System monitoring methods and devices

Abstract

This invention discloses a system monitoring method and apparatus, relating to the field of data analysis technology. One specific embodiment of the method includes: receiving a monitoring command for a target system; identifying multiple working nodes in the target system; determining abnormal nodes from the multiple working nodes based on their node states and node dependencies; determining fault information corresponding to the abnormal nodes based on their node states and system operation logs; and generating and returning abnormal information corresponding to the target system based on the node identifier and fault information corresponding to the abnormal nodes. This embodiment can quickly detect abnormal nodes in an abnormal state and accurately locate the fault information corresponding to the abnormal nodes, providing convenience for monitoring the operation of the system.

Description

Technical Field

[0001] This invention relates to the field of data analysis technology, and in particular to a system monitoring method and apparatus. Background Technology

[0002] With the continuous development of computer technology, large-scale systems are becoming increasingly common, and the number and complexity of tasks they need to handle are also increasing. To ensure the high reliability, throughput, and operational efficiency of large-scale systems, tasks are often broken down into multiple worker nodes, which collaborate to complete the system tasks. However, because the deployment and tasks executed by each worker node are different, current technologies lack solutions for quickly identifying abnormal nodes in an abnormal state and accurately locating the corresponding fault information. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a system monitoring method and apparatus that can quickly detect abnormal nodes in an abnormal state and accurately locate the fault information corresponding to the abnormal nodes, thereby facilitating the monitoring of the system's operation.

[0004] In a first aspect, embodiments of the present invention provide a system monitoring method, including:

[0005] Receive monitoring instructions for the target system and identify multiple working nodes in the target system;

[0006] Based on the node status and node dependencies of each working node, abnormal nodes are identified from the plurality of working nodes;

[0007] Based on the node status of the abnormal node and the system operation log, determine the fault information corresponding to the abnormal node;

[0008] Based on the node identifier and fault information corresponding to the abnormal node, generate and return the abnormal information corresponding to the target system.

[0009] Optionally, determining abnormal nodes from the plurality of working nodes based on the node status and node dependencies of each working node includes:

[0010] The current node is determined from the plurality of working nodes;

[0011] In response to the current node's node state being "waiting," the system determines, based on the node dependencies, whether there exists at least one predecessor node of the current node among the plurality of working nodes.

[0012] In response to the existence of at least one predecessor node of the current node, if the node status of each predecessor node is successful, the current node is determined to be an abnormal node.

[0013] In response to the absence of a predecessor node, the current node is determined to be an abnormal node.

[0014] Optionally, determining abnormal nodes from the plurality of working nodes based on the node status and node dependencies of each working node includes:

[0015] The current node is determined from the plurality of working nodes;

[0016] In response to the current node's node status being either running or ready, the current time and the current node's preset completion time are obtained.

[0017] In response to the current time being later than the preset completion time, the current node is determined to be an abnormal node.

[0018] Optionally, determining abnormal nodes from the plurality of working nodes based on the node status and node dependencies of each working node includes:

[0019] The current node is determined from the plurality of working nodes;

[0020] In response to the current node's node status indicating a failure to run, the current node is determined to be an abnormal node.

[0021] Optionally, determining the fault information corresponding to the abnormal node based on the node status and system operation log of the abnormal node includes:

[0022] In response to the node status of the abnormal node being ready, the system operation log is used to determine whether the ready waiting time of the abnormal node is greater than the waiting time threshold.

[0023] In response to the ready wait time being greater than the wait time threshold, determine whether the number of database connections in the target system is greater than the number of scheduled resources;

[0024] In response to the number of database connections being greater than the number of scheduling resources, the fault information is determined to indicate that the target system has insufficient scheduling resources.

[0025] In response to the fact that the number of database connections is not greater than the number of scheduled resources, the fault information is determined to indicate that the database load of the target system is too high.

[0026] Optionally, determining the fault information corresponding to the abnormal node based on the node status and system operation log of the abnormal node includes:

[0027] In response to the node status of the abnormal node being "running failed", the error information corresponding to the abnormal node is obtained from the system operation log;

[0028] Based on the error message, generate the fault information corresponding to the abnormal node.

