoring system includes:

[0015] Acquire performance indicator information, log entries and alarm information of a monitored object, wherein the performance indicator information is monitoring information of the monitored object in the indicator monitoring system, the log entry is monitoring information of the monitored object in the log monitoring system, and the alarm information is monitoring information of the monitored object in the alarm system;

[0016] The establishing, for the at least one monitored object, a correspondence between the unified tag and monitoring information for the at least one monitored object in each monitoring system includes:

[0017] For the at least one monitoring object, a correspondence between the unified tag and the performance indicator information, the log entry, and the alarm information is established.

[0018] Optionally, before acquiring the unified label corresponding to the at least one monitored object, the method further includes:

[0019] Obtaining a label fingerprint of at least one monitored object;

[0020] For the at least one monitored object, converting the label fingerprint into a unified label, wherein keywords of the unified labels corresponding to different monitored objects are the same;

[0021] The monitored object and the unified label are stored correspondingly.

[0022] Optionally, converting the label fingerprint into a unified label includes:

[0023] The label fingerprint is input into a pre-established matching model, and a unified label corresponding to the label fingerprint is obtained by using the matching model, wherein the matching model is learned based on a plurality of sample fingerprint data.

[0024] In a second aspect, an embodiment of the present invention provides a monitoring device, including:

[0025] A first acquisition module is used to acquire at least one unified label, wherein the unified label is obtained by converting the label fingerprint of the monitored object, and the keywords of the unified labels corresponding to different monitored objects are the same;

[0026] The query module is used to obtain the monitoring information of the monitored object in the multiple monitoring systems corresponding to the unified tag based on the unified tag through the pre-established correspondence between the unified tag and the monitoring information in the multiple monitoring systems.

[0027] Optionally, the device further comprises:

[0028] A second acquisition module is used to acquire, for each of the plurality of monitoring systems, monitoring information for at least one monitoring object; and to acquire a unified label corresponding to the at least one monitoring object;

[0029] An establishing module is used to establish, for the at least one monitored object, a corresponding relationship between the unified tag and monitoring information for the at least one monitored object in each monitoring system.

[0030] Optionally, the multiple monitoring systems include an indicator monitoring system, a log monitoring system and an alarm system;

[0031] The query module is specifically used to obtain, based on the unified tag, the performance indicator information in the indicator monitoring system corresponding to the unified tag, the log entries in the log monitoring system corresponding to the unified tag, and the alarm information in the alarm system corresponding to the unified tag through a pre-established correspondence between the unified tag and the monitoring information in multiple monitoring systems.

[0032] Optionally, the second acquisition module is specifically used to: acquire performance indicator information, log entries and alarm information of the monitored object, wherein the performance indicator information is monitoring information of the monitored object in the indicator monitoring system, the log entry is monitoring information of the monitored object in the log monitoring system, and the alarm information is monitoring information of the monitored object in the alarm system;

[0033] The establishing module is specifically used to establish, for the at least one monitoring object, a correspondence between the unified tag and the performance indicator information, the log entry, and the alarm information.

[0034] Optionally, the device further comprises:

[0035] A third acquisition module is used to obtain a label fingerprint of at least one monitored object;

[0036] a conversion module, configured to convert the label fingerprint into a unified label for the at least one monitored object, wherein the keywords of the unified labels corresponding to different monitored objects are the same;

[0037] A storage module is used to store the monitored objects and the unified labels accordingly.

[0038] Optionally, the conversion module is specifically used to input the label fingerprint into a pre-established matching model, and use the matching model to obtain a unified label corresponding to the label fingerprint, wherein the matching model is learned based on multiple sample fingerprint data.

[0039] In a third aspect, an embodiment of the present invention provides an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0040] Memory, used to store computer programs;

[0041] The processor is used to implement the method steps described in the first aspect when executing the program stored in the memory.

[0042] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in the first aspect are implemented.

[0043] An embodiment of the present invention further provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method steps described in the first aspect above.

[0044] Beneficial effects of the embodiments of the present invention:

[0045] The monitoring method, device, electronic device, and storage medium provided in the embodiments of the present invention can obtain at least one unified tag, wherein the unified tag is obtained by converting the tag fingerprint of the monitored object, and the keywords of the unified tags corresponding to different monitored objects are the same; for at least one unified tag, based on the unified tag, through the pre-established correspondence between the unified tag and the monitoring information in multiple monitoring systems, the monitoring information of the monitored object in the multiple monitoring systems corresponding to the unified tag is obtained. In the embodiments of the present invention, the correspondence between the unified tag and the monitoring information in multiple monitoring systems can be pre-established, that is, the correspondence between multiple unified tags and the monitoring information in multiple monitoring systems can be pre-established. In this way, the unified tag can be used to query the monitoring information in the multiple monitoring systems corresponding to each unified tag from the correspondence between the unified tag and the monitoring information in the multiple monitoring systems, and the correlation analysis of multiple monitoring systems can be realized.

