Alarm threshold determination method and device, equipment, storage medium and alarm system

Abstract

The application discloses an alarm threshold determination method and device, equipment, storage medium, and an alarm system. The alarm threshold determination method comprises the following steps: acquiring continuous monitoring data of a performance index of a virtual machine system in real time; determining a state result of whether the virtual machine system is in a stable state based on the continuous monitoring data of the performance index; in the case that the state result indicates that the virtual machine system is in a non-stable state, segmenting the continuous monitoring data of the performance index based on a preset method to obtain target continuous monitoring data; inputting the state result and the target continuous monitoring data into a pre-trained threshold determination model to obtain an alarm threshold of the virtual machine system, so that the virtual machine system sends an alarm information in the case that the performance index is lower than the alarm threshold. The alarm threshold determination method provided by the application can realize adaptive system itself characteristics to obtain a dynamic alarm threshold, and further guarantee that the determined alarm threshold can adapt to the current system, and ensure the accuracy of the alarm information.

Description

Technical Field

[0001] This application relates to the field of communication technology, specifically to an alarm threshold determination method, apparatus, device and storage medium, and alarm system. Background Technology

[0002] With the development of cloud computing technology, the stability of devices and related business systems on cloud platforms is receiving increasing attention from business stakeholders and operations and maintenance support providers.

[0003] Currently, operations and maintenance (O&M) support systems are generally built on cloud platforms. The performance alarm thresholds for virtual machines in these systems are typically static thresholds. When a monitored performance indicator exceeds the set static threshold, an alarm is triggered to alert both the business and O&M teams. However, as business logic becomes increasingly complex and intertwined, the operating states of underlying devices such as network storage and load balancers become increasingly difficult to maintain a fixed and unique state. If the switching of system operating states is not considered and static alarm thresholds are continued to be relied upon, inaccurate alarm information will result, making it impossible for O&M managers to grasp the actual operating status of the system. Summary of the Invention

[0004] The purpose of this application is to provide an alarm threshold determination method, apparatus, device, storage medium, and alarm system, which can solve the technical problem in the prior art that alarm thresholds lead to inaccurate alarm information after system configuration changes.

[0005] The technical solution of this application is as follows:

[0006] Firstly, a method for determining an alarm threshold is provided, comprising: acquiring continuous monitoring data of the performance indicators of a virtual machine system in real time; determining whether the virtual machine system is in a stable state based on the continuous monitoring data of the performance indicators; when the state result indicates that the virtual machine system is in an unstable state, segmenting the continuous monitoring data of the performance indicators according to a preset method to obtain target continuous monitoring data; inputting the state result and the target continuous monitoring data into a pre-trained threshold determination model to obtain an alarm threshold for the virtual machine system, so that the virtual machine system issues an alarm message when the performance indicators are lower than the alarm threshold.

[0007] In some embodiments, when the status result indicates that the virtual machine system is in a stable state, the continuous monitoring data of the status result and performance indicators are input into a pre-trained threshold determination model to obtain the alarm threshold of the virtual machine system.

[0008] In some embodiments, the continuous monitoring data of performance indicators is segmented based on a preset method, including:

[0009] Based on continuous monitoring data of multiple performance indicators, data regression analysis was performed to obtain the analysis results;

[0010] If the data fitting error in the analysis results is greater than the preset threshold, the continuous monitoring data of the segmentation performance index is used to obtain the target continuous monitoring data, which is the continuous monitoring data from the current segmentation to the next segmentation.

[0011] In some embodiments, before inputting the state results and continuous target monitoring data into a pre-trained threshold determination model, the method further includes:

[0012] Obtain the training sample set, which includes multiple training samples. Each training sample includes performance metric data and its corresponding alarm threshold threshold label.

[0013] The threshold determination model is trained using training samples until the training stopping condition is met, resulting in the trained threshold determination model.

[0014] In some embodiments, obtaining the training sample set includes:

[0015] Obtain historical performance metrics data and historical threshold labels from the resource pool;

[0016] Use historical performance metrics data from the same time period and their corresponding historical threshold labels as a training sample to obtain a training sample set;

[0017] Acquire alarm information data from the alarm system and performance metrics data from the virtual machine;

[0018] Based on alarm information data and performance index data, training samples that do not meet the preset conditions are removed from the training sample set.

[0019] In some embodiments, before training a model using a preset threshold based on training samples, the method further includes:

[0020] Obtain historical performance metrics data from the resource pool and performance metrics data collected by the agent program;

[0021] Based on historical performance data from the resource pool and performance data collected by the agent program, the initial threshold parameters in the threshold determination model are determined.

[0022] Secondly, an alarm system is provided, the system including:

[0023] The alarm threshold determination module is used to determine the alarm threshold by applying the alarm threshold determination method of the first aspect;

[0024] The data acquisition module is used to acquire performance data of the virtual machine system;

[0025] The alarm module is used to issue alarm messages when performance data falls below the alarm threshold.

[0026] Thirdly, an alarm threshold determination device is provided, the device comprising:

[0027] The first acquisition module is used to acquire continuous monitoring data of the performance indicators of the virtual machine system in real time;

[0028] The information processing module is used to determine whether the virtual machine system is in a stable state based on continuous monitoring data of performance indicators.