[0029] Optionally, determining the fault information corresponding to the abnormal node based on the node status and system operation log of the abnormal node includes:

[0030] In response to the abnormal node's node status being "running", the runtime of the abnormal node is determined based on the system operation log, and it is determined whether the runtime is greater than a runtime threshold.

[0031] In response to the runtime exceeding the runtime threshold, the system determines, based on the system operation log, whether the data table involved in the abnormal node is deadlocked.

[0032] In response to a deadlock in the data table involved in the abnormal node, the fault information indicates a deadlock in the data table.

[0033] Optionally, determining the fault information corresponding to the abnormal node based on the node status and system operation log of the abnormal node includes:

[0034] In response to the node status of the abnormal node being "waiting", determine whether there is at least one predecessor node of the abnormal node among the plurality of working nodes;

[0035] In response to the existence of at least one preceding node with the abnormal node, the system operation log is used to determine whether there is a failed preceding node; if there is a failed preceding node, the fault information is determined to indicate a preceding dependency configuration error.

[0036] In response to the absence of a predecessor node for the abnormal node, if a predecessor file for the abnormal node exists, it is determined that the generation of the fault information characterization predecessor file is delayed.

[0037] Secondly, embodiments of the present invention provide a system monitoring device, comprising:

[0038] The instruction receiving module is used to receive monitoring instructions for the target system and identify multiple working nodes in the target system.

[0039] The node determination module is used to determine abnormal nodes from the plurality of working nodes based on the node status and node dependencies of each working node.

[0040] The information determination module is used to determine the fault information corresponding to the abnormal node based on the node status of the abnormal node and the system operation log.

[0041] The information return module is used to generate and return the abnormal information corresponding to the target system based on the node identifier and fault information corresponding to the abnormal node.

[0042] Optionally, the node determination module is specifically used for:

[0043] The current node is determined from the plurality of working nodes;

[0044] In response to the current node's node state being "waiting," the system determines, based on the node dependencies, whether there exists at least one predecessor node of the current node among the plurality of working nodes.

[0045] In response to the existence of at least one predecessor node of the current node, if the node status of each predecessor node is successful, the current node is determined to be an abnormal node.

[0046] In response to the absence of a predecessor node, the current node is determined to be an abnormal node.

[0047] Optionally, the node determination module is specifically used for:

[0048] The current node is determined from the plurality of working nodes;

[0049] In response to the current node's node status being either running or ready, the current time and the current node's preset completion time are obtained.

[0050] In response to the current time being later than the preset completion time, the current node is determined to be an abnormal node.

[0051] Optionally, the node determination module is specifically used for:

[0052] The current node is determined from the plurality of working nodes;

[0053] In response to the current node's node status indicating a failure to run, the current node is determined to be an abnormal node.

[0054] Thirdly, embodiments of the present invention provide an electronic device, including:

[0055] One or more processors;

[0056] Storage device for storing one or more programs.

[0057] When the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any of the above embodiments.

[0058] Fourthly, embodiments of the present invention provide a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the methods described in any of the above embodiments.

[0059] Fifthly, embodiments of the present invention provide a computer program product, including a computer program that, when executed by a processor, implements the methods described in any of the above embodiments.

[0060] One embodiment of the above invention has the following advantages or beneficial effects: based on the node status and node dependencies of each working node in the target system, abnormal nodes are identified from multiple working nodes; then, based on the node status of the abnormal node and the system operation log, the fault information corresponding to the abnormal node is determined. Applying the solution of this invention embodiment can quickly discover abnormal nodes in an abnormal state and accurately locate the fault information corresponding to the abnormal nodes, providing convenience for monitoring the operation of the system.

[0061] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0062] The accompanying drawings are provided to better understand the invention and are not intended to unduly limit the scope of the invention. Wherein:

[0063] Figure 1 This is a flowchart illustrating a system monitoring method provided in the first embodiment of the present invention;

[0064] Figure 2 This is a flowchart illustrating an abnormal node determination method provided in the second embodiment of the present invention;

[0065] Figure 3 This is a flowchart illustrating a method for determining fault information of an abnormal node according to the third embodiment of the present invention.

