A server exception detection method and device, electronic equipment and storage medium

Abstract

The application provides a kind of server exception detection method, device, electronic equipment and storage medium, related to server detection field, method includes: the hardware running information and log information of server are collected;Value detection and / or state detection are carried out on hardware running information, to generate first detection result;Abnormal log correlation detection is carried out on log information, to generate second detection result;When first detection result and / or second detection result are abnormal result, the alarm information corresponding to abnormal result is generated and output;The automation degree of server exception detection can be improved, and the positioning efficiency of administrator to server fault and the success rate of eradicating these faults can be improved by value detection, state detection on hardware running information and abnormal log correlation detection on log information.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of server detection, and in particular to a server anomaly detection method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the acceleration of the digital era, as the operation center for storing and processing massive data, the scale of data center is also rapidly growing. The increasing number of servers not only increases the difficulty of managing the server cluster of the data center, but also increases the probability of cluster failure, which brings great challenges to the operation and maintenance of the data center. Therefore, it is of great significance to ensure the stable operation of the data center server, find and eliminate hidden dangers in advance of server failure, and improve the quality of enterprise IT services.

[0003] In related technologies, the data center server monitoring is mostly performed by administrators through manual monitoring, and the fault diagnosis efficiency is low. After the server problem occurs, the administrator can only locate the fault and solve it according to his own experience and some detection tools, and the automation degree is not high. In addition, since the cause of the fault and the system data before the fault occur are not traceable, the administrator can only judge according to experience, which is difficult to eradicate the fault and thus easily causes secondary fault. SUMMARY

[0004] The purpose of the present application is to provide a server anomaly detection method, device, electronic equipment and storage medium, which can improve the automation degree of server anomaly detection, and can improve the positioning efficiency of server fault and the success rate of eradicating these faults by detecting the numerical value of hardware running information, state detection and abnormal log correlation detection of log information.

[0005] To solve the above technical problems, the present application provides a server anomaly detection method, comprising:

[0006] Collecting hardware running information and log information of the server;

[0007] Numerical value detection and / or state detection are performed on the hardware running information to generate a first detection result;

[0008] Abnormal log correlation detection is performed on the log information to generate a second detection result;

[0009] When the first detection result and / or the second detection result is an abnormal result, the alarm information corresponding to the abnormal result is generated and output.

[0010] Optionally, the collecting of hardware running information and log information of the server comprises:

[0011] The control monitoring manager utilizes pre-stored server communication information to schedule a preset number of data collectors to collect the hardware operation information and the log information.

[0012] Optionally, the data collector collecting the hardware operation information and the log information comprises:

[0013] The data collector utilizes the server communication information to determine whether a network connection with the server can be established;

[0014] If yes, the hardware operation information and the log information are acquired from the server in a multi-thread, asynchronous non-blocking manner;

[0015] If no, alarm information indicating a network connection exception is outputted.

[0016] Optionally, the abnormal log correlation detection on the log information to generate a second detection result comprises:

[0017] Time information, frequency information and component information corresponding to an abnormal event are extracted from the log information by utilizing a preset fault knowledge base, and the time information, the frequency information and the component information are integrated into abnormal information;

[0018] It is determined whether the abnormal information matches a preset abnormal system event correlation and / or abnormal sensor data correlation and / or a custom correlation;

[0019] If yes, a second detection result indicating that the log information is abnormal is generated;

[0020] If no, a second detection result indicating that the log information is not abnormal is generated.

[0021] Optionally, the numerical detection on the hardware operation information comprises:

[0022] It is determined whether a current numerical value in the hardware operation information is beyond a preset range;

[0023] If yes, a first detection result indicating that the hardware operation information is abnormal is generated;

[0024] If no, a first detection result indicating that the hardware operation information is not abnormal is generated; and / or,

[0025] A historical numerical value corresponding to the hardware operation information is acquired, and it is determined whether a difference between the historical numerical value and the current numerical value is greater than a preset threshold;

[0026] If yes, a first detection result indicating that the hardware operation information is abnormal is generated;

[0027] If no, a first detection result indicating that the hardware running information has no exception is generated.

[0028] Optionally, the state detection on the hardware running information comprises:

[0029] determining whether the state information in the hardware running information is an abnormal state;

[0030] If yes, a first detection result indicating that the hardware running information has an exception is generated.

[0031] If no, a first detection result indicating that the hardware running information has no exception is generated.

