Service component anomaly detection method and system, electronic device, and storage medium

Abstract

This invention provides a service component anomaly detection method, system, electronic device, and storage medium. The service component anomaly detection method includes: determining the number of business threads of the service component based on the basic thread count corresponding to historical samples and the current thread count of the service component's process; determining a recursive sequence of confidence intervals for the CPU usage of the process corresponding to the number of business threads based on historical samples; determining the longest waiting time for the thread count to decrease based on historical samples and the confidence intervals in the recursive sequence; and determining whether the duration of CPU usage at the left endpoint of the confidence interval corresponding to the number of business threads being less than the number of business threads is greater than a preset multiple of the longest waiting time. If so, the service component is determined to be in an abnormal state. This invention can predict the range of CPU usage when a certain number of business threads is reached at a future point in time, achieving the goal of non-intrusive and rapid detection of whether a service component is abnormal.

Description

Technical Field

[0001] This invention relates to the field of CPU detection, and more particularly to a method and system for detecting service component anomalies, electronic devices, and storage media. Background Technology

[0002] In the internet age, with the surge in business volume, traditional architectures struggle to meet the demands of rapid business delivery, leading to the rise of microservice architectures. Because microservices decompose business logic, the number of running service component processes in the system increases, consequently increasing the difficulty of operation and maintenance. For example, when the system becomes sluggish, it's difficult to determine which service component is malfunctioning. Many techniques exist for determining whether a service component is malfunctioning, such as checking service component logs, monitoring service component status interfaces, checking the CPU / memory resource usage of service component processes, examining the call stack of service component processes, and injecting critical code locations into service component processes to monitor the call process. However, these techniques suffer from the following problems.

[0003] The drawbacks of viewing service component logs are that the log volume can be very large, making it difficult to quickly locate problems through logs in many cases. The drawback of monitoring service component status interfaces is that it cannot monitor service components that do not provide status interfaces. The drawback of viewing the CPU / memory resource usage of service component processes is that a single metric is difficult to reflect whether a service component is abnormal; furthermore, an abnormal service component may not have high CPU / memory usage, such as a deadlocked service component. The drawback of viewing the call stack of service component processes is that in a microservice environment, because business logic is split into multiple components, it is difficult to quickly locate problems through the stack trace. The drawback of injecting critical code locations into service component processes is that it intrudes into the service component's call process, which is more difficult to develop and, if not properly controlled, may have adverse effects on the business. Summary of the Invention

[0004] This invention provides a service component anomaly detection method and system, electronic device and storage medium to address the technical deficiencies existing in the prior art.

[0005] This invention provides a method for detecting service component anomalies, comprising:

[0006] S1: Based on the basic thread count corresponding to the historical samples and the current thread count of the service component process, determine the business thread count of the service component, and based on the historical samples, determine the confidence interval recursive sequence of the process CPU usage corresponding to the business thread count.

[0007] S2: Based on historical samples and the confidence intervals in the recursive sequence of the confidence intervals, determine the longest waiting time for the number of threads to decrease;

[0008] S3: Determine whether the duration of CPU usage at the left endpoint of the confidence interval corresponding to the number of business threads being less than the number of business threads is greater than a preset multiple of the longest waiting time. If so, determine that the service component is in an abnormal state.

[0009] According to the service component anomaly detection method provided by the present invention, determining the number of business threads of the service component based on the basic thread count corresponding to historical samples and the current thread count of the service component's process includes:

[0010] The number of business threads of the service component is obtained by subtracting the number of basic threads corresponding to the historical samples from the current number of threads of the service component process. The number of basic threads corresponding to the historical samples is the number of threads when the process CPU usage is close to 0 in the historical samples of the service component during normal operation.

[0011] According to the service component anomaly detection method provided by the present invention, the recursive sequence of confidence intervals for determining the process CPU usage corresponding to the number of business threads based on historical samples includes:

[0012] The confidence interval for determining the CPU utilization corresponding to the number of business threads is the confidence interval (minV). n maxV n );

[0013] Based on the confidence interval of CPU usage corresponding to the number of business threads, determine the recursive sequence of confidence intervals of process CPU usage corresponding to the number of business threads.

[0014] Where n represents the number of business threads, minV n Let maxV be the left endpoint of the confidence interval. n This represents the right endpoint of the confidence interval.