[0046] Of course, it is not necessary to achieve all of the advantages described above at the same time to implement any product or method of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0048] Figure 1 A flow chart of a monitoring method provided by an embodiment of the present invention;

[0049] Figure 2 A flowchart of pre-establishing a correspondence between a unified tag and monitoring information in multiple monitoring systems in an embodiment of the present invention;

[0050] Figure 3 A flowchart of predetermining a unified label in an embodiment of the present invention;

[0051] Figure 4 A flow chart of a monitoring method provided by an embodiment of the present invention;

[0052] Figure 5 A structural schematic diagram of a monitoring device is also provided for an embodiment of the present invention;

[0053] Figure 6 Another structural schematic diagram of a monitoring device is also provided for an embodiment of the present invention;

[0054] Figure 7 Another structural schematic diagram of a monitoring device is also provided for an embodiment of the present invention;

[0055] Figure 8 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field based on this application belong to the scope of protection of the present invention.

[0057] The monitoring method provided by the embodiment of the present invention can be applied to electronic devices, such as terminals, servers, etc. The server can be a server in a monitoring system, and so on.

[0058] The monitoring method provided by the embodiment of the present invention may include:

[0059] Acquire at least one unified label, wherein the unified label is obtained by converting the label fingerprint of the monitored object, and the keywords of the unified labels corresponding to different monitored objects are the same;

[0060] For at least one unified tag, based on the unified tag, through a pre-established correspondence between the unified tag and the monitoring information in the multiple monitoring systems, the monitoring information on the monitoring object in the multiple monitoring systems corresponding to the unified tag is obtained.

[0061] In an embodiment of the present invention, a correspondence between a unified tag and monitoring information in multiple monitoring systems can be established in advance, that is, a correspondence between multiple unified tags and monitoring information in multiple monitoring systems can be established in advance. In this way, the unified tag can be used to query the monitoring information in multiple monitoring systems corresponding to each unified tag from the correspondence between the unified tag and the monitoring information in multiple monitoring systems, thereby realizing correlation analysis of multiple monitoring systems.

[0062] Figure 1 For a flow chart of the monitoring method provided by an embodiment of the present invention, see Figure 1 , the monitoring method provided by the embodiment of the present invention may include:

[0063] S101: Obtain at least one unified label.

[0064] The unified label is obtained by converting the label fingerprint of the monitored object.

[0065] The keywords of the unified labels corresponding to different monitoring objects are the same.

[0066] In one possible implementation, a correspondence between at least one monitored object and its corresponding unified tag can be pre-established, and the established correspondence between the at least one monitored object and its corresponding unified tag can be stored in a database, such as a unified tag database. When monitoring and analyzing the monitored object, the unified tag corresponding to the monitored object can be obtained, such as by querying the unified tag database to obtain the unified tag corresponding to the monitored object. The unified tag corresponding to a monitored object can include one, or can also include multiple.

[0067] S102, for at least one unified tag, based on the unified tag, by using a pre-established correspondence between the unified tag and the monitoring information in the multiple monitoring systems, obtaining monitoring information on the monitoring object in the multiple monitoring systems corresponding to the unified tag.

[0068] In the embodiment of the present invention, the correspondence between the unified tag and the monitoring information in multiple monitoring systems can be pre-established, that is, the correspondence between multiple unified tags and the monitoring information in multiple monitoring systems can be pre-established. In this way, the unified tag can be used to query the monitoring information in multiple monitoring systems corresponding to each unified tag from the correspondence between the unified tag and the monitoring information in multiple monitoring systems, so that the correlation analysis of multiple monitoring systems can be realized. At the same time, the unified tag can be used to quickly obtain the monitoring information in multiple monitoring systems, thereby improving the operation and maintenance efficiency.

[0069] In an optional embodiment, the multiple monitoring systems include an indicator monitoring system, a log monitoring system and an alarm system.

[0070] Based on the unified tag, the monitoring information of the monitoring object in the multiple monitoring systems corresponding to the unified tag is obtained through the pre-established correspondence between the unified tag and the monitoring information in the multiple monitoring systems, including:

[0071] Based on unified tags, through the pre-established correspondence between unified tags and monitoring information in multiple monitoring systems, the performance indicator information in the indicator monitoring system corresponding to the unified tags, the log entries in the log monitoring system corresponding to the unified tags, and the alarm information in the alarm system corresponding to the unified tags are obtained.