[0066] Figure 4 This is a schematic diagram of the structure of a system monitoring device provided in an embodiment of the present invention;

[0067] Figure 5 This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present invention. Detailed Implementation

[0068] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0069] It should be noted that the collection, analysis, use, transmission, and storage of user personal information involved in the technical solution of this invention all comply with relevant laws and regulations, are used for legitimate and reasonable purposes, and are not shared, disclosed, or sold outside of these legitimate uses, and are subject to supervision and management by regulatory authorities. Necessary measures should be taken to prevent unauthorized access to such personal information data, ensure that personnel authorized to access personal information data comply with relevant laws and regulations, and ensure the security of user personal information. Once this user personal information data is no longer needed, the risk should be minimized by restricting or even prohibiting data collection and / or deleting the data.

[0070] To facilitate understanding of the solutions provided in the embodiments of the present invention, some terms involved in the solutions provided in the embodiments of the present invention will be explained below.

[0071] Work nodes: are used to complete specific processing tasks, such as retrieving and calculating relevant business data from database tables and saving the calculation results to a specified result table.

[0072] Node dependencies: Typically, the execution of a worker node is contingent upon the successful execution of all its predecessor nodes.

[0073] Processing Path: A complete processing path typically contains multiple work nodes with dependencies. The processing path is considered complete when all work nodes in the path are finished. A business requirement generally includes one or more processing paths. The latest completion time that the business requirement must meet is the latest completion time of all processing paths.

[0074] Table 1 defines the node states of worker nodes. As shown in Table 1, the node states of a worker node can include: waiting, ready, running, running failed, and running successfully. At any given time, a worker node can only be in one node state. Under certain conditions, the node states of the same node can transition between each other.

[0075] Table 1. Node Status Definitions for Working Nodes

[0076]

[0077] Figure 1This is a flowchart illustrating a system monitoring method provided in the first embodiment of the present invention, as shown below. Figure 1 As shown, the method includes:

[0078] Step 101: Receive monitoring instructions for the target system and identify multiple working nodes in the target system.

[0079] Monitoring commands can be issued by the user or automatically and periodically by the monitoring system or the target system. As one possible implementation, in response to the incomplete target task in the target system, the current time and the expected completion time of the target task are determined, where the current time is later than the expected completion time. If the time difference between the current time and the expected completion time exceeds a time threshold, a monitoring command is sent to the target system.

[0080] Step 102: Based on the node status and node dependencies of each working node, identify the abnormal node from among multiple working nodes.

[0081] The system can pre-save node information and dependencies for each worker node. Node information may include: node identifier, node name, predecessor nodes, predecessor files, node status, expected completion time, cumulative running time, historical running time, ready waiting time, start time, number of runs, completion time, and exception logs. Running status includes: waiting, ready, running, running failed, and running successfully.

[0082] Node dependencies are used to store the prerequisite dependencies between worker nodes. Through node dependencies, the prerequisite nodes for each worker node can be obtained. For the current node, execution can only begin after all its prerequisite nodes have run successfully. A worker node may correspond to one or more prerequisite nodes, or it may have no prerequisite nodes.

[0083] Based on the operational information and dependencies of the working nodes, one or more abnormal nodes can be identified. Abnormal nodes are nodes that may be faulty. If abnormal nodes exist in the target system, it may cause the target system to malfunction or cause the calculation completion time of the processing paths contained in the target system to exceed the expected completion time.

[0084] Step 103: Determine the fault information corresponding to the abnormal node based on the node status and system operation log of the abnormal node.

[0085] System operation logs may include: operation logs of each processing module in the system or database operation logs, etc. Fault information may indicate that the target system's database is overloaded, data table deadlocks, or incorrect configuration of prerequisite dependencies, etc.

[0086] Step 104: Generate and return the corresponding abnormal information for the target system based on the node identifier and fault information corresponding to the abnormal node.