[0015] According to the service component anomaly detection method provided by the present invention, determining the longest waiting time for the decrease in the number of threads based on historical samples and the confidence interval in the recursive sequence of the confidence interval includes:

[0016] The maximum value among the historical samples where the number of business threads decreased and the CPU usage was less than the left endpoint of the confidence interval was selected as the longest waiting time for the number of threads to decrease.

[0017] The present invention also provides a service component anomaly detection system, comprising:

[0018] The business thread determination module is used to determine the number of business threads of a service component based on the basic thread count corresponding to historical samples and the current thread count of the service component process, and to determine the confidence interval recursive sequence of the process CPU usage corresponding to the number of business threads based on historical samples.

[0019] The longest waiting time determination module is used to determine the longest waiting time for the number of threads to decrease based on historical samples and the confidence interval in the recursive sequence of the confidence interval.

[0020] The anomaly detection module is used to determine whether the duration of CPU usage at the left end of the confidence interval corresponding to the number of business threads being less than the number of business threads is greater than a preset multiple of the longest waiting time. If so, the service component is determined to be in an abnormal state.

[0021] According to the service component anomaly detection system provided by the present invention, the business thread count determination module includes:

[0022] The business thread number determination unit is used to obtain the business thread number of the service component by subtracting the basic thread number corresponding to the historical sample from the current thread number of the process of the service component. The basic thread number corresponding to the historical sample is the number of threads when the process CPU usage is close to 0 in the historical samples of the service component during normal operation.

[0023] According to the service component anomaly detection system provided by the present invention, the business thread count determination module includes:

[0024] The confidence interval determination unit is used to determine the confidence interval (minV) of the CPU utilization corresponding to the number of business threads. n maxV n );

[0025] The confidence interval recursive sequence determination unit is used to determine the confidence interval recursive sequence of process CPU usage corresponding to the number of business threads based on the confidence interval of CPU usage corresponding to the number of business threads.

[0026] Where n represents the number of business threads, minV n Let maxV be the left endpoint of the confidence interval. n This represents the right endpoint of the confidence interval.

[0027] According to the service component anomaly detection system provided by the present invention, determining the longest waiting time for the thread count to decrease based on historical samples and the confidence interval in the recursive sequence of confidence intervals includes:

[0028] The maximum value among the historical samples where the number of business threads decreased and the CPU usage was less than the left endpoint of the confidence interval was selected as the longest waiting time for the number of threads to decrease.

[0029] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of any of the above-described service component anomaly detection methods.

[0030] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the service component anomaly detection method as described above.

[0031] The service component anomaly detection method provided by this invention uses a standard deviation-based algorithm to statistically analyze the relationship between the number of business threads, CPU usage, and duration of historical samples of a microservice process. It predicts the range of CPU usage when a certain number of business threads is reached at a future point in time. If the CPU usage deviates from the predicted range for an extended period, the service component is deemed anomaly. This invention eliminates the need for extensive log or call stack analysis, requires no status interface from the service component, and avoids injecting code into the service component to obtain anomaly results, achieving a non-intrusive and rapid method for detecting service component anomalies. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0033] Figure 1 This is a flowchart illustrating a service component anomaly detection method provided in an embodiment of the present invention;

[0034] Figure 2 This is a schematic diagram of the number of threads in historical data for a specific day, provided by an embodiment of the present invention;

[0035] Figure 3 This is a schematic diagram of CPU usage in historical data for a specific day, provided by an embodiment of the present invention.

[0036] Figure 4 This is a schematic diagram of the number of threads in the current data provided in an embodiment of the present invention;

[0037] Figure 5 This is a schematic diagram of CPU utilization in the current data provided in an embodiment of the present invention;

[0038] Figure 6 This is a schematic diagram of the service component anomaly detection system provided by the present invention;

[0039] Figure 7 This is a schematic diagram of the structure of the electronic device provided by the present invention; Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0041] This invention discloses a method for detecting service component anomalies, see [link to relevant documentation]. Figure 1 ,include:

[0042] S1: Based on the basic thread count corresponding to the historical samples and the current thread count of the service component process, determine the business thread count of the service component, and based on the historical samples, determine the confidence interval recursive sequence of the process CPU usage corresponding to the business thread count.

[0043] S2: Based on historical samples and the confidence intervals in the recursive sequence of the confidence intervals, determine the longest waiting time for the number of threads to decrease;

[0044] S3: Determine whether the duration of CPU usage at the left endpoint of the confidence interval corresponding to the number of business threads being less than the number of business threads is greater than a preset multiple of the longest waiting time. If so, determine that the service component is in an abnormal state.