[0072] The correspondence between the pre-established multiple unified tags and the monitoring information in the multiple monitoring systems can also be called an inverted index based on the unified tag, that is, data sorted by using the unified tag as the query primary key.

[0073] The performance indicator information in the monitoring system is simply understood as the indicator of the monitored object, the log entries in the log monitoring system are simply understood as the logs of the monitored object, and the alarm information in the alarm system is simply understood as the alarms related to the monitored object.

[0074] Pre-establish the correspondence between unified tags and monitoring information in multiple monitoring systems, that is, pre-establish the correspondence between unified tags and performance indicator information in the indicator monitoring system, log entries in the log monitoring system, and alarm information in the alarm system. Simply understand it as an inverted index between unified tags and the time series data set of indicators, logs, and alarms. In this way, you can query the associated performance indicator information, log entries, and alarm information based on the unified tags for correlation analysis. That is, by establishing an inverted index between unified tags and the time series data set of indicators, logs, and alarms, you can achieve correlation query and analysis of each monitoring system, and improve the efficiency of operation and maintenance management. For example, for container applications that are frequently upgraded.

[0075] Figure 2 This is a flow chart of pre-establishing a correspondence between a unified tag and monitoring information in multiple monitoring systems in an embodiment of the present invention. Figure 2 , the steps of pre-establishing the corresponding relationship between the unified label and the monitoring information in multiple monitoring systems include:

[0076] S201, for a plurality of monitoring systems, respectively obtain monitoring information of at least one monitoring object in each monitoring system.

[0077] For example, each monitoring system monitors each monitoring object in real time, and for each monitoring object, monitoring information of the monitoring object can be collected from each monitoring system.

[0078] S202: Obtain a unified label corresponding to at least one monitored object.

[0079] A correspondence between at least one monitored object and a corresponding unified tag can be established in advance, and the established correspondence between the at least one monitored object and the corresponding unified tag can be stored in a database, such as a unified tag database. In this way, the unified tag corresponding to the monitored object can be obtained from the database using the monitored object.

[0080] S203: For at least one monitored object, a corresponding relationship between a unified tag and monitoring information for at least one monitored object in each monitoring system is established.

[0081] In an optional embodiment, the multiple monitoring systems include an indicator monitoring system, a log monitoring system and an alarm system.

[0082] The step of pre-establishing a correspondence between a unified label and monitoring information in multiple monitoring systems, namely, pre-establishing a correspondence between a unified label and monitoring information in an indicator monitoring system, a log monitoring system and an alarm system.

[0083] S201 may include: obtaining performance indicator information, log entries, and alarm information of the monitored object.

[0084] Performance indicator information is monitoring information for the monitoring object in the indicator monitoring system, log entries are monitoring information for the monitoring object in the log monitoring system, and alarm information is monitoring information for the monitoring object in the alarm system;

[0085] S202 may include: obtaining a unified label corresponding to the monitored object.

[0086] A correspondence between at least one monitored object and a corresponding unified tag can be established in advance, and the established correspondence between the at least one monitored object and the corresponding unified tag can be stored in a database, such as a unified tag database. In this way, the unified tag corresponding to the monitored object can be obtained from the database using the monitored object.

[0087] S203 may include: establishing a correspondence between the unified tag and the performance indicator information, log entries, and alarm information.

[0088] By querying the unified tag database, corresponding unified tags are bound to the resource indicators, logs and alarms. That is, the unified tags corresponding to the monitored objects are obtained by querying the unified tag database, and the unified tags corresponding to the monitored objects are bound to the performance indicator information, log entries and alarm information of the monitored objects.

[0089] Establish an inverted index of the time series data set from unified tags to indicators, logs, and alarms. When performing monitoring correlation analysis, you can quickly obtain the associated monitoring indicators, logs, and alarm items by querying the unified tags, thereby achieving multi-dimensional monitoring correlation analysis.

[0090] It realizes the associated query and analysis of each monitoring system, and improves the efficiency of operation and maintenance management. For example, for container applications that are frequently upgraded, there is no need to obtain the label fingerprint of the monitoring object from the configuration file every time the upgrade is performed, nor is there a need to obtain the monitoring information of the monitoring object from each monitoring system for each monitoring object. It can realize the associated query and analysis of each monitoring system for container applications, and improve the efficiency of operation and maintenance management.