[0029] The data segmentation module is used to segment the continuous monitoring data of performance indicators based on a preset method to obtain the target continuous monitoring data when the status result indicates that the virtual machine system is in an unstable state.

[0030] The model prediction module is used to input the state results and target continuous monitoring data into a pre-trained threshold determination model to obtain the alarm threshold of the virtual machine system, so that the virtual machine system can issue alarm information when the performance index is lower than the alarm threshold.

[0031] Fourthly, embodiments of this application provide an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the alarm threshold determination method as described in the first aspect.

[0032] Fifthly, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the alarm threshold determination method as described in the first aspect.

[0033] The technical solutions provided by the embodiments of this application have at least the following beneficial effects:

[0034] The alarm threshold determination method provided in this application determines whether the virtual machine system is in a stable state based on continuous monitoring data of performance indicators. If the state indicates that the virtual machine system is in an unstable state, the continuous monitoring data of performance indicators is segmented using a preset method to obtain target continuous monitoring data. The state result and the target continuous monitoring data are input into a pre-trained threshold determination model to obtain the alarm threshold of the virtual machine system. In determining the alarm threshold of the virtual machine system, the method can differentiate between stable and unstable operating states, enabling adaptive acquisition of dynamic alarm thresholds based on the system's inherent characteristics. This ensures that the determined alarm threshold adapts to the current system and guarantees the accuracy of alarm information.

[0035] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0036] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application, and do not constitute an undue limitation of this application.

[0037] Figure 1 This is a schematic diagram of the structure of an alarm threshold determination system provided in an embodiment of this application;

[0038] Figure 2 This is a flowchart illustrating an alarm threshold determination method provided in an embodiment of this application;

[0039] Figure 3 This is a schematic diagram of a poor performance data model provided in an embodiment of this application;

[0040] Figure 4 This is a schematic diagram of the structure of an alarm system provided in an embodiment of this application;

[0041] Figure 5 This is a schematic diagram of the structure of an alarm threshold determination device provided in an embodiment of this application;

[0042] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0043] To enable those skilled in the art to better understand the technical solutions of this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are merely intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0044] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples consistent with some aspects of this application as detailed in the appended claims.

[0045] As can be seen from the background technology, the performance alarm threshold of virtual machines in the existing technology is generally a static threshold. Relying on static alarm thresholds will lead to inaccurate alarm information, which in turn makes it impossible for the operation and maintenance manager to grasp the actual operation of the system.

[0046] Specifically, the development of cloud computing technology has made the stability of devices and related business systems on cloud platforms increasingly important to business stakeholders and operations and maintenance (O&M) support teams. Currently, the performance alarm rules of monitoring and O&M support systems rely on fixed thresholds to ensure that monitored targets are in normal working order. Once a monitored indicator exceeds the set static threshold, an alarm is triggered to alert the business and O&M sides. As business logic becomes increasingly complex and intertwined, the operating states of underlying devices such as network storage and load balancers are difficult to maintain in a fixed and unique manner. If the switching of system operating states is not considered and fixed alarm thresholds are continued, it is easy to miss alarms, ultimately leading to O&M managers being unable to grasp the actual operating status of the system and accurately locate system problems when faults occur. Moreover, the lack of adaptive dynamic thresholds also makes it difficult for monitoring and O&M systems to identify the fluctuations in the alarm process, easily generating erroneous alarms and wasting system and human resources.

[0047] Based on the above problems, the applicant devised a dynamic alarm threshold generation method. This method uses historical data from the business system to predict business data at the target time, thereby generating dynamic alarm thresholds that vary with the running time. This improves the flexibility of alarm threshold generation, makes full and reasonable use of rich data resources, and results in more reasonable alarm thresholds.

[0048] However, the above-mentioned dynamic threshold generation method still has the following problems:

[0049] As business systems and their logic become increasingly complex, data subsets extracted based on time and year are no longer sufficient to train predictive models. Predictions obtained from such historical data over extended periods are ill-suited to the current operational status of the business system. Secondly, due to the multiple operating states of the system, the predictive model lacks training to differentiate between steady-state and non-steady-state conditions. Consequently, the performance thresholds obtained from this training lack universality across various system operating states. Thirdly, the training data relies solely on historical business data, lacking alternative data sources for reference. This prevents the optimization of alarm thresholds through training results based on the correlation of multiple data sets. Finally, since alarm thresholds are ultimately applied to the monitoring and alarm system itself, this method fails to extract alarm data from the alarm system as a validation dataset to facilitate reverse optimization of the alarm threshold prediction process. Therefore, this method is unsuitable for business systems with complex logic, diverse operating conditions, and frequent changes.

[0050] Based on the above findings, embodiments of this application provide a method, apparatus, device, storage medium, and alarm system for determining alarm thresholds, to at least solve the technical problem in the prior art where inaccurate performance alarm thresholds for virtual machines lead to inaccurate alarm information. The alarm threshold determination method provided in this application is an adaptive alarm threshold prediction method that supports dynamic verification. This method can classify the system into stable and unstable operating states, and adaptively obtain dynamic alarm thresholds based on the characteristics of the system itself.

[0051] The alarm threshold determination method in this application embodiment can be implemented by an alarm threshold determination system, such as... Figure 1 As shown, the alarm threshold determination system 100 may include: a data acquisition module 101, a data processing module 102, a threshold prediction module 103, and a bad data collection module 104.