[0045] The preset multiplier can be set based on experience. Preferably, if the duration of CPU usage Wn at the left endpoint of the confidence interval is greater than twice the longest waiting time t for the number of threads to decrease, then the current service component is determined to be in an abnormal state.

[0046] The confidence interval corresponding to the number of business threads is the confidence interval corresponding to a certain number of business threads in a process.

[0047] According to the service component anomaly detection method provided by the present invention, determining the number of business threads of the service component based on the basic thread count corresponding to historical samples and the current thread count of the service component's process includes:

[0048] The number of business threads of the service component is obtained by subtracting the number of basic threads corresponding to the historical samples from the current number of threads of the service component process. The number of basic threads corresponding to the historical samples is the number of threads when the process CPU usage is close to 0 in the historical samples of the service component during normal operation.

[0049] According to the service component anomaly detection method provided by the present invention, the recursive sequence of confidence intervals for determining the process CPU usage corresponding to the number of business threads based on historical samples includes:

[0050] The confidence interval for determining the CPU utilization corresponding to the number of business threads is the confidence interval (minV). n maxV n );

[0051] Based on the confidence interval of CPU usage corresponding to the number of business threads, determine the recursive sequence of confidence intervals of process CPU usage corresponding to the number of business threads.

[0052] Where n represents the number of business threads, maxV n Let maxV be the left endpoint of the confidence interval. n This represents the right endpoint of the confidence interval.

[0053] Specifically, it includes the following steps:

[0054] Define the CPU usage Wn and duration Tn corresponding to the number of business threads N in the historical samples, and define Xn = ∑(Wn / Tn) n ×T n ) / ∑T n Historical samples are samples collected in the past.

[0055] Define the number of samples Wn corresponding to the number of business threads N as C;

[0056] Define the standard deviation of the sample Wn for the number of business threads N.

[0057] Define the confidence interval for CPU usage of the number of business threads N as (X n -S n X n +S n )

[0058] Find the confidence interval for CPU usage of the number N of uncollected business threads;

[0059] If no data is collected by the number of business threads N, then the lower limit of the confidence interval for CPU usage is (n / n-1) times the lower limit of the previous number of business threads, and the upper limit is (n / n-1) times the upper limit of the previous number of business threads. That is, the confidence interval for CPU usage of the number of business threads N that have not collected data is ((X... n-1 -S n-1 )×n / (n-1)), (X n-1 +S n-1 )×n / (n-1))

[0060] Assuming that the maximum value of the left and right endpoints of the confidence interval will not exceed the number of cores × 100%, if the calculation result exceeds this value, then the result is taken as this value.

[0061] Adjust the confidence interval (minV) of CPU usage for the number of business threads N n maxVn );

[0062] Based on actual conditions, the more threads a process with the same business logic has, the more CPU it consumes. Therefore, the confidence interval for adjusting the number of business threads N is (max(X...). n-1 -S n-1 X n -S n ), X n +S n ), simplified as (minV n maxV n );

[0063] Find the recursive sequence of confidence intervals for the number of business threads and CPU usage: (minV1, maxV1), (minV2, maxV2), ..., (minV1, maxV2) n maxV n ).

[0064] According to the service component anomaly detection method provided by the present invention, determining the longest waiting time for the decrease in the number of threads based on historical samples and the confidence interval in the recursive sequence of the confidence interval includes:

[0065] The maximum value among the historical samples where the number of business threads decreased, and the duration of CPU usage less than the left endpoint of the confidence interval, is selected as the longest waiting time for the number of threads to decrease.

[0066] In other words, the maximum value among the durations of CPU usage Wn less than the left endpoint of the confidence interval in historical samples where the number of business threads N decreases is taken as the longest waiting time t for the thread count to decrease. Specifically, the time difference between those historical samples where CPU usage is close to 0 and the previous CPU time of that historical sample is selected as the thread count decrease time. That is, the time difference from having business threads (i.e., more than the baseline number of threads) to having no business threads or reaching the minimum number of threads is taken as the longest waiting time for the thread count to decrease.

[0067] To further understand the method of this embodiment, an example of the technical solution of the present invention is provided below:

[0068] Step 101: Collect data on a historical day under normal conditions, including the number of threads and CPU utilization as follows: Figure 2-3 As shown.