[0091] Figure 3 Flow chart of predetermining unified labels in an embodiment of the present invention. Figure 3 In the embodiment of the present invention, predetermining a unified tag may include:

[0092] S301, obtaining a label fingerprint of at least one monitored object.

[0093] Monitoring objects may include: infrastructure layer objects, platform service layer objects, and / or container applications. Infrastructure layer objects include virtual machines, storage, networks, etc.; platform service layer objects include platform service components, etc.

[0094] In one possible implementation, the monitored object can be obtained based on service discovery, and the label fingerprint of the monitored object can be extracted.

[0095] For example, you can extract label fingerprints for infrastructure layer objects when deploying them, such as extracting label fingerprints for virtual machines, storage, and networks when deploying them. You can extract label fingerprints for platform service layer objects when deploying platform services, such as extracting label fingerprints for platform services from platform service components. You can extract label fingerprints for container applications when deploying container applications, and extract container application label fingerprints from application images, deployment configurations, and target container engines.

[0096] S302: For at least one monitored object, convert the label fingerprint into a unified label.

[0097] Among them, the keywords of the unified labels corresponding to different monitoring objects are the same.

[0098] All monitoring objects use the same type of labels. For example, all monitoring objects use the same KV label, which is a key-value pair. Different monitoring objects have the same K (keyword) but different V values ​​(values ​​corresponding to the keyword). For example, the unified label for the central processing unit (CPU) of all monitoring objects is in the form of CPU:CPU value. Different monitoring objects use the same keyword in the unified label for the CPU, but different CPU values.

[0099] The label fingerprint is converted into a unified label, such as converting the label fingerprint into a label of a preset type and a preset form. For example, the unified label for the CPU of the monitored object uses a preset keyword, CPU. After obtaining the label fingerprint (such as by including the content of cpu in the label fingerprint), the content of the CPU of the monitored object represented in the label fingerprint can be extracted and expressed in the form of CPU:CPU value, that is, cpu is expressed as CPU, and the content of the CPU of the monitored object represented in the label fingerprint is filled into the CPU value.

[0100] A monitoring object can correspond to one unified label, or can correspond to multiple unified labels.

[0101] S303, correspondingly storing the monitored objects and unified labels.

[0102] A relational database that stores unified tags and monitored objects, with the monitored object as the primary key.

[0103] The correspondence between the monitored objects and the unified tags may be stored in a database, for example, in a unified tag database.

[0104] In the embodiment of the present invention, the original label is automatically converted into a system unified label. At the same time, a unified label database is introduced to perform unified management and operation and maintenance of the label.

[0105] In an optional embodiment, a matching model can be pre-trained and used for label matching. For example, a unified label for each monitored object can be extracted from the label fingerprint through the matching model, and the unified label and the monitored object can be bound. It can also be understood as establishing a corresponding relationship between the monitored object and the unified label, such as storing the corresponding relationship between the identification information of the monitored object and the unified label.

[0106] The label fingerprint is input into the pre-established matching model, and the matching model is used to obtain the unified label corresponding to the label fingerprint.

[0107] A matching relationship between label fingerprints and unified labels can be generated. For example, a set of unified labels can be obtained by inputting a set of label fingerprints into a matching model.

[0108] The matching model can be learned based on multiple sample fingerprint data. For example, a large amount of sample fingerprint data can be obtained, feature analysis and classification can be performed based on the large amount of sample fingerprint data, and a mapping relationship between label fingerprints and unified labels can be constructed. A mapping relationship model with unified labels can be generated based on label fingerprint analysis, i.e., a matching model. The large amount of fingerprint data obtained is used as sample data to learn the mapping relationship between label fingerprints and unified labels.

[0109] When the monitoring system collects indicators and logs and triggers alarms, it can query the unified tag database and establish an inverted index with unified tags as the index for the time series of indicators, logs, and alarm responses. In this way, by querying the inverted index with unified tags, the corresponding time series data set of the associated indicators, logs, and alarms can be obtained to achieve association analysis, which can also be understood as achieving multi-dimensional monitoring association analysis. At the same time, the unified tags can quickly obtain the associated indicators, logs, alarms and other information, and operation and maintenance management can be performed based on the associated indicators, logs, alarms and other information, so that the operation and maintenance efficiency can be improved.