[0052] The data acquisition module 101 is connected to the virtual machine 200. The data acquisition module 101 is used to collect the performance data of the virtual machine, which serves as the main data source for the alarm threshold determination system.

[0053] The data processing module 102 is used to receive and process the data collected by the data acquisition module. The data processing module 102 can also be connected to a database.

[0054] The threshold prediction module 103 is used to predict threshold data based on the virtual machine performance data transmitted from the data processing module. The threshold prediction module 103 can also be used to train a prediction model.

[0055] The alarm threshold determination system 100 is also connected to the alarm system 300, providing threshold data to the alarm system 300.

[0056] The poor data collection module 104 is used to collect alarm information returned by the alarm system and feed the data back to the threshold prediction module 103 to guide the model training process in the threshold prediction module 103.

[0057] After the threshold prediction module 103, a performance threshold data processing module can also be connected. The performance threshold data processing module compares the input performance data with the performance threshold, and informs the alarm system when the threshold is exceeded, which serves as the basis for monitoring and alarm forwarding. The input adaptive performance data index is used as the monitoring and alarm threshold of the alarm system to form an intelligent judgment and processing process.

[0058] The alarm threshold determination method provided in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0059] Figure 2This illustration shows a flowchart of an alarm threshold determination method provided in an embodiment of this application, which can be applied to the alarm threshold determination system described above, such as... Figure 2 As shown, the method may include steps S110-S140.

[0060] Step S110: Obtain continuous monitoring data of the virtual machine system's performance metrics in real time.

[0061] Performance metrics are indicators that represent the performance of a virtual machine, specifically data such as CPU and memory usage of virtual machine resources.

[0062] The alarm threshold determination system's data acquisition module acquires virtual machine performance data in real time. It can also process the acquired performance data, extract valid data fields, and use them as the data basis for performance threshold prediction. Finally, the performance data is entered into the database as a source of offline training data.

[0063] Step S120: Based on continuous monitoring data of performance indicators, determine whether the virtual machine system is in a stable state.

[0064] Unstable states occur due to the complexity of the system's operating environment. During certain periods, there may be surges in business volume, system business migrations, or changes in underlying platform equipment, leading to abnormal fluctuations in performance data. Specifically, unstable states can occur during cutovers, optimizations, and other similar situations. In unstable states, traditional threshold setting methods are prone to causing alarm systems to generate errors or miss alarms, ultimately affecting the accurate judgment of operations and maintenance personnel.

[0065] The alarm threshold determination system determines whether there are abnormal fluctuations based on the continuous monitoring data obtained in step S110, and judges the status of the system accordingly.

[0066] In this step, the alarm threshold determination system can also extract prior knowledge from the incoming historical data using a sliding window to confirm the bandwidth parameter of the adaptive threshold, which serves as the noise capacity of the adaptive threshold.

[0067] Step S130: When the status result indicates that the virtual machine system is in an unstable state, the continuous monitoring data of the performance index is segmented based on a preset method to obtain the target continuous monitoring data.

[0068] There are many possible preset methods; the sliding window algorithm will be used as an example in the following text.

[0069] To obtain adaptive alarm thresholds under unstable conditions, a sliding window algorithm can be used to continuously segment the collected data and build a data regression model by combining it with new data. If the fitting error of the established model is higher than the set segmentation error, the new data is included in a new data segment, and a new regression model is used for calculation. If the data segmentation error is less than the preset error value, the analysis and calculation of the new data continues.

[0070] As an example, based on the above, step S130 may specifically include steps S131-S132.

[0071] Step S131: Based on continuous monitoring data of multiple performance indicators, perform data regression analysis to obtain analysis results;

[0072] Step S132: If the data fitting error in the analysis results is greater than a preset threshold, the continuous monitoring data of the segmentation performance index is obtained to obtain the target continuous monitoring data. The target continuous monitoring data is the continuous monitoring data from the current segmentation to the next segmentation.

[0073] To address the system transition process, a sliding window algorithm is used to segment continuous data. Based on the established scale model, the existing data segments are expanded using new data to build a new regression model, thereby obtaining the confidence range of the dynamic alarm threshold.

[0074] Step S140: Input the status results and target continuous monitoring data into the pre-trained threshold determination model to obtain the alarm threshold of the virtual machine system, so that the virtual machine system can issue an alarm message when the performance index is lower than the alarm threshold.

[0075] The threshold determination model can be trained in advance to learn the correlation between the performance values ​​and alarm thresholds in the monitoring data under various states. The specific training process is detailed in the following embodiments and will not be repeated here.

[0076] To improve the performance of the alarm system, after obtaining the alarm threshold, the dynamic threshold can be optimized by utilizing changes in the mean and variance, thereby reducing the missed alarm rate caused by fault signals.

[0077] In some embodiments, when the status result indicates that the virtual machine system is in a stable state, the alarm threshold determination method may further include step S150, wherein the execution order of step S150 is not related to that of step S140.

[0078] Step S150: When the status result indicates that the virtual machine system is in a stable state, the continuous monitoring data of the status result and performance indicators are input into the pre-trained threshold determination model to obtain the alarm threshold of the virtual machine system.

[0079] For the steady-state process of the system, the threshold range at time N+1 can be obtained by using an iterative recursive approach.