[0069] Step 102: Based on historical samples, the basic number of threads is 12. The number of threads corresponding to low CPU utilization (<5%) is shown in Table 1 below:

[0070] Table 1

[0071] date CPU utilization Thread count date CPU utilization Thread count 2020 / 9 / 14 3:00 3 13 2020 / 9 / 14 3:05 4 13 2020 / 9 / 14 3:10 3 11 2020 / 9 / 14 3:15 3 11 2020 / 9 / 14 3:20 1 12 2020 / 9 / 14 3:25 2 12 2020 / 9 / 14 3:30 1 12 2020 / 9 / 14 3:35 1 12 2020 / 9 / 14 3:40 1 12 2020 / 9 / 14 3:45 0 12 2020 / 9 / 14 3:50 0 12 2020 / 9 / 14 3:55 4 12

[0072] Therefore, the number of threads corresponding to low CPU utilization is (13+13+11+11+12+12+12+12+12+12+12+12) / 12=12. Since the time is 5 minutes, the 5 minutes are ignored to simplify the calculation.

[0073] Step 103: Based on historical samples, the CPU confidence intervals corresponding to the number of business threads under normal circumstances are obtained, as shown in Table 2 (confidence interval data table with more than 5 samples).

[0074] To reduce error, confidence intervals are not calculated for samples with fewer than 5 samples, thus yielding a confidence interval sequence.

[0075] Table 2

[0076]

[0077]

[0078] Because, based on actual conditions, the more threads a normal process with the same business has, the more CPU it occupies, the left endpoint of the confidence interval for the number of threads 8, 31, 38, and 45 has been adjusted compared to Table 2.

[0079] In addition, the confidence interval for the number of uncollected threads is estimated. For example, the confidence interval for 50 business threads is (371.2×50 / 45, 439.79×50 / 45), which is (412.4, 488.66).

[0080] Step 104: Calculate the longest waiting time t for the number of threads to decrease.

[0081] As shown in Table 3 below, it takes 10 minutes for the number of data service threads to drop below 0. Therefore, the longest waiting time for the number of threads to decrease is 10 minutes.

[0082] Table 3

[0083]

[0084] Step 105, as follows Figure 4-5 As shown in the figure, the currently collected data, including the number of threads and CPU utilization, are as follows: Figure 4-5 As shown in the figure. Suppose that the CPU usage of 16 business threads is consistently less than the left endpoint of the confidence interval (96.66, 155.63) for 20 minutes, then the current service component is determined to be in an abnormal state. Figure 4-5 The status is abnormal (Note: In practice, this could be due to an upgrade to an incorrect application version, or a deadlock occurring in some logic within the application, which would freeze the request thread). Figure 4-5The 28 threads are equivalent to 16 business threads, since the basic thread count is 12.

[0085] If, in the future, the CPU usage of 50 business threads is consistently less than the left endpoint of the predicted confidence interval (412.4, 488.66) for 20 minutes, then the current service component is determined to be in an abnormal state.

[0086] The data acquisition method in this embodiment of the invention can be selected from the following methods:

[0087] Methods for collecting thread counts for multiple microservices: for example, the threads field in proc / microservice pid / status;

[0088] The method for collecting CPU data from multiple microservices is as follows: For example, the 14th and 15th items in proc / microservice pid / status are calculated and merged (specifically, the values ​​collected at 30-second intervals are subtracted, divided by 30, and converted to CPU clock values).

[0089] The collected data from multiple nodes is reported to the server, which then stores the data in its database.

[0090] Table 3 below shows the monitoring data for one day.

[0091] Table 3

[0092]

[0093]

[0094]

[0095]

[0096]

[0097] As can be seen from the above embodiments, compared with viewing service component logs, the advantage of the present invention is that it eliminates the need for manual viewing of service component logs. It can determine whether the service is abnormal by using confidence intervals, thereby saving labor costs.

[0098] Compared with the status interface of the monitoring service component, the advantage of this invention is that it does not require the monitoring service component to provide a status interface. It can determine whether the service is abnormal by collecting the confidence interval corresponding to the operating system level data of the service, thereby expanding the scope of service objects that can be monitored.

[0099] Compared to viewing the CPU / memory resource usage of service component processes, the advantage of this invention is that it eliminates the need to manually set an abnormal threshold for the value of a single indicator such as CPU usage of a process. Furthermore, it does not require a high CPU usage to determine whether a service is abnormal; rather, it can determine whether a service is abnormal by using a confidence interval. This simplifies the configuration process and improves the accuracy of the judgment.

[0100] Compared to viewing the call stack of service component processes, the advantage of this invention is that it eliminates the need for manual or tool-assisted analysis of service component call stacks. It can determine whether a service is abnormal simply by analyzing the confidence interval, thereby saving labor costs.