[0110] Compared with the indicator monitoring, log monitoring and alarm systems of related monitoring technologies, which are scattered systems and cannot establish association relationships, that is, cannot achieve multi-dimensional monitoring association analysis, the embodiment of the present invention associates the monitoring items of the indicator monitoring system, log monitoring system and alarm system to achieve alarm association analysis. In addition, compared with the related technology in which tags are scattered in various configuration files and cannot be centrally managed, the embodiment of the present invention uses a unified tag database to centrally use, maintain and manage tags, automatically convert original tags into system unified tags, and combine with the unified tag database to uniformly manage and operate tags.

[0111] The monitoring method in the embodiment of the present invention can be understood as a monitoring method based on a unified tag.

[0112] By converting the label fingerprint of the monitored object into a unified label and storing it in a unified label database, consistent management of the monitoring system labels can be achieved.

[0113] In response to the problem in the related art that the indicator system, log system and alarm system in the monitoring system are independent of each other and cannot establish correlation analysis, the embodiment of the present disclosure establishes an inverted index between the time series data sets of unified labels to indicators, logs and alarms, so as to realize the correlation query and analysis of each monitoring system, thereby improving the operation and maintenance management efficiency, especially for frequently upgraded container applications.

[0114] Specifically: extract the label fingerprint of the monitored object, bind it with the most matching unified label, and store the binding relationship between the unified label and the object in the unified label database.

[0115] When collecting (or generating) indicators, log entries or alarm events of the monitored objects, the corresponding unified tags are bound to the resource's indicators, logs and alarms by querying the unified tag library, and an inverted index is established from the unified tags to the time series data set of indicators, logs and alarms.

[0116] In this way, when performing monitoring correlation analysis, you can quickly obtain related monitoring indicators, logs, and alarm items by querying unified tags, thereby achieving multi-dimensional monitoring correlation analysis.

[0117] Figure 4 Flow chart of the monitoring method provided by the embodiment of the present invention. Referring to FIG4 , the monitoring method provided by the embodiment of the present invention is described in detail.

[0118] Extract fingerprints of monitored objects.

[0119] When deploying at the infrastructure layer, extract label fingerprints from objects at the infrastructure layer. For example, when deploying at the infrastructure layer, extract label fingerprints for virtual machines, storage, and networks. Extract label fingerprints when deploying platform services, such as extracting label fingerprints of platform services from platform service components. Extract label fingerprints when deploying container applications, and extract container application label fingerprints from application images, deployment configurations, and target container engines.

[0120] The matching model generation module is used to generate the matching relationship between the label fingerprint and the unified label. A set of label fingerprints can be input into the matching model to obtain a set of unified labels.

[0121] Label matching: Extract unified labels for each object from label fingerprints through matching models, bind labels to objects, and store relational databases between unified labels and monitored objects, with monitored objects as primary keys.

[0122] Inverted index library: When collecting indicators, log entries, and alarm event triggers of monitored objects, query the unified label database to obtain the unified label of the monitored object, and establish an inverted index from the unified label to the time series data of indicators, logs, and alarms.

[0123] The inverted index database can be understood as data sorted by unified tags as keywords. During the query process, the unified tags can be used as query keys to obtain performance indicator information, log entries, alarm information, etc. corresponding to the unified tags.

[0124] In one possible implementation, a matching model may be obtained through a preprocessing process, and the matching model may also be referred to as a mapping relationship model.

[0125] Pre-processing steps may include:

[0126] Label fingerprint feature analysis: Perform feature analysis and classification based on a large amount of fingerprint data, and construct a mapping relationship between label fingerprints and unified labels.

[0127] Generate a matching model between label fingerprints and unified labels: Generate a mapping relationship model with unified labels based on label fingerprint analysis.

[0128] It can be understood that a large amount of fingerprint data is obtained as sample data to learn the mapping relationship between label fingerprints and unified labels.

[0129] Evaluation: Test the mapping relationship model by constructing test data to verify the accuracy of the model.

[0130] The accuracy of the mapping relationship model can be improved through the evaluation process, so the accuracy of the unified label obtained through the mapping relationship model can be improved.

[0131] After obtaining the label fingerprint of the monitored object, such as extracting the label fingerprint of the service component, the mapping relationship model can be used to bind the service component to the unified label of the level to which the service component belongs that best matches the service component, and the binding relationship between the monitored object and the unified label, that is, the corresponding relationship between the monitored object and the unified label, is stored in the unified label database.

[0132] In the label extraction process, the label fingerprint of the monitored object can be extracted. For example, the service component is deployed and the label fingerprint of the service component is extracted: the label key-value pair is extracted from the configuration file of the service component as the label fingerprint. Then, the label is matched: the label fingerprint is used as input, and the mapping relationship model between the label fingerprint and the unified label generated in the above preprocessing process is used to bind the most matching unified label to the label object, such as the service component.