[0080] The alarm threshold determination method provided in this application determines whether the virtual machine system is in a stable state based on continuous monitoring data of performance indicators. If the state indicates that the virtual machine system is in an unstable state, the continuous monitoring data of performance indicators is segmented using a preset method to obtain target continuous monitoring data. The state result and the target continuous monitoring data are input into a pre-trained threshold determination model to obtain the alarm threshold of the virtual machine system. In determining the alarm threshold of the virtual machine system, the method can differentiate between stable and unstable operating states, enabling adaptive acquisition of dynamic alarm thresholds based on the system's inherent characteristics. This ensures that the determined alarm threshold adapts to the current system and guarantees the accuracy of alarm information.

[0081] To facilitate understanding, the threshold determination model in the embodiments of this application will be explained in detail below with a specific example.

[0082] Due to the variability and complexity of the IT system's operating environment, IT systems exist in various operating states. Traditional alarm threshold settings rely on past operational experience to set static, fixed thresholds, which can lead to erroneous alarm information. Therefore, this embodiment uses a sliding window algorithm to divide time windows, train on historical experience data, and combine prior data with newly collected performance data to obtain the alarm threshold for the next moment, i.e., the training process of the threshold determination model mentioned above. The construction process of the threshold determination model is described in detail below:

[0083] Assume the inequality has mean E(y) = μ and variance D(y) = σ. 2

[0084] According to Chebyshev's inequality, for any parameter y, we can obtain P(|y-μ|≥ε)≤σ 2 / ε 2 , such that ε = nσ

[0085] Then we can obtain the following formula (1).

[0086] P(|y-μ|≥ε)≤1 / n 2 (1)

[0087] Based on formula (1), the alarm threshold range represented by the y parameter can be obtained as: [μ-nσ, μ+nσ]

[0088] The mean of the dataset is Where y i is the actual collected data, and m is the actual mean of the collected data.

[0089] The variance S at time N is calculated as follows:

[0090]

[0091] In formula (2), μ and σ are used to replace m and S to obtain the maximum normal range [m-nS, m+nS]. The obtained range of variation is valid for any random variable.

[0092] The alarm threshold in formula (2) will change with the bandwidth parameter n, the mean μ and the variance σ. The mean μ and the variance σ can be obtained by online calculation data.

[0093] Since bandwidth parameters are difficult to obtain adaptively, offline training can be used to obtain fixed values ​​from the online system, which is the offline training mentioned above.

[0094] According to Chebyshev's inequality, under normal conditions, for any ε>0, assuming RF is the maximum limit value of the false alarm rate and RM is the missing alarm rate, we obtain:

[0095] P(|ym|≥ε)≤RF (3)

[0096] Pr(y>m+ε)≤RF (4)

[0097] Let ε = nS, then we get:

[0098] Pr(y>m+nS)≤RF (5)

[0099] in Furthermore, m and S are the mean and variance obtained from the real-time dataset.

[0100] After obtaining the initial bandwidth parameters, they will be continuously adjusted and improved during subsequent training. The parameter n will be fine-tuned using the fast descent method, resulting in:

[0101] n N+1 =n N +ηe N (6)

[0102] Where e N Let N be the tuning variable, and η be the tuning parameter, satisfying 0 < η < 1 / y. N Then at time N+1 we have:

[0103]

[0104] in, This is the upper limit of the prediction threshold. This is the lower limit of the prediction threshold.

[0105] Due to the complexity of the system's operating environment, there may be a surge in business volume, system business migration, or changes in basic platform equipment at certain times, which may lead to abnormal changes in performance data. This may cause the alarm system to generate errors or omissions, ultimately affecting the accurate judgment of operation and maintenance personnel.

[0106] To obtain an adaptive alarm threshold under non-steady-state conditions, a sliding window algorithm is used to continuously segment the collected data, and a data regression model is continuously built by combining new data. If the fitting error of the built model is higher than the set segmentation error, the new data is included in a new data segment, and a new regression model is used for calculation. If the data segmentation error is less than the preset error value, the analysis and calculation of the new data continues, i.e., steps S120-S140 in the aforementioned embodiment.

[0107] For the time series of an unsteady process, [t1, t2] n Based on this, the regression model for the measurement data variables is established as follows:

[0108] y i =a+bt i (8)

[0109] This requires considering transforming the estimation of variables into the estimation of the slope b and the truncation error a.

[0110] Considering the influence of noise variables on the measured data variables, and assuming that the noise variables of the measured data variables follow independent distributions, the model of the measured data variables can be obtained as follows:

[0111] y i =a+bt i +ε (9)

[0112] Wherein, variable ε is the random variable error, which follows a mean of 0 and a variance of δ. 2 The normal distribution, i.e., ε ~ N(0,δ) 2 Therefore, the probability calculation model for the alarm threshold can be expressed as an average value of a + bt. i The variance is δ 2 , that is, y i ~N(a+bt) i ,δ 2 ).

[0113] The following section will use Bayesian linear equations to predict the two parameters a and b. Based on t n+1 New performance data collected in real time is used to construct y n+1 The predicted distribution function.

[0114] Using the least squares method, estimate the parameters a and b, and record the estimated values ​​as:

[0115]

[0116] The parameters are represented as follows:

[0117]

[0118]

[0119]

[0120] and These are unbiased estimates of a and b, respectively, and both follow a normal distribution.