[0087] Anomaly information is generated, which includes the node identifier and fault information of the abnormal node. Relevant personnel can use this information to troubleshoot problems in the target system, ensuring that each working node operates normally and guaranteeing the stable operation of the target system.

[0088] In this embodiment of the invention, based on the node status and node dependencies of each working node in the target system, abnormal nodes are identified from multiple working nodes; then, based on the node status of the abnormal node and the system operation log, the corresponding fault information of the abnormal node is determined. Applying the solution of this embodiment of the invention can quickly discover abnormal nodes in an abnormal state and accurately locate the corresponding fault information, providing convenience for monitoring the operation of the system.

[0089] To facilitate the implementation of the solutions in this embodiment of the invention, a method for determining abnormal nodes is provided below. This method determines whether a working node is an abnormal node based on different node states. Figure 2 This is a flowchart illustrating an abnormal node determination method provided in the second embodiment of the present invention, as shown below. Figure 2 As shown, the method includes:

[0090] Step 201: Determine the current node from among the multiple working nodes in the target system.

[0091] The current node can be randomly determined from multiple worker nodes. Alternatively, the dependency level of each worker node can be determined based on node dependencies. Based on the dependency level, the current node is determined sequentially, and steps 202-207 below are executed. That is, worker nodes with lower dependency levels are first determined from multiple nodes, followed by worker nodes with higher dependency levels. This method can comprehensively and efficiently identify abnormal nodes in the target system.

[0092] For example, in a system with 5 worker nodes N1, N2...N5, where N1 is the predecessor node of N2, N3 is the predecessor node of N4, and N2 and N4 are the predecessor nodes of N5, the dependency level of N1 and N3 is 1, the dependency level of N2 and N4 is 2, and the dependency level of N5 is 3. We can first extract N1 and N3, and then use steps 202-207 below to determine if N1 and N3 are abnormal nodes. Next, extract N2 and N4, and use steps 202-207 below to determine if N2 and N4 are abnormal nodes. Finally, extract N5, and use steps 202-207 below to determine if N5 is an abnormal node.

[0093] Step 202: In response to the current node's node state being "waiting", determine, based on node dependencies, whether there is at least one predecessor node of the current node among multiple worker nodes.

[0094] Step 203: In response to the existence of at least one predecessor node of the current node, if the node status of each predecessor node is successful, determine the current node as an abnormal node.

[0095] If all preceding nodes are in a successful running state, and the current node is in a waiting state, then the current node is determined to be an abnormal node.

[0096] If there are predecessor nodes whose status is waiting, ready, running, or failed, the current node cannot run normally because of the predecessor nodes that failed to run. In this case, it is impossible to determine whether the current node is an abnormal node. Further, by analyzing the running information of the predecessor nodes that failed to run, it can be determined whether there are any abnormal predecessor nodes.

[0097] Step 204: In response to the absence of a predecessor node, determine that the current node is an abnormal node.

[0098] For a worker node in a waiting state, obtain the latest status of all its predecessor nodes. If all predecessor nodes are in a successful state, or if the worker node has no predecessor nodes, then the worker node is abnormal.

[0099] Step 205: In response to the current node's node status being running or ready, obtain the current time and the current node's preset completion time.

[0100] The preset completion time can be determined manually or based on historical completion times. The average of historical completion times can be calculated, and the preset duration can be added to this average to obtain the preset completion time.

[0101] Step 206: In response to the current time being later than the preset completion time, determine the current node as an abnormal node.

[0102] If a worker node that is in a running or ready state has an anomaly when the current time is later than the preset completion time of that worker node, that worker node is considered to have an anomaly.

[0103] Step 207: In response to the current node's node status being "running failed", determine that the current node is an abnormal node.

[0104] For a worker node that is in a failed running state, directly determine that the worker node has an anomaly.

[0105] In this embodiment of the invention, for work nodes in different node states, including: waiting, running, ready, or running failed, the target node is accurately determined as an abnormal node based on information such as the preset completion time of the work node and the running status of the preceding node.

[0106] Figure 3 This is a flowchart illustrating a method for determining fault information of an abnormal node according to the third embodiment of the present invention. Figure 3 As shown, when the node status of an abnormal node is ready, the fault information of the abnormal node can be determined in the following way: according to the system operation log, determine whether the ready waiting time of the abnormal node is greater than the waiting time threshold.