[0032] Optionally, before outputting the alarm information corresponding to the exception result, the method further comprises:

[0033] inputting all the alarm information generated in a preset period into corresponding nodes of a preset association tree; the preset association tree is constructed by using a preset alarm information association relationship;

[0034] determining root nodes in the nodes corresponding to all the alarm information by using a depth-first traversal algorithm to traverse the preset association tree;

[0035] Correspondingly, outputting the alarm information corresponding to the exception result comprises:

[0036] outputting alarm information corresponding to the root nodes.

[0037] The application further provides a server exception detection device, comprising:

[0038] a collection module configured to collect hardware running information and log information of a server;

[0039] a first detection module configured to perform numerical detection and / or state detection on the hardware running information to generate a first detection result;

[0040] a second detection module configured to perform abnormal log association detection on the log information to generate a second detection result;

[0041] an alarm module configured to generate and output alarm information corresponding to an exception result when the first detection result and / or the second detection result is the exception result.

[0042] The application further provides an electronic device, comprising:

[0043] a memory configured to store a computer program;

[0044] a processor configured to execute the computer program to implement the server exception detection method as described above.

[0045] The application further provides a computer readable storage medium, wherein computer executable instructions are stored in the computer readable storage medium, and the computer executable instructions are loaded and executed by a processor to implement the server anomaly detection method.

[0046] The application provides a server anomaly detection method, which comprises the following steps: collecting hardware running information and log information of a server; performing numerical detection and / or state detection on the hardware running information to generate a first detection result; performing abnormal log correlation detection on the log information to generate a second detection result; and generating and outputting alarm information corresponding to the abnormal result when the first detection result and / or the second detection result is an abnormal result.

[0047] It can be seen that the application can automatically collect hardware running information and log information of a server, wherein, for the hardware running information, the application can adopt numerical detection and state detection to process the hardware running information, so as to give a warning for the fault of specific hardware; in addition, for the log information, the application can adopt abnormal log correlation detection to process the log information, that is, the application can detect the correlation between log information, so as to determine whether there is a correlation between multiple server anomaly events, and give a warning for the correlation, so that an administrator can maintain the server according to the correlation anomaly events involved in the warning, which can effectively improve the eradication rate of server faults and reduce the possibility of secondary maintenance. In other words, the application can improve the automation degree of server anomaly detection, and can improve the positioning efficiency of server faults and the success rate of eradicating the faults by numerical detection, state detection of hardware running information and abnormal log correlation detection of log information. The application further provides a server anomaly detection device, an electronic device and a computer readable storage medium, which have the above beneficial effects. BRIEF DESCRIPTION OF DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description only constitute the embodiments of the application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of the provided drawings.

[0049] Figure 1 A flow chart of a server anomaly detection method provided by the embodiments of the application;

[0050] Figure 2 An architecture schematic diagram of a state monitoring module provided by the embodiments of the application;

[0051] Figure 3 A schematic diagram of a log analysis framework provided by the embodiments of the application;

[0052] Figure 4 A general framework diagram of a server exception detection device provided by an embodiment of the present application is shown in FIG. 1.

[0053] Figure 5 A structural block diagram of a server exception detection device provided by an embodiment of the present application is shown in FIG. 2. DETAILED DESCRIPTION

[0054] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0055] In the related art, data center server monitoring is mostly performed by administrators through manual monitoring, and the fault diagnosis efficiency is low. After the server has a problem, the administrator can only locate the fault and solve it according to his own experience and some detection tools, and the degree of automation is not high. In addition, since the cause of the fault and the system data before the fault cannot be checked, the administrator can only judge according to experience, and it is difficult to eradicate the fault, which may easily cause secondary faults. Therefore, the present application provides a server exception detection method, which can improve the degree of automation of server exception detection, and can improve the positioning efficiency of server faults and the success rate of eradicating these faults through numerical detection of hardware running information, state detection, and abnormal log association detection of log information. Please refer to Figure 1 , Figure 1 A flowchart of a server exception detection method provided by an embodiment of the present application is shown in FIG. 3. The method can include the following steps.

[0056] S101, collect hardware running information and log information of the server.