[0101] Compared with injecting critical code locations into the service component process, the advantage of this invention is that it does not intrude on the service component calling process and will not have an adverse impact on business operations.

[0102] Therefore, compared with the prior art, the present invention does not require spending too much time to check logs or call stacks, nor does it require the service component to provide a status interface or inject code into the service component. It also performs joint processing on the two indicators of the number of service threads and CPU utilization, and can obtain abnormal results without spending too much manual analysis. Thus, it overcomes the various problems of the aforementioned technologies and achieves the goal of non-intrusive and rapid detection of whether the service component is abnormal.

[0103] In the above embodiments, the data is collected by nodes on each machine from the monitored microservices.

[0104] The service component anomaly detection system provided by the present invention is described below. The service component anomaly detection system described below can be referred to in correspondence with the service component anomaly detection method described above.

[0105] This invention discloses a service component anomaly detection system, see [link to relevant documentation]. Figure 6 ,include:

[0106] The present invention also provides a service component anomaly detection system, comprising:

[0107] The business thread determination module 10 is used to determine the number of business threads of the service component based on the basic thread count corresponding to the historical samples and the current thread count of the service component process, and to determine the confidence interval recursive sequence of the process CPU usage corresponding to the number of business threads based on the historical samples.

[0108] The longest waiting time determination module 20 is used to determine the longest waiting time for the number of threads to decrease based on historical samples and the confidence interval in the recursive series of the confidence interval;

[0109] The anomaly detection module 30 is used to determine whether the duration of CPU usage at the left end of the confidence interval corresponding to the number of business threads being less than the number of business threads is greater than a preset multiple of the longest waiting time. If so, it is determined that the service component is in an abnormal state.

[0110] According to the service component anomaly detection system provided by the present invention, the business thread count determination module includes:

[0111] The business thread number determination unit is used to obtain the business thread number of the service component by subtracting the basic thread number corresponding to the historical sample from the current thread number of the process of the service component. The basic thread number corresponding to the historical sample is the number of threads when the process CPU usage is close to 0 in the historical samples of the service component during normal operation.

[0112] According to the service component anomaly detection system provided by the present invention, the business thread count determination module includes:

[0113] The confidence interval determination unit is used to determine the confidence interval (minV) of the CPU utilization corresponding to the number of business threads. n maxV n );

[0114] The confidence interval recursive sequence determination unit is used to determine the confidence interval recursive sequence of process CPU usage corresponding to the number of business threads based on the confidence interval of CPU usage corresponding to the number of business threads.

[0115] Where n represents the number of business threads, minV n Let maxV be the left endpoint of the confidence interval. n This represents the right endpoint of the confidence interval.

[0116] According to the service component anomaly detection system provided by the present invention, determining the longest waiting time for the thread count to decrease based on historical samples and the confidence interval in the recursive sequence of confidence intervals includes:

[0117] The maximum value among the historical samples where the number of business threads decreased and the CPU usage was less than the left endpoint of the confidence interval was selected as the longest waiting time for the number of threads to decrease.

[0118] Figure 7A schematic diagram of the physical structure of an electronic device is provided. This electronic device may include: a processor 710, a communication interface 720, a memory 730, and a communication bus 740. The processor 710, communication interface 720, and memory 730 communicate with each other via the communication bus 740. The processor 710 can invoke logical instructions from the memory 730 to execute a service component anomaly detection method. This method includes:

[0119] S1: Based on the basic thread count corresponding to the historical samples and the current thread count of the service component process, determine the business thread count of the service component, and based on the historical samples, determine the confidence interval recursive sequence of the process CPU usage corresponding to the business thread count.

[0120] S2: Based on historical samples and the confidence intervals in the recursive sequence of the confidence intervals, determine the longest waiting time for the number of threads to decrease;

[0121] S3: Determine whether the duration of CPU usage at the left endpoint of the confidence interval corresponding to the number of business threads being less than the number of business threads is greater than a preset multiple of the longest waiting time. If so, determine that the service component is in an abnormal state.

[0122] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0123] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, wherein when the program instructions are executed by a computer, the computer is able to execute a service component anomaly detection method, the method comprising:

[0124] S1: Based on the basic thread count corresponding to the historical samples and the current thread count of the service component process, determine the business thread count of the service component, and based on the historical samples, determine the confidence interval recursive sequence of the process CPU usage corresponding to the business thread count.