[0107] If the ready wait time exceeds the wait time threshold, determine if the number of database connections in the target system is greater than the number of scheduled resources. If the number of database connections is greater than the number of scheduled resources, determine that the fault information indicates insufficient scheduled resources in the target system. If the number of database connections is not greater than the number of scheduled resources, determine that the fault information indicates excessive database load in the target system. If the ready wait time is not greater than the wait time threshold, determine that no fault information exists.

[0108] When a node's status is "failed," its fault information can be determined as follows: Obtain the corresponding error message from the system log; generate fault information based on the error message. Fault information may include: abnormal data format, table structure issues, access permission problems, connection errors, and database errors.

[0109] When an abnormal node's status is "running," its fault information can be determined as follows: Based on the system logs, determine the abnormal node's runtime and whether it exceeds a runtime threshold. If the runtime exceeds the threshold, based on the system logs, determine if the data tables involved in the abnormal node are deadlocked. If the data tables involved in the abnormal node are deadlocked, determine the fault information indicating a data table deadlock. If the runtime does not exceed the runtime threshold, it is determined that no fault information exists.

[0110] When an abnormal node's node status is "waiting," its fault information can be determined as follows: First, determine if at least one of the abnormal node's predecessor nodes exists among multiple worker nodes. If at least one predecessor node exists, determine, based on the system operation log, whether any predecessor nodes failed to run. If a failed predecessor node exists, the fault information indicates a configuration error in the predecessor dependency, which can be resolved by deleting the predecessor relationship between the failed predecessor node and the abnormal node. If no predecessor node exists for the abnormal node, but a predecessor file exists for the abnormal node, the fault information indicates a delayed generation of the predecessor file.

[0111] In this embodiment of the invention, the judgment conditions and boundaries of fault information for various abnormal nodes are clearly defined, enabling rapid location of the fault causes corresponding to abnormal nodes and improving the efficiency of anomaly handling. The basic data dimensions required for locating fault information can be clearly defined, facilitating data collection and statistics. The solution in this embodiment of the invention can also support large-scale node monitoring, real-time calculation of monitoring results, and clearly define anomaly judgment criteria in the algorithm, effectively improving the accuracy of node fault location.

[0112] Figure 4 This is a schematic diagram of the structure of a system monitoring device provided in one embodiment of the present invention, as shown below. Figure 4 As shown, the device includes:

[0113] The instruction receiving module 401 is used to receive monitoring instructions for the target system and identify multiple working nodes in the target system.

[0114] The node determination module 402 is used to determine abnormal nodes from multiple working nodes based on the node status and node dependencies of each working node.

[0115] The information determination module 403 is used to determine the fault information corresponding to the abnormal node based on the node status of the abnormal node and the system operation log.

[0116] The information return module 404 is used to generate and return the corresponding abnormal information of the target system based on the node identifier and fault information corresponding to the abnormal node.

[0117] Optionally, the node determination module 402 is specifically used for:

[0118] Determine the current node from multiple working nodes;

[0119] In response to the current node's node state being "waiting," determine, based on node dependencies, whether there exists at least one predecessor node among multiple worker nodes for the current node.

[0120] In response to the existence of at least one predecessor node, if the node status of each predecessor node is successful, the current node is determined to be an abnormal node.

[0121] If a predecessor node does not exist, the current node is determined to be an abnormal node.

[0122] Optionally, the node determination module 402 is specifically used for:

[0123] Determine the current node from multiple working nodes;

[0124] In response to the current node's status being either running or ready, obtain the current time and the current node's preset completion time;

[0125] If the current time is later than the preset completion time, the current node is determined to be an abnormal node.

[0126] Optionally, the node determination module 402 is specifically used for:

[0127] Determine the current node from multiple working nodes;

[0128] If the current node's status indicates a failure, then the current node is determined to be an abnormal node.