[0057] In the embodiment of the present application, the hardware running information of the server refers to the current running information of each hardware module of the server, such as the server temperature, the rotating speed of each fan, each power supply voltage and device power and the like; and the log information is the system event information and sensor information collected by the server, such as various BMC logs (Baseboard Management Controller), such as SEL logs (System Event Log) and SDR logs (Sensor Data Record) and the like. By monitoring the above information, the running status of the server can be intuitively understood, so that the operation and maintenance personnel can timely find the server abnormalities and perform troubleshooting. It should be noted that the embodiment of the present application does not limit the specific hardware running information and log information to be collected, which can be set according to the actual application requirements. The embodiment of the present application also does not limit the number of servers to be monitored, which can be either a single server or multiple servers. Further, when multiple servers are collected, multiple data collectors can be used to collect data from the servers to improve the data collection performance. In addition, a monitoring manager can also be added to control the above data collectors, which is used to schedule the data collectors. Specifically, the monitoring manager can collect the communication information of the servers to be managed, and then control the manager to schedule the data collectors to collect information from the specified servers according to the specific task content.

[0058] In one possible case, collecting the hardware running information and the log information of the server can include:

[0059] Step 11: controlling the monitoring manager to schedule a preset number of data collectors to collect the hardware running information and the log information by using the pre-stored server communication information.

[0060] It should be noted that the embodiment of the present application does not limit the specific value of the preset number, which can be set according to the actual application requirements. For ease of understanding, please refer to Figure 2 , Figure 2The schematic diagram of the architecture of the state monitoring module provided in the embodiments of the present application is shown. It should be further noted that the embodiments of the present application do not limit the specific manner in which the data collector acquires relevant information. In order to improve the collection efficiency, the data collector can acquire relevant information from the server in an asynchronous non-blocking manner. In addition, in order to improve the performance of a single data collector, multiple threads can be set for each collector to process information collection. The embodiments of the present application do not limit the specific implementation manner of the asynchronous non-blocking manner, nor the number of threads in each data collector, which can be set according to actual application requirements. Of course, it can be understood that, before information collection, the data collector can perform network testing by using the allocated server communication information to determine whether a network connection can be established with the target server. If the network connection can be established, information collection is performed. If the network connection cannot be established, an alarm information is generated and corresponding alarm can be performed.

[0061] In a possible case, the data collector collects hardware running information and log information, which can include:

[0062] Step 21: The data collector determines whether a network connection can be established with the server by using server communication information. If yes, step 22 is performed. If no, step 23 is performed.

[0063] Step 22: Hardware running information and log information are acquired from the server in a multi-thread, asynchronous non-blocking manner.

[0064] Step 23: Alarm information indicating a network connection exception is output.

[0065] Further, the data collector can collect hardware running information from the server by using an IPMI protocol (Intelligent Platform Management Interface) and collect log information from the server by using a BMC interface (Baseboard Management Controller). The specific acquisition steps can refer to related technologies, which will not be described herein.

[0066] S102: Numerical detection and / or state detection are performed on the hardware running information to generate a first detection result.

[0067] For the hardware running information, the embodiments of the present application can directly perform numerical detection or state detection to determine whether the related hardware is abnormal. For numerical detection, it can be detected whether a current value corresponding to the hardware running information exceeds a preset range, or whether there is a mutation between the current value and a historical value (i.e., whether a difference between the two data exceeds a preset threshold) to determine whether the related hardware is abnormal.

[0068] In a possible case, the numerical detection on the hardware running information can include:

[0069] Step 31: determining whether the current numerical value in the hardware running information is beyond the preset range; if yes, proceeding to step 32; if no, proceeding to step 33;

[0070] Step 32: generating a first detection result indicating that the hardware running information is abnormal;

[0071] Step 33: generating a first detection result indicating that the hardware running information is normal.

[0072] In a possible case, the numerical detection on the hardware running information can include:

[0073] Step 41: obtaining a historical numerical value corresponding to the hardware running information, and determining whether the difference between the historical numerical value and the current numerical value is greater than a preset threshold; if yes, proceeding to step 42; if no, proceeding to step 43;

[0074] Step 42: generating a first detection result indicating that the hardware running information is abnormal;

[0075] Step 43: generating a first detection result indicating that the hardware running information is normal.

[0076] It should be noted that the preset range and the preset threshold are not limited in the embodiments of the present application, and can be set according to actual application requirements.

[0077] Further, for the state detection, if the hardware running information contains specific state information, it can also be determined whether the state information indicates an abnormality, and if yes, it can be determined that the related hardware is in an abnormal condition.