[0133] Unified tag storage: The correspondence between unified tags and monitoring objects, such as the binding relationship between unified tags and service components, is stored in the unified tag database.

[0134] In this way, a query can be performed based on the correspondence between the unified tags and the monitored objects in the unified tag database. For example, the tag of the level to which the component belongs that best matches the component can be bound to the component through a mapping relationship model.

[0135] Tag query: When collecting monitoring object indicators, logs, and alarm event triggers, the corresponding unified tags will be bound to the monitoring object indicators, logs, and alarms through the unified tag library.

[0136] Tag index establishment: Use unified tags as indexes to establish and store an inverted index database of unified tags and time series of indicators, logs, and alarm responses.

[0137] It can also be understood as establishing a correspondence between unified tags and performance indicator information, log entries, and alarm information.

[0138] In this way, correlation analysis can be achieved. Specifically, by querying unified tags, the time data set corresponding to the associated indicators, logs, and alarms can be obtained, and the correlation of indicators, logs, and alarms can be quickly achieved.

[0139] Prometheus is a monitoring system based on time series. Prometheus can obtain monitoring data through the Hypertext Transfer Protocol (HTTP) interface. Each monitoring object can collect monitoring data indicators through Exporter. After certain configuration, Prometheus can actively collect monitoring data from various Exporters. Build an Adapter (middle component) between the Prometheus Server (server) and the Exporter. At this time, Prometheus no longer directly initiates HTTP requests to the Exporter to grab monitoring indicators, but initiates requests to the Adapter. Once the Adapter receives the request, it will turn to the Exporter to actually grab the monitoring indicators. It is known that the indicator content is actually some text, so you can inject custom indicators by doing some simple insertion operations. Finally, return the processed content to the Prometheus Server.

[0140] The data stored in Prometheus is a time series, which is uniquely identified by the name of the metric and a series of tags (key-value pairs). Different tags represent different time series, that is, you can query specified data by specifying tags. Metrics + tags realize the role of query conditions, and different tags can be specified to filter different data. The monitoring system discovers the monitoring object through the service discovery mechanism and extracts the monitoring object indicators and tags.

[0141] A complete monitoring system usually includes an indicator monitoring system, a log monitoring system, and an alarm system. Usually, these three systems are independent of each other, but in fact, there is a correlation between them. For example, CPU overload will involve corresponding CPU indicators, logs, and CPU overload alarms. In related technologies, time series databases are used for storage, and the data models are similar. However, due to the independence of the systems, it is difficult to perform correlation analysis in the monitoring system, and it is impossible to string together the correlation information of the three systems for analysis.

[0142] In the embodiment of the present invention, the label fingerprint of the monitored object is converted into a unified label and stored in a unified label database to achieve consistency management of the monitoring system label. In view of the problem that the indicator system, log system and alarm system in the monitoring system in the related art are independent of each other and cannot establish correlation analysis, in the embodiment of the present invention, an inverted index between the time series data set of unified labels to indicators, logs and alarms is established to achieve correlation query and analysis of each monitoring system, thereby improving the efficiency of operation and maintenance management, especially for frequently upgraded container applications.

[0143] Specifically: obtain the monitoring object based on service discovery, extract the label fingerprint of the monitoring object, bind the most matching unified label through label matching, and store the binding relationship between the unified label and the monitoring object in the unified label database. When collecting (or generating) the indicators, log entries or alarm event triggers of the monitoring object, query the unified label database to bind the corresponding unified labels to the indicators, logs and alarms of the resources, and establish an inverted index of the unified label to the time series data set of indicators, logs and alarms. When performing monitoring association analysis, you can quickly obtain the associated monitoring indicators, logs and alarm entries by querying the unified labels, realizing multi-dimensional monitoring association analysis and improving operation and maintenance efficiency.

[0144] The embodiments of the present invention can be applied to unified tag management in monitoring systems and correlation analysis of multi-dimensional monitoring information. By extracting, converting and binding unified tags to tag fingerprints of monitored objects, the tag consistency of various monitored objects in the monitoring system can be achieved. Then, by injecting unified tags into the indicator monitoring system, log monitoring system and alarm system, correlation query of the indicator system, log system and alarm system based on unified tags can be achieved.