[0129] Optionally, the information determination module 403 is specifically used for:

[0130] In response to the node status of the abnormal node being ready, the system operation log is used to determine whether the ready waiting time of the abnormal node is greater than the waiting time threshold.

[0131] In response to a ready wait duration exceeding a wait duration threshold, determine whether the number of database connections in the target system is greater than the number of scheduled resources;

[0132] When the number of database connections exceeds the number of scheduling resources, fault information is determined to indicate that the target system's scheduling resources are insufficient.

[0133] If the number of database connections is not greater than the number of scheduled resources, the fault information indicates that the database load of the target system is too high.

[0134] Optionally, the information determination module 403 is specifically used for:

[0135] In response to the node status of the abnormal node being "running failed", the error information corresponding to the abnormal node is obtained from the system operation log;

[0136] Based on the error message, generate the fault information corresponding to the abnormal node.

[0137] Optionally, the information determination module 403 is specifically used for:

[0138] In response to the abnormal node's status being "running", the runtime of the abnormal node is determined based on the system operation log, and it is determined whether the runtime exceeds the runtime threshold.

[0139] In response to a runtime exceeding a runtime threshold, the system determines, based on the system runtime logs, whether the data tables involved in the abnormal node are experiencing deadlocks.

[0140] In response to a deadlock in a data table involved in an abnormal node, the fault information is determined to indicate a deadlock in the data table.

[0141] Optionally, the information determination module 403 is specifically used for:

[0142] In response to the node status of an abnormal node being "waiting", determine whether there is at least one predecessor node of the abnormal node among multiple worker nodes.

[0143] In response to at least one preceding node with an abnormal node, determine whether there is a failed preceding node based on the system operation log; if there is a failed preceding node, determine the fault information indicating a preceding dependency configuration error.

[0144] In response to a predecessor node that does not have an abnormal node, if a predecessor file with an abnormal node exists, the generation of the predecessor file representing the fault information is delayed.

[0145] This invention provides an electronic device, comprising:

[0146] One or more processors;

[0147] Storage, used to store one or more programs.

[0148] When one or more programs are executed by one or more processors, the one or more processors implement the methods of any of the above embodiments.

[0149] This invention provides a computer program product, including a computer program that, when executed by a processor, implements the enterprise risk assessment method of this invention.

[0150] The following is for reference. Figure 5 It shows a schematic diagram of the structure of a computer system 500 suitable for implementing a terminal device of the present invention. Figure 5 The terminal device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0151] like Figure 5As shown, the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 502 or programs loaded from storage section 508 into random access memory (RAM) 503. The RAM 503 also stores various programs and data required for the operation of the system 500. The CPU 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0152] The following components are connected to I / O interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to I / O interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 510 as needed so that computer programs read from it can be installed into storage section 508 as needed.

[0153] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by central processing unit (CPU) 501, it performs the functions defined above in the system of this invention.

[0154] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0155] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0156] The modules described in the embodiments of the present invention can be implemented in software or hardware. The described modules can also be located in a processor, and for example, can be described as: an instruction receiving module, a node determination module, an information determination module, and an information return module. The names of these modules do not necessarily limit the module itself; for example, the instruction receiving module can also be described as "a module that receives monitoring instructions for a target system and determines multiple working nodes in the target system."

[0157] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, which, when executed by the device, cause the device to include:

[0158] Receive monitoring instructions for the target system and identify multiple working nodes in the target system;

[0159] Based on the node status and node dependencies of each working node, abnormal nodes are identified from the plurality of working nodes;

[0160] Based on the node status of the abnormal node and the system operation log, determine the fault information corresponding to the abnormal node;

[0161] Based on the node identifier and fault information corresponding to the abnormal node, generate and return the abnormal information corresponding to the target system.

[0162] According to the technical solution of this invention, based on the node status and node dependencies of each working node in the target system, abnormal nodes are identified from multiple working nodes; then, based on the node status of the abnormal nodes and the system operation logs, the fault information corresponding to the abnormal nodes is determined. Applying the solution of this invention can quickly discover abnormal nodes in an abnormal state and accurately locate the fault information corresponding to the abnormal nodes, providing convenience for monitoring the operation of the system.