[0078] In a possible case, the numerical detection on the hardware running information can include:

[0079] Step 51: determining whether the state information in the hardware running information is an abnormal state; if yes, proceeding to step 52; if no, proceeding to step 53;

[0080] Step 52: generating a first detection result indicating that the hardware running information is abnormal;

[0081] Step 53: generating a first detection result indicating that the hardware running information is normal.

[0082] It should be noted that the specific form of the first detection result is not limited in the embodiments of the present application, which can be used to indicate whether the related hardware is abnormal, and can also include specific abnormal types, generation time, etc., which can be set according to actual application requirements.

[0083] S103, performing abnormal log correlation detection on the log information to generate a second detection result.

[0084] For the log information, the embodiment of the application will adopt the log correlation manner to perform detection. This is because the fault is usually caused by multiple factors, and it is difficult to eliminate the fault and easy to cause secondary maintenance if only a single fault is repaired. The analysis of the correlation relationship between multiple faults can more deeply analyze the causes of the induced fault, so as to enable the maintenance personnel to eliminate the server fault and reduce the probability of secondary maintenance. It should be noted that the embodiment of the application does not limit the specific manner of log correlation detection. For example, the log information can be matched by using a preset correlation relationship to determine the abnormal correlation relationship in the log information. Of course, in order to improve the processing efficiency, a pre-set fault knowledge base can also be used to extract the key information corresponding to the abnormal event from the log information, such as time information, frequency of occurrence and information of related components, and a plurality of preset correlation relationships are used to match the above key information. It should be noted that the embodiment of the application does not limit the specific correlation relationship. For example, it can be an abnormal system event correlation relationship (which can represent the correlation relationship between abnormal system events) set based on system event logs, or an abnormal sensor data correlation relationship (which can represent the correlation relationship between abnormal sensor data) set based on sensor data records, or a self-defined correlation relationship, which can be set according to actual application requirements. The above correlation relationship can be used for simple matching, and can also be used for screening. For example, the log information is first screened in the first round by using the abnormal system event correlation relationship, then screened in the second round by using the abnormal sensor data correlation relationship, and then screened in the third round by using the self-defined correlation relationship. The actual application requirements can be set.

[0085] In one possible case, the abnormal log correlation detection on the log information to generate a second detection result can include:

[0086] Step 61: Extracting time information, frequency information and component information corresponding to the abnormal event from the log information by using a pre-set fault knowledge base, and integrating the time information, frequency information and component information into abnormal information;

[0087] Step 62: judging whether the abnormal information matches the pre-set abnormal system event correlation relationship and / or abnormal sensor data correlation relationship and / or self-defined correlation relationship; if yes, go to step 63; if no, go to step 64;

[0088] Step 63: generating a second detection result indicating that the log information has an abnormality;

[0089] Step 64: generating a second detection result indicating that the log information has no abnormality.

[0090] For ease of understanding, please refer toFigure 3 , Figure 3 A schematic diagram of a log analysis framework provided by an embodiment of the present application, wherein SEL analysis refers to log analysis using abnormal system event correlation, SDR analysis refers to log analysis using abnormal sensor data correlation, and typical analysis refers to log analysis using a self-defined correlation.

[0091] It should be noted that embodiments of the present application do not limit the specific form of the second detection result, which can be used to indicate whether the relevant log information is abnormal, and can also include specific abnormal types, generation time, etc., which can be set according to actual application requirements.

[0092] S104, when the first detection result and / or the second detection result is an abnormal result, generating and outputting alarm information corresponding to the abnormal result.

[0093] After determining that the first detection result or the second detection result is an abnormal result, the corresponding alarm information can be generated and output. Embodiments of the present application do not limit the specific form of the alarm information, for example, E=(U, S, D, T) can be constructed to represent the early warning event information, wherein U is the early warning event identifier, S is the early warning event source, D is the early warning description information, and T is the early warning generation time. Embodiments of the present application do not limit the specific way of output, for example, it can be output to the display device of the target device, or it can be output to the target device in the form of email or short message. Of course, before outputting the alarm information, the information can also be filtered, for example, repeated information can be filtered, or key information in the alarm information can be determined by using the correlation relationship and output, which can be set according to actual application requirements.