[0121]

[0122]

[0123] And there are:

[0124]

[0125]

[0126]

[0127] calculate According to Bayes' theorem, the posterior probability distribution functions of parameters a and b are expressed as:

[0128] g(a,b|t,y)∝f(t,y|a,b)×g(a,b) (20)

[0129] ∝[f(t,y|b)×g(b)]×[f(t,y|a)×g(a)] (21)

[0130] ∝[g(b|t,y)]×g(a|t,y) (22)

[0131] Assume the prior probability distribution functions of a and b are:

[0132] And the prior probability distribution functions of a and b are:

[0133] The mean and variance of parameter b are calculated as follows:

[0134] It can also calculate the mean and variance of parameter a:

[0135]

[0136] By deriving the posterior distribution function, we can obtain the mean and variance of the prediction threshold as follows:

[0137]

[0138]

[0139] When Q e If the error is greater than the maximum permissible error β, then the fitted data (t1, t) n This will not meet the requirements and the data needs to be re-segmented and linearized; if Q e If the condition of being less than the maximum permissible error β is met, the dynamic alarm threshold can be obtained.

[0140] Dynamic alarm threshold The prediction confidence interval is:

[0141] Under steady-state conditions, and while meeting the requirements for real-time estimation of mean and variance, an iterative recursive formula is adopted to reduce computational load:

[0142]

[0143] In t N+1 To calculate the mean at time t, you only need to calculate t. N Mean at time t N+1 Real-time data reduces computational costs.

[0144] The iterative recursive formula for variance is:

[0145]

[0146] Calculation yields t N+1 The threshold range at any given time is:

[0147]

[0148] By relying on two performance data collection methods—agent collection and resource pool collection—and combining the changing trends of the two performance data, the correlation parameters between them are obtained, and the bandwidth parameters are optimized and calculated.

[0149] Given a time series T, assuming the agent's data collection performance sequence is AG and the resource pool's data collection performance sequence is VC, to better calculate the correlation parameter between the two, it is necessary to select stationary data sequences between the two sets as the basis for calculation, discarding the non-matching data sequences. The algorithm for obtaining non-matching data sequences will be described below:

[0150] Step 1: Divide the collected performance data into multiple subsequences according to the time series. Each subsequence is represented by the mean of the original data sequence, and the value of the subsequence is used to represent the value of the original performance data sequence during this period.

[0151] Step 2: For a given time series T, find the subsequence AG of AG. i The length is n, and the starting position is S. AG ; Subsequences of VC i Starting position is S VC .

[0152] Step 3: First, set the subsequence AG i The initial distance between the VC and the VC is 0, and the positioning point is empty. The two sets of subsequences are traversed in a nested traversal manner.

[0153] Step 4: For each AG i and VC i In other words, when |S AG -S VC When |≥n, it indicates that there is a non-match between the two sets of sequences, and the distance between them is (S AG ,...,S AG+n-1 ,S VC ,...,S VC+n-1 If the distance is less than the initial distance, the nested loop is completely exited and execution ends. If the condition is not met, the distance between the two sets of subsequences is set to the minimum distance.

[0154] Step 5: If the minimum distance between the two sets of subsequences is greater than the initial distance, then the initial distance is updated to the minimum distance, and the current record point is added to the empty record point set. Then, proceed to step 4.

[0155] Step 6: After execution, obtain the set of empty points and their corresponding distances, and discard them as non-matching data points.

[0156] Based on the similarity metric function, combined with the mean and variance of the performance data subsequences, the metric function is obtained, and the tuning parameter ξ is calculated: in is the distance function of the mean of the subsequences in the two sequences, and D is the distance function of the variance of the subsequences in the two sequences.

[0157] Therefore, the bandwidth parameter after noise reduction is obtained as ξn. After parameter optimization, noise reduction is achieved during the process of obtaining the alarm threshold.

[0158] The training process of the threshold determination model in the above embodiments will be described below.

[0159] In some embodiments, before inputting the state results and continuous target monitoring data into the pre-trained threshold determination model, it is necessary to sequence the threshold determination model. Therefore, the alarm threshold determination method may further include steps S160-S170.

[0160] Step S160: Obtain the training sample set, which includes multiple training samples. Each training sample includes performance index data and its corresponding alarm threshold label.

[0161] As an example, step S160 may specifically include steps S161-S164.

[0162] Step S161: Obtain historical performance metric data and historical threshold labels from the resource pool.

[0163] Step S162: Take the historical performance index data of the same time and its corresponding historical threshold label as a training sample to obtain the training sample set.

[0164] Step S163: Obtain alarm information data from the alarm system and performance index data from the virtual machine.

[0165] Historical alarm data from the alarm system is collected. Based on the system's operational health, when the system's operational status is abnormal, its current performance data is collected to form a poor performance dataset, which serves as the basis for offline training data. Finally, noise reduction and optimization are performed on the performance prediction to achieve a high degree of matching between the predicted indicators and the actual system operation.

[0166] Step S164: Based on alarm information data and performance index data, remove training samples from the training sample set that do not meet the preset conditions.

[0167] In practice, this step can involve collecting poor performance data to form a poor performance data model, and using this data model to provide a set of guiding parameters for the dynamic performance threshold acquisition process, thereby achieving performance threshold prediction and optimization.