[0125] S2: Based on historical samples and the confidence intervals in the recursive sequence of the confidence intervals, determine the longest waiting time for the number of threads to decrease;

[0126] S3: Determine whether the duration of CPU usage at the left endpoint of the confidence interval corresponding to the number of business threads being less than the number of business threads is greater than a preset multiple of the longest waiting time. If so, determine that the service component is in an abnormal state.

[0127] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform a service component anomaly detection method, the method comprising:

[0128] S1: Based on the basic thread count corresponding to the historical samples and the current thread count of the service component process, determine the business thread count of the service component, and based on the historical samples, determine the confidence interval recursive sequence of the process CPU usage corresponding to the business thread count.

[0129] S2: Based on historical samples and the confidence intervals in the recursive sequence of the confidence intervals, determine the longest waiting time for the number of threads to decrease;

[0130] S3: Determine whether the duration of CPU usage at the left endpoint of the confidence interval corresponding to the number of business threads being less than the number of business threads is greater than a preset multiple of the longest waiting time. If so, determine that the service component is in an abnormal state.

[0131] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0132] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0133] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting anomalies in a service component, characterized in that, include: S1: Subtract the number of basic threads corresponding to the historical samples from the current number of threads in the process of the service component to obtain the number of business threads of the service component. The number of basic threads corresponding to the historical samples is the number of threads when the process CPU usage is close to 0 in the historical samples of the service component's normal operation. Based on the historical samples, a recursive sequence of confidence intervals of process CPU usage corresponding to the number of business threads is determined. S2: Based on historical samples and the confidence intervals in the recursive sequence of the confidence intervals, determine the longest waiting time for the number of threads to decrease; S3: Determine whether the duration of CPU usage at the left endpoint of the confidence interval corresponding to the number of business threads being less than the number of business threads is greater than a preset multiple of the longest waiting time. If so, determine that the service component is in an abnormal state.

2. The service component anomaly detection method according to claim 1, characterized in that, The recursive sequence of confidence intervals for determining the process CPU usage corresponding to the number of business threads based on historical samples includes: The confidence interval for determining the CPU usage corresponding to the number of business threads is the confidence interval (( )); Based on the confidence interval of CPU usage corresponding to the number of business threads, determine the recursive sequence of confidence intervals of process CPU usage corresponding to the number of business threads. Where n represents the number of business threads, The left endpoint of the confidence interval is... This represents the right endpoint of the confidence interval.

3. The service component anomaly detection method according to claim 1, characterized in that, The determination of the longest waiting time for the number of threads to decrease, based on historical samples and the confidence intervals in the recursive series of confidence intervals, includes: The maximum value among the historical samples where the number of business threads decreased and the CPU usage was less than the left endpoint of the confidence interval was selected as the longest waiting time for the number of threads to decrease.

4. A service component anomaly detection system, characterized in that, include: The business thread determination module is used to obtain the business thread number of the service component by subtracting the basic thread number corresponding to the historical sample from the current thread number of the service component process. The basic thread number corresponding to the historical sample is the thread number when the process CPU usage is close to 0 in the historical sample of the service component's normal operation. Based on the historical sample, the module determines the recursive sequence of the confidence interval of the process CPU usage corresponding to the business thread number. The longest waiting time determination module is used to determine the longest waiting time for the number of threads to decrease based on historical samples and the confidence interval in the recursive sequence of the confidence interval. The anomaly detection module is used to determine whether the duration of CPU usage at the left end of the confidence interval corresponding to the number of business threads being less than the number of business threads is greater than a preset multiple of the longest waiting time. If so, the service component is determined to be in an abnormal state.

5. The service component anomaly detection system according to claim 4, characterized in that, The business thread determination module includes: The confidence interval determination unit is used to determine the confidence interval of CPU usage corresponding to the number of business threads. ); The confidence interval recursive sequence determination unit is used to determine the confidence interval recursive sequence of process CPU usage corresponding to the number of business threads based on the confidence interval of CPU usage corresponding to the number of business threads. Where n represents the number of business threads, The left endpoint of the confidence interval is... This represents the right endpoint of the confidence interval.

6. The service component anomaly detection system according to claim 4, characterized in that, The longest waiting time determination module includes: The maximum value among the historical samples where the number of business threads decreased and the CPU usage was less than the left endpoint of the confidence interval was selected as the longest waiting time for the number of threads to decrease.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the service component anomaly detection method as described in any one of claims 1 to 3.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the service component anomaly detection method as described in any one of claims 1 to 3.

Images