[0094] Further, embodiments of the present application can use a distributed framework to implement the above steps, for example, step S101 can set a state monitoring module, steps S102 and S103 can set a warning judgment module, step S103 can set a warning notification module, alarm filtering can set a warning filtering module, and the collection module can use an information queue to send data to the analysis module. In this way, when the detection requirement changes, the relevant modules can be replaced or expanded to improve the expansibility and availability of the system. For ease of understanding, please refer to Figure 4 , Figure 4 A general framework diagram of a server anomaly detection device provided by an embodiment of the present application.

[0095] Based on the above embodiment, the application can first automatically collect the hardware running information and the log information of the server. For the hardware running information, the application can adopt the numerical detection and state detection methods to process, so as to give a warning for the fault condition of the specific hardware. In addition, for the log information, the application can also adopt the abnormal log correlation detection method to process, that is, the correlation between the log information can be detected to determine whether there is a correlation between multiple server abnormal events, and the above correlation is warned, so that the administrator can maintain the server according to the correlation abnormal events involved in the warning, which can effectively improve the eradication rate of server faults and reduce the possibility of secondary maintenance. In other words, the application can improve the automation degree of server abnormal detection, and can improve the positioning efficiency of the administrator to the server fault and the success rate of eradicating these faults through numerical detection, state detection of hardware running information and abnormal log correlation detection of log information.

[0096] Based on the above embodiment, in order to improve the utilization value of the alarm information, the alarm information can also be filtered before being output. The specific way of filtering the alarm information is introduced below. In one possible case, before outputting the alarm information corresponding to the abnormal result, the following can be included:

[0097] S201, input all alarm information generated in a preset period into the corresponding node of a preset correlation tree; the preset correlation tree is constructed by using a preset alarm information correlation.

[0098] The embodiment of the application adopts a preset correlation tree to filter all alarm information generated in a preset period, wherein the correlation tree is constructed by using a preset alarm information correlation. This is because there is usually a correlation between faults, for example, the failure of a certain hardware is easy to cause the failure of other hardware. In other words, the root of multiple faults in the server may be one or a few key faults; accordingly, to eradicate the server fault, the repair focus should also be the repair of the key faults when repairing the server. Therefore, the application constructs a preset correlation tree according to a preset alarm information correlation, and filters the alarm information by using this tree structure, which can select the key alarm from the many alarms, so as to improve the utilization value of the alarm information. It can be understood that each node of the tree corresponds to a specific alarm information, and the connection relationship between the nodes represents the correlation between the alarm information. It should be noted that the embodiment of the application does not limit the specific alarm information correlation, nor the specific form of the preset correlation tree, as long as the above description is met.

[0099] S202, using a depth-first traversal algorithm to traverse the preset correlation tree to determine the root node in the node corresponding to all alarm information.

[0100] It can be understood that the node corresponding to the alarm information in the preset period also has a corresponding substructure in the preset association tree, and the substructure also has a corresponding root node, and the node means that the corresponding alarm information belongs to the key alarm, so that only the alarm information corresponding to the root node is output, that is, the effect of improving the utilization value of the alarm information can be achieved.

[0101] Correspondingly, the alarm information corresponding to the abnormal result can include:

[0102] S203, output the alarm information corresponding to the root node.

[0103] Based on the above embodiment, the preset association tree can be used to filter the alarm information, that is, the information filtering can be performed according to the association relationship between the alarm information, and the key alarm information can be effectively extracted to improve the server troubleshooting effect and eradication rate.

[0104] The server anomaly detection device, electronic equipment and computer readable storage medium provided by the embodiment of the application will be introduced below, and the server anomaly detection device, electronic equipment and computer readable storage medium described below can be mutually corresponding with the server anomaly detection method described above.

[0105] Please refer to Figure 5 , Figure 5 The structure block diagram of a server anomaly detection device provided by the embodiment of the application, the device can include:

[0106] The acquisition module 501 is used for acquiring the hardware running information and the log information of the server;

[0107] The first detection module 502 is used for numerical detection and / or state detection on the hardware running information, and generates a first detection result;

[0108] The second detection module 503 is used for abnormal log association detection on the log information, and generates a second detection result;

[0109] The alarm module 504 is used for generating and outputting the alarm information corresponding to the abnormal result when the first detection result and / or the second detection result is an abnormal result.

[0110] Optionally, the acquisition module 501 can include:

[0111] The monitoring manager sub-module is used for controlling the monitoring manager to schedule a preset number of data collectors to collect the hardware running information and the log information by using the pre-stored server communication information.