[0168] Step S170: Use training samples to train the preset threshold determination model until the training stopping condition is met, and obtain the trained threshold determination model.

[0169] As an example, such as Figure 1 As shown, the sample training process can include offline training, correlation training, and adaptive threshold training.

[0170] Offline training involves training on historical performance data to obtain a bandwidth coefficient training set, and also training offline on historical poor performance index data, which serves as the data basis for optimizing performance data threshold prediction.

[0171] Correlation training involves training the correlation between performance metrics collected from the agent program and performance metrics collected from the resource pool. By combining the changing trends of the two types of performance data, the influence of noise factors during adaptive threshold training is reduced, thereby improving the reliability of the predicted threshold.

[0172] Adaptive threshold training uses a sliding window algorithm to train historical performance data to obtain the data bandwidth coefficient. Then, an improved recursive formula is used to estimate the alarm threshold in real time, establishing a mapping relationship between threshold monitoring and actual operation.

[0173] The alarm threshold determination method provided in this application selects two data sources during the data source extraction process: performance data collected by the agent program and performance data collected by the resource pool. By training on the correlation between the two datasets, correlation parameters are obtained. These parameters are then used to reduce noise in the adaptive threshold calculation process, achieving dynamic optimization. Furthermore, alarm information data generated by the alarm service system forms a poor performance dataset, which is sent back to the adaptive performance threshold acquisition module. This dynamic collaboration between the monitoring alarm system and the performance acquisition system achieves closed-loop optimization, ensuring the accuracy of alarms and adaptability to different states.

[0174] In some embodiments, before training a preset threshold determination model using training samples, it is necessary to acquire data to construct training samples. Therefore, the alarm threshold determination method may further include steps S180-S190.

[0175] Step S180: Obtain historical performance metrics data from the resource pool and performance metrics data collected by the agent program.

[0176] The data acquisition module in the alarm threshold determination system can collect performance metrics data such as CPU and memory of virtual machine resources through a proxy, serving as the primary data source for the system. Alternatively, the module can directly collect or import performance metrics such as CPU and memory of host resources from the resource pool management platform via an interface, serving as the basis for relevant training datasets.

[0177] Step S190: Based on historical performance index data from the resource pool and performance index data collected by the agent program, determine the initial threshold parameter in the threshold determination model.

[0178] The alarm threshold determination system uses a sliding window to extract prior knowledge from the incoming historical data and confirms the bandwidth parameter of the adaptive threshold as the noise capacity of the adaptive threshold. It then performs correlation training on the agent program and the resource pool data, and uses the correlation training results of their changing trends to optimize the adaptive threshold, shorten the bandwidth parameter, and reduce noise.

[0179] In existing technologies, due to the lack of actual alarm data guidance, the optimized alarm thresholds still cannot guide the alarm system to function properly. Therefore, this paper obtains the poor performance data stream of the alarm system and establishes a poor performance data stream model to dynamically verify and optimize the calculation of alarm thresholds. For the poor performance data model, please refer to [reference needed]. Figure 3 .

[0180] The following describes the dynamic verification process of alarm thresholds by the alarm system:

[0181] 1) The front-end calling function module sends the monitoring performance data indicators to the alarm service system. The alarm client determines whether an alarm event has occurred based on the alarm threshold, and then sends the judgment result to the alarm service system through the calling interface.

[0182] 2) Once an alarm event is identified, a pre-alarm message will be sent to the business system manager and monitoring personnel. The business system health status will be checked by the system manager, and the results will be fed back to the alarm service system.

[0183] 3) The alarm system combines the feedback results with the current performance threshold data to form a poor performance data model, which is then fed back to the alarm threshold data optimization module to dynamically verify the alarm threshold prediction process.

[0184] The alarm threshold determination method provided in this application is not only universally applicable to various system operating conditions, enabling separate estimation and prediction under different states, but also fully utilizes multiple collected data samples to perform noise reduction and optimization on the entire alarm threshold prediction process, resulting in a smaller alarm threshold range and more accurate values. Furthermore, the monitoring and alarm system extracts and maintains alarm information to form a set of poor performance data samples, dynamically optimizing the entire alarm threshold prediction process. This achieves organic linkage between the alarm service system and the performance prediction module, ensuring that the obtained alarm threshold more closely matches the actual operating state of the system, effectively reducing false alarm rates and missed alarm rates.

[0185] This application also provides an alarm system.

[0186] Figure 4 An alarm system provided in an embodiment of this application is illustrated, such as... Figure 4 As shown, the alarm system 400 may include:

[0187] The alarm threshold determination module 410 is used to determine the alarm threshold by applying the alarm threshold determination method provided in any of the above embodiments;

[0188] Data acquisition module 420 is used to acquire performance data of the virtual machine system;

[0189] The alarm module 430 is used to issue alarm information when the performance data is lower than the alarm threshold.

[0190] The alarm system provided in this application embodiment can determine an adaptive threshold through the alarm threshold determination method in the above embodiment, which is used to set alarm monitoring rules, thereby improving the accuracy of alarms, reducing false alarm rate and missed alarm rate, optimizing alarm processing process, optimizing operation and maintenance process, and realizing intelligent operation and maintenance.

[0191] Based on the same inventive concept, this application also provides an alarm threshold determination device.