[0145] At the same time, compared with the related technology monitoring system, the labels of the monitored objects cannot be uniformly managed and maintained, but are manually configured in each monitored object and extracted through the monitoring system. Different monitored objects are often managed and maintained by different teams, that is, the labels in the related technology are scattered in various configuration files and cannot be centrally managed. For example, for container applications that are frequently deployed and upgraded, the labels are scattered in various container configuration files, and their labels are difficult to maintain. The embodiment of the present invention extracts label fingerprints, converts the change fingerprints into unified labels, and stores the corresponding relationship between the monitored objects and the unified labels in the database, thereby realizing the use of a unified label database, and centrally using, maintaining and managing labels.

[0146] Corresponding to the monitoring method provided in the above embodiment, the embodiment of the present invention also provides a monitoring device, such as Figure 5 As shown, this may include:

[0147] A first acquisition module 501 is used to acquire at least one unified label, wherein the unified label is obtained by converting the label fingerprint of the monitored object, and the keywords of the unified labels corresponding to different monitored objects are the same;

[0148] The query module 502 is used to obtain monitoring information of a monitoring object in multiple monitoring systems corresponding to the unified tag based on the unified tag through a pre-established correspondence between the unified tag and the monitoring information in multiple monitoring systems.

[0149] Optional, such as Figure 6 As shown, the device also includes:

[0150] The second acquisition module 601 is used to acquire, for multiple monitoring systems, monitoring information of at least one monitoring object in each monitoring system; and to acquire a unified label corresponding to at least one monitoring object;

[0151] The establishing module 602 is used to establish, for at least one monitored object, a corresponding relationship between a unified tag and monitoring information for at least one monitored object in each monitoring system.

[0152] Optionally, multiple monitoring systems include an indicator monitoring system, a log monitoring system, and an alarm system;

[0153] Query module 502 is specifically used to obtain performance indicator information in the indicator monitoring system corresponding to the unified tag, log entries in the log monitoring system corresponding to the unified tag, and alarm information in the alarm system corresponding to the unified tag based on the unified tag through the pre-established correspondence between the unified tag and the monitoring information in multiple monitoring systems.

[0154] Optionally, the second acquisition module 601 is specifically used to: acquire performance indicator information, log entries and alarm information of the monitored object, the performance indicator information is the monitoring information of the monitored object in the indicator monitoring system, the log entry is the monitoring information of the monitored object in the log monitoring system, and the alarm information is the monitoring information of the monitored object in the alarm system;

[0155] The establishing module 602 is specifically used to establish a correspondence between a unified tag and performance indicator information, log entries and alarm information for at least one monitoring object.

[0156] Optional, such as Figure 7 As shown, the device also includes:

[0157] The third acquisition module 701 is used to obtain a label fingerprint of at least one monitored object;

[0158] A conversion module 702, configured to convert a label fingerprint into a unified label for at least one monitored object, wherein the keywords of the unified labels corresponding to different monitored objects are the same;

[0159] The storage module 703 is used to store the monitoring objects and the unified labels accordingly.

[0160] Optionally, the conversion module 702 is specifically used to input the label fingerprint into a pre-established matching model, and use the matching model to obtain a unified label corresponding to the label fingerprint, wherein the matching model is learned based on multiple sample fingerprint data.

[0161] The embodiment of the present invention further provides an electronic device, such as Figure 8 As shown, it includes a processor 801 , a communication interface 802 , a memory 803 and a communication bus 804 , wherein the processor 801 , the communication interface 802 , and the memory 803 communicate with each other via the communication bus 804 .

[0162] Memory 803, used for storing computer programs;

[0163] The processor 801 is used to implement the method steps of the above monitoring method when executing the program stored in the memory 803.

[0164] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0165] The communication interface is used for communication between the above electronic device and other devices.

[0166] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0167] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0168] In another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the method steps of the above-mentioned monitoring method are implemented.

[0169] In another embodiment of the present invention, a computer program product including instructions is provided, which, when executed on a computer, enables the computer to execute the method steps of the monitoring method in the above embodiment.