[0112] Optionally, the acquisition module 501 can include:

[0113] The data collector submodule is configured to determine whether the server communication information indicates that a network connection with the server can be established, and if so, acquire hardware running information and log information from the server in a multithreaded, asynchronous and non-blocking manner, and if not, output alarm information indicating that the network connection is abnormal.

[0114] Optionally, the second detection module 503 can include:

[0115] The extraction submodule is configured to extract time information, frequency information and component information corresponding to the abnormal event from the log information using a preset fault knowledge base, and integrate the time information, the frequency information and the component information into the abnormal information.

[0116] The first judgment submodule is configured to determine whether the abnormal information matches a preset abnormal system event association relationship and / or an abnormal sensor data association relationship and / or a custom association relationship, and if so, generate a second detection result indicating that the log information is abnormal, and if not, generate a second detection result indicating that the log information is not abnormal.

[0117] Optionally, the first detection module 502 can include:

[0118] The second judgment submodule is configured to determine whether the current value in the hardware running information is outside a preset range, and if so, generate a first detection result indicating that the hardware running information is abnormal, and if not, generate a first detection result indicating that the hardware running information is not abnormal.

[0119] The third judgment submodule is configured to acquire a historical value corresponding to the hardware running information, and determine whether a difference between the historical value and the current value is greater than a preset threshold, and if so, generate a first detection result indicating that the hardware running information is abnormal, and if not, generate a first detection result indicating that the hardware running information is not abnormal.

[0120] Optionally, the first detection module 502 can include:

[0121] The fourth judgment submodule is configured to determine whether the state information in the hardware running information is an abnormal state, and if so, generate a first detection result indicating that the hardware running information is abnormal, and if not, generate a first detection result indicating that the hardware running information is not abnormal.

[0122] Optionally, the device can further include:

[0123] The input module is configured to input all alarm information generated within a preset period into corresponding nodes of a preset association tree; and the preset association tree is constructed using a preset alarm information association relationship.

[0124] The traversing module is configured to traverse the preset correlation tree by using a depth-first traversal algorithm to determine a root node in the nodes corresponding to the alarm information;

[0125] Correspondingly, the alarm module 504 can include:

[0126] The output module is configured to output the alarm information corresponding to the root node.

[0127] The present application also provides an electronic device, which includes:

[0128] The memory is configured to store a computer program.

[0129] The processor is configured to execute the computer program to implement the steps of the server exception detection method.

[0130] Since the embodiments of the electronic device part correspond to the embodiments of the server exception detection method part, the embodiments of the electronic device part are described in the description of the embodiments of the server exception detection method part, and will not be described here.

[0131] The present application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the server exception detection method of any of the above embodiments.

[0132] Since the embodiments of the computer readable storage medium part correspond to the embodiments of the server exception detection method part, the embodiments of the storage medium part are described in the description of the embodiments of the server exception detection method part, and will not be described here.

[0133] The embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts of each embodiment can be referred to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the related parts can be referred to the method part.

[0134] The skilled person can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of the two. In order to clearly show the interchangeability of hardware and software, the components and steps of each example have been described in the above description. Whether the functions are realized by hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0135] The steps of a method or algorithm described in connection with the embodiments disclosed herein can be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module can reside in random access memory (RAM), flash memory, read-only memory (ROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, hard disk can be used for tangibly embodying the software module.

[0136] The above describes in detail a server exception detection method, device, electronic equipment and storage medium provided by the present application. The principles and implementation modes of the present application are described by applying specific examples in this paper. The above description of the embodiments is only used to help understand the method of the present application and its core idea. It should be pointed out that for ordinary skilled persons in the art, without departing from the principles of the present application, the present application can be improved and modified in several ways. These improvements and modifications also fall within the protection scope of the claims of the present application.