[0192] Figure 5 An alarm threshold determination device provided in an embodiment of this application is illustrated, such as... Figure 5 As shown, the alarm threshold determination device 500 may include:

[0193] The first acquisition module 510 can be used to acquire continuous monitoring data of the performance indicators of the virtual machine system in real time;

[0194] The information processing module 520 can be used to determine whether the virtual machine system is in a stable state based on continuous monitoring data of performance indicators.

[0195] The data segmentation module 530 can be used to segment continuous monitoring data of performance indicators based on a preset method to obtain target continuous monitoring data when the status result indicates that the virtual machine system is in an unstable state.

[0196] The model prediction module 540 can be used to input the state results and target continuous monitoring data into a pre-trained threshold determination model to obtain the alarm threshold of the virtual machine system, so that the virtual machine system can issue an alarm message when the performance index is lower than the alarm threshold.

[0197] In some embodiments, the model prediction module 540 can also be used to input continuous monitoring data of the state results and performance indicators into a pre-trained threshold determination model to obtain the alarm threshold of the virtual machine system when the state results indicate that the virtual machine system is in a stable state.

[0198] In some embodiments, the data segmentation module 530 may specifically include a regression analysis unit and a data segmentation unit.

[0199] The regression analysis unit can be used to perform data regression analysis based on continuous monitoring data of multiple performance indicators to obtain analysis results;

[0200] The data segmentation unit can be used to segment the continuous monitoring data of performance indicators when the data fitting error in the analysis results is greater than a preset threshold, so as to obtain the target continuous monitoring data. The target continuous monitoring data is the continuous monitoring data from the current segmentation to the next segmentation.

[0201] In some embodiments, the alarm threshold determination device 500 may further include a sample acquisition module and a model training module.

[0202] The sample acquisition module can be used to acquire a training sample set, which includes multiple training samples. Each training sample includes performance index data and its corresponding alarm threshold label.

[0203] The model training module can be used to train a preset threshold determination model using training samples until the training stopping condition is met, thus obtaining the trained threshold determination model.

[0204] As an example, the sample acquisition module may specifically include a first acquisition unit, a sample generation unit, a second acquisition unit, and a sample screening unit.

[0205] The first acquisition unit can be used to acquire historical performance index data and historical threshold labels from the resource pool;

[0206] The sample generation unit can be used to take historical performance index data from the same time period and its corresponding historical threshold labels as a training sample to obtain a training sample set.

[0207] The second acquisition unit can be used to acquire alarm information data from the alarm system and performance index data from the virtual machine.

[0208] The sample filtering unit can be used to remove training samples from the training sample set that do not meet preset conditions based on alarm information data and performance index data.

[0209] In some embodiments, the alarm threshold determination device 500 may further include a second acquisition module and a parameter determination module.

[0210] The second acquisition module can be used to acquire historical performance index data from the resource pool and performance index data collected by the agent program before training a model using training samples and setting a preset threshold.

[0211] The parameter determination module can be used to determine the initial threshold parameters in the threshold determination model based on historical performance index data from the resource pool and performance index data collected by the agent program.

[0212] The alarm threshold determination device provided in this application embodiment can be used to execute the alarm threshold determination method provided in the above method embodiments. Its implementation principle and technical effect are similar, and will not be described in detail here for the sake of brevity.

[0213] Based on the same inventive concept, embodiments of this application also provide an electronic device.

[0214] Figure 6This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. For example... Figure 6 As shown, the electronic device may include a processor 601 and a memory 602 storing computer programs or instructions.

[0215] Specifically, the processor 601 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of the present invention.

[0216] Memory 602 may include a large-capacity memory for data or instructions. For example, and not limitingly, memory 602 may include a hard disk drive (HDD), a floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 602 may include removable or non-removable (or fixed) media. Where appropriate, memory 602 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 602 is a non-volatile solid-state memory. In a particular embodiment, memory 602 includes read-only memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or flash memory, or a combination of two or more of these.

[0217] The processor 601 reads and executes computer program instructions stored in the memory 602 to implement any of the alarm threshold determination methods in the above embodiments.

[0218] In one example, the electronic device may also include a communication interface 603 and a bus 610. For example, Figure 6 As shown, the processor 601, memory 602, and communication interface 603 are connected through bus 610 and complete communication with each other.

[0219] The communication interface 603 is mainly used to realize communication between various modules, devices, units and / or devices in the embodiments of the present invention.

[0220] Bus 610 includes hardware, software, or both, that couples components of an electronic device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 610 may include one or more buses. Although specific buses are described and illustrated in embodiments of the invention, the invention contemplates any suitable bus or interconnect.

[0221] The electronic device can execute the disaster recovery method in the embodiments of the present invention, thereby realizing the alarm threshold determination method and apparatus described in the above embodiments.

[0222] Furthermore, in conjunction with the alarm threshold determination method in the above embodiments, this invention can be implemented using a readable storage medium. This readable storage medium stores program instructions; when these program instructions are executed by a processor, they implement any of the alarm threshold determination methods in the above embodiments.

[0223] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0224] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the required tasks. The programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0225] It should also be noted that the exemplary embodiments mentioned in this invention describe methods or systems based on a series of steps or apparatus. However, this invention is not limited to the order of the steps described above; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0226] The above description is merely a specific embodiment of the present invention. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the protection scope of the present invention.