[0170] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0171] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0172] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, electronic device, computer-readable storage medium, and computer program product embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0173] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A monitoring method, characterized in that: include: Obtain at least one unified label, wherein the unified label is obtained by converting the label fingerprint of the monitored object, the keywords of the unified labels corresponding to different monitored objects are the same, the unified labels are all labels in the form of key-value pairs, and the keywords of the unified labels represent the keys in the key-value pairs; For the at least one unified tag, based on the unified tag, by using a pre-established correspondence between the unified tag and the monitoring information in the multiple monitoring systems, obtaining monitoring information for the monitoring object in the multiple monitoring systems corresponding to the unified tag; The step of pre-establishing a correspondence between a unified tag and monitoring information in a plurality of monitoring systems comprises: for a plurality of monitoring systems, respectively obtaining monitoring information for at least one monitoring object in each monitoring system; obtaining a unified tag corresponding to the at least one monitoring object; and establishing a correspondence between the unified tag and monitoring information for at least one monitoring object in each monitoring system for the at least one monitoring object; The multiple monitoring systems include an indicator monitoring system, a log monitoring system and an alarm system; The obtaining, based on the unified tag, of the monitoring information for the monitoring object in the multiple monitoring systems corresponding to the unified tag through a pre-established correspondence between the unified tag and the monitoring information in the multiple monitoring systems includes: obtaining, based on the unified tag, of the performance indicator information in the indicator monitoring system corresponding to the unified tag, of the log entries in the log monitoring system corresponding to the unified tag, and of the alarm information in the alarm system corresponding to the unified tag through a pre-established correspondence between the unified tag and the monitoring information in the multiple monitoring systems; The method of obtaining, for multiple monitoring systems, monitoring information for at least one monitoring object in each monitoring system, includes: obtaining performance indicator information, log entries and alarm information of the monitoring object, wherein the performance indicator information is the monitoring information for the monitoring object in the indicator monitoring system, the log entry is the monitoring information for the monitoring object in the log monitoring system, and the alarm information is the monitoring information for the monitoring object in the alarm system; the method of establishing, for at least one monitoring object, a correspondence between the unified label and the monitoring information for at least one monitoring object in each monitoring system, includes: establishing, for at least one monitoring object, a correspondence between the unified label and the performance indicator information, the log entry and the alarm information.

2. The method according to claim 1, characterized in that Before obtaining the unified label corresponding to the at least one monitored object, the method further includes: Obtaining a label fingerprint of at least one monitored object; For the at least one monitored object, converting the label fingerprint into a unified label, wherein keywords of the unified labels corresponding to different monitored objects are the same; The monitored object and the unified label are stored correspondingly.

3. The method according to claim 2, characterized in that The converting the label fingerprint into a unified label includes: inputting the label fingerprint into a pre-established matching model, and using the matching model to obtain a unified label corresponding to the label fingerprint, wherein the matching model is learned based on multiple sample fingerprint data.

4. A monitoring device, characterized in that: include: A first acquisition module is used to acquire at least one unified label, wherein the unified label is obtained by converting the label fingerprint of the monitored object, and the keywords of the unified labels corresponding to different monitored objects are the same; A query module, configured to obtain, for the at least one unified tag, monitoring information of the monitored object in the multiple monitoring systems corresponding to the unified tag based on the unified tag and through a pre-established correspondence between the unified tag and the monitoring information in the multiple monitoring systems; The device also includes: A second acquisition module is used to acquire, for each of the plurality of monitoring systems, monitoring information for at least one monitoring object; and to acquire a unified label corresponding to the at least one monitoring object; An establishing module, used for establishing, for the at least one monitored object, a correspondence between the unified tag and monitoring information for the at least one monitored object in each monitoring system; The multiple monitoring systems include an indicator monitoring system, a log monitoring system and an alarm system; The query module is specifically used to obtain, based on the unified tag, the performance indicator information in the indicator monitoring system corresponding to the unified tag, the log entry in the log monitoring system corresponding to the unified tag, and the alarm information in the alarm system corresponding to the unified tag through the pre-established correspondence between the unified tag and the monitoring information in multiple monitoring systems; The second acquisition module is specifically used to: acquire performance indicator information, log entries and alarm information of the monitored object, wherein the performance indicator information is monitoring information of the monitored object in the indicator monitoring system, the log entry is monitoring information of the monitored object in the log monitoring system, and the alarm information is monitoring information of the monitored object in the alarm system; The establishing module is specifically used to establish, for the at least one monitoring object, a correspondence between the unified tag and the performance indicator information, the log entry, and the alarm information.

5. The device according to claim 4, characterized in that The device also includes: A third acquisition module is used to obtain a label fingerprint of at least one monitored object; a conversion module, configured to convert the label fingerprint into a unified label for the at least one monitored object, wherein the keywords of the unified labels corresponding to different monitored objects are the same; A storage module is used to store the monitored objects and the unified labels accordingly.

6. The device according to claim 5, characterized in that The conversion module is specifically used to input the label fingerprint into a pre-established matching model, and use the matching model to obtain a unified label corresponding to the label fingerprint, wherein the matching model is learned based on multiple sample fingerprint data.

7. An electronic device, characterized in that: The invention comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; the memory is used to store computer programs; and the processor is used to implement the method steps described in any one of claims 1 to 3 when executing the program stored in the memory.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 3 are implemented.

Images