Claims

1. A method for detecting server anomalies, characterized in that, include: Collect server hardware operation information and log information; Perform numerical detection and / or status detection on the hardware operation information to generate a first detection result; Anomaly log correlation detection is performed on the log information to generate a second detection result; When the first detection result and / or the second detection result are abnormal results, an alarm message corresponding to the abnormal result is generated and output. Before outputting the alarm information corresponding to the abnormal result, the following is also included: All alarm information generated within a preset period is input into the corresponding node of a preset association tree; the preset association tree is constructed using preset alarm information association relationships, and the alarm information association relationships represent the association relationships between faults; The preset association tree is traversed using a depth-first traversal algorithm to determine the nodes corresponding to all the alarm information, the substructures corresponding to the nodes of the alarm information in the preset association tree, and the root nodes corresponding to the substructures. Accordingly, the alarm information corresponding to the abnormal result is output, including: Output the alarm information corresponding to the root node; The step of performing abnormal log correlation detection on the log information and generating a second detection result includes: The time information, frequency information, and component information corresponding to the abnormal events are extracted from the log information using a preset fault knowledge base, and the time information, frequency information, and component information are integrated into the abnormal information. The log information is filtered sequentially using preset abnormal system event associations, abnormal sensor data associations, and custom associations to determine whether the abnormal information matches the preset abnormal system event associations, abnormal sensor data associations, or custom associations. If so, a second detection result indicating that the log information is abnormal is generated; If not, a second detection result indicating that the log information does not contain any abnormalities is generated; the hardware operation information and log information of the collection server include: The control monitoring manager uses pre-stored server communication information to schedule a preset number of data collectors to collect the hardware operation information and log information; The data collector collects the hardware operation information and log information, including: The data collector uses the server communication information to determine whether a network connection can be established with the server. If so, the hardware operation information and log information are obtained from the server in a multi-threaded, asynchronous, non-blocking manner; If not, output an alarm message indicating a network connection problem.

2. The server anomaly detection method according to claim 1, characterized in that, The numerical detection of the hardware operating information includes: Determine whether the current value in the hardware operation information exceeds a preset range; If so, a first detection result indicating an anomaly in the hardware operation information is generated; If not, a first detection result indicating that the hardware operating information does not have any abnormalities is generated; and / or, Obtain historical values ​​corresponding to the hardware operation information, and determine whether the difference between the historical value and the current value is greater than a preset threshold; If so, a first detection result indicating an anomaly in the hardware operation information is generated; If not, a first detection result is generated indicating that there are no abnormalities in the hardware operation information.

3. The server anomaly detection method according to claim 1, characterized in that, The step of detecting the status of the hardware operating information includes: Determine whether the status information in the hardware operation information is in an abnormal state; If so, a first detection result indicating an anomaly in the hardware operation information is generated; If not, a first detection result is generated indicating that there are no abnormalities in the hardware operation information.

4. A server anomaly detection device, characterized in that, include: The data acquisition module is used to collect hardware operation information and log information from the server. The first detection module is used to perform numerical detection and / or status detection on the hardware operation information and generate a first detection result. The second detection module is used to perform abnormal log correlation detection on the log information and generate a second detection result; The alarm module is used to generate and output alarm information corresponding to the abnormal result when the first detection result and / or the second detection result is an abnormal result; The input module is used to input all alarm information generated within a preset period into the corresponding node of a preset association tree; The preset association tree is constructed using preset alarm information association relationships, which represent the association relationships between faults; The traversal module is used to traverse the preset association tree using a depth-first traversal algorithm, determine the nodes corresponding to all the alarm information, determine the substructures corresponding to the nodes of the alarm information in the preset association tree, and determine the root node corresponding to the substructure. Correspondingly, the alarm module includes: The output module is used to output the alarm information corresponding to the root node; The step of performing abnormal log correlation detection on the log information and generating a second detection result includes: The time information, frequency information, and component information corresponding to the abnormal events are extracted from the log information using a preset fault knowledge base, and the time information, frequency information, and component information are integrated into the abnormal information. Determine whether the abnormal information matches a preset abnormal system event correlation and / or an abnormal sensor data correlation and / or a custom correlation; If so, a second detection result indicating that the log information is abnormal is generated; If not, a second detection result is generated indicating that the log information does not contain any abnormalities; The acquisition module includes: The monitoring manager submodule is used to control the monitoring manager to schedule a preset number of data collectors to collect the hardware operation information and log information using pre-stored server communication information; The data acquisition submodule is used to determine whether a network connection can be established with the server using the server communication information; if so, it obtains the hardware operation information and the log information from the server in a multi-threaded, asynchronous, non-blocking manner; if not, it outputs an alarm message indicating a network connection error.

5. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the server anomaly detection method as described in any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when loaded and executed by a processor, implement the server anomaly detection method as described in any one of claims 1 to 3.

Images