Claims

1. A method for determining an alarm threshold, the method comprising: Continuous monitoring data of virtual machine system performance metrics can be obtained in real time; Based on continuous monitoring data of the aforementioned performance indicators, the status result of determining whether the virtual machine system is in a stable state is obtained. When the status result indicates that the virtual machine system is in an unstable state, the continuous monitoring data of the performance index is segmented based on a preset method to obtain the target continuous monitoring data; The status results and the continuous monitoring data of the target are input into a pre-trained threshold determination model to obtain the alarm threshold of the virtual machine system, so that the virtual machine system can issue an alarm message when the performance index is lower than the alarm threshold. Before inputting the state result and the target continuous monitoring data into the pre-trained threshold determination model, the method further includes: Obtain a training sample set, which includes multiple training samples. Each training sample includes performance indicator data and its corresponding alarm threshold threshold label. The training samples include performance indicator data collected by the agent program and performance indicator data collected by the resource pool. The preset threshold determination model is trained using the training samples until the training stopping condition is met, thus obtaining the trained threshold determination model. After obtaining the alarm threshold of the virtual machine system, the method further includes: The front-end call function module sends the continuous monitoring data of the performance indicators to the alarm service system. The alarm service system determines whether an alarm event has occurred based on the alarm threshold and the continuous monitoring data of the performance indicators. When the determination result is an alarm event, the alarm service system sends pre-alarm information to the devices corresponding to the business system manager and monitoring personnel, so that the devices can check the health status of the business system and feed back the result to the alarm service system. The alarm service system then uses the feedback result and the current performance threshold data to form a poor performance data model, which is fed back to the alarm threshold data optimization module for dynamic verification of the alarm threshold prediction process.

2. The method according to claim 1, characterized in that, When the status result indicates that the virtual machine system is in a stable state, the status result and the continuous monitoring data of the performance indicators are input into a pre-trained threshold determination model to obtain the alarm threshold of the virtual machine system.

3. The method according to claim 1, characterized in that, The continuous monitoring data of the performance indicators segmented based on a preset method includes: Based on continuous monitoring data of multiple sets of the aforementioned performance indicators, data regression analysis was performed to obtain the analysis results; If the data fitting error in the analysis results is greater than a preset threshold, the continuous monitoring data of the performance index is segmented to obtain target continuous monitoring data, which is the continuous monitoring data from the current segmentation to the next segmentation.

4. The method according to claim 1, characterized in that, The acquisition of the training sample set includes: Obtain historical performance metrics data and historical threshold labels from the resource pool; The historical performance index data and their corresponding historical threshold labels at the same time are used as a training sample to obtain the training sample set; Acquire alarm information data from the alarm system and performance metrics data from the virtual machine; Based on the alarm information data and the performance index data, training samples that do not meet the preset conditions are removed from the training sample set.

5. The method according to claim 1, characterized in that, Before training the preset threshold model using the training samples, the method further includes: Obtain historical performance metrics data from the resource pool and performance metrics data collected by the agent program; Based on the historical performance index data from the resource pool and the performance index data collected by the agent program, the initial threshold parameter in the threshold determination model is determined.

6. An alarm system, comprising: An alarm threshold determination module is used to determine an alarm threshold by applying the alarm threshold determination method according to any one of claims 1-5; The data acquisition module is used to acquire performance data of the virtual machine system; An alarm module is used to issue an alarm message when the performance data is lower than the alarm threshold.

7. An alarm threshold determination device, the device comprising: The first acquisition module is used to acquire continuous monitoring data of the performance indicators of the virtual machine system in real time; The information processing module is used to determine whether the virtual machine system is in a stable state based on continuous monitoring data of the performance indicators. The data segmentation module is used to segment the continuous monitoring data of the performance index based on a preset method to obtain target continuous monitoring data when the status result indicates that the virtual machine system is in an unstable state. The model prediction module is used to input the state results and the target continuous monitoring data into a pre-trained threshold determination model to obtain the alarm threshold of the virtual machine system, so that the virtual machine system can issue an alarm message when the performance index is lower than the alarm threshold. The first acquisition module is further configured to, before inputting the state result and the target continuous monitoring data into the pre-trained threshold determination model, include: Obtain a training sample set, which includes multiple training samples. Each training sample includes performance indicator data and its corresponding alarm threshold threshold label. The training samples include performance indicator data collected by the agent program and performance indicator data collected by the resource pool. The preset threshold determination model is trained using the training samples until the training stopping condition is met, thus obtaining the trained threshold determination model. The model prediction module is further configured to, after obtaining the alarm threshold of the virtual machine system, include: The front-end call function module sends the continuous monitoring data of the performance indicators to the alarm service system. The alarm service system determines whether an alarm event has occurred based on the alarm threshold and the continuous monitoring data of the performance indicators. When the determination result is an alarm event, the alarm service system sends pre-alarm information to the devices corresponding to the business system manager and monitoring personnel, so that the devices can check the health status of the business system and feed back the result to the alarm service system. The alarm service system then uses the feedback result and the current performance threshold data to form a poor performance data model, which is fed back to the alarm threshold data optimization module for dynamic verification of the alarm threshold prediction process.

8. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein when the program or instructions are executed by the processor, they implement the steps of the alarm threshold determination method as described in any one of claims 1-5.

9. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the alarm threshold determination method as described in any one of claims 1-5.

Images