[0163] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A system monitoring method characterized by, The method comprises: receiving a monitoring instruction for a target system, determining a plurality of work nodes in the target system; wherein, in response to a target job in the target system not being completed, determining a current time and an expected completion time of the target job, and in a case where a time difference between the current time and the expected completion time exceeds a time threshold, sending the monitoring instruction for the target system; determining an abnormal node from the plurality of work nodes according to a node state and a node dependency relationship of each of the work nodes; determining fault information corresponding to the abnormal node according to the node state and a system running log of the abnormal node; generating and returning abnormal information corresponding to the target system according to a node identifier and the fault information of the abnormal node; the determining of the abnormal node from the plurality of work nodes according to the node state and the node dependency relationship of each of the work nodes comprises: determining a current node from the plurality of work nodes; in response to the node state of the current node being ready, acquiring a current time and a preset completion time of the current node; and in response to the current time being later than the preset completion time, determining that the current node is an abnormal node; the determining of the fault information corresponding to the abnormal node according to the node state and the system running log of the abnormal node comprises: in response to the node state of the abnormal node being ready, determining whether a ready waiting time length of the abnormal node is greater than a waiting time length threshold according to the system running log; in response to the ready waiting time length being greater than the waiting time length threshold, determining whether a database connection number in the target system is greater than a scheduling resource number; in response to the database connection number being greater than the scheduling resource number, determining that the fault information represents that scheduling resources of the target system are insufficient; and in response to the database connection number not being greater than the scheduling resource number, determining that the fault information represents that a database load of the target system is too high.

2. The method of claim 1, wherein, the determining of the abnormal node from the plurality of work nodes according to the node state and the node dependency relationship of each of the work nodes comprises: determining a current node from the plurality of work nodes; in response to the node state of the current node being waiting, determining whether there is at least one preceding node of the current node in the plurality of work nodes according to the node dependency relationship; in response to there being at least one preceding node of the current node, determining that the current node is an abnormal node in a case where the node state of each of the preceding nodes is running successfully; in response to there being no preceding node of the current node, determining that the current node is an abnormal node.

3. The method of claim 1, wherein, the determining of the abnormal node from the plurality of work nodes according to the node state and the node dependency relationship of each of the work nodes comprises: determining a current node from the plurality of work nodes; in response to the node state of the current node being running, acquiring a current time and a preset completion time of the current node; in response to the current time being later than the preset completion time, determining that the current node is an abnormal node.

4. The method of claim 1, wherein, The determining the abnormal node from the plurality of working nodes according to the node state and the node dependency relationship of each working node comprises: determining a current node from the plurality of working nodes; in response to the node state of the current node being running failure, determining the current node as the abnormal node.

5. The method of claim 1, wherein, The determining the fault information corresponding to the abnormal node according to the node state of the abnormal node and the system running log comprises: in response to the node state of the abnormal node being running failure, obtaining error information corresponding to the abnormal node from the system running log; generating the fault information corresponding to the abnormal node according to the error information.

6. The method of claim 1, wherein, The determining the fault information corresponding to the abnormal node according to the node state of the abnormal node and the system running log comprises: in response to the node state of the abnormal node being running, determining a running duration of the abnormal node according to the system running log, and determining whether the running duration is greater than a running duration threshold; in response to the running duration being greater than the running duration threshold, determining whether a data table involved by the abnormal node appears a deadlock condition according to the system running log; in response to the data table involved by the abnormal node appearing the deadlock condition, determining that the fault information represents a data table deadlock.

7. The method of claim 1, wherein, The determining the fault information corresponding to the abnormal node according to the node state of the abnormal node and the system running log comprises: in response to the node state of the abnormal node being waiting, determining whether there is at least one preceding node of the abnormal node in the plurality of working nodes; in response to there being at least one preceding node of the abnormal node, determining whether there is a preceding node of running failure according to the system running log; in the case that there is a preceding node of running failure, determining that the fault information represents a preceding dependency configuration error; in response to there being no preceding node of the abnormal node, in the case that there is a preceding file of the abnormal node, determining that the fault information represents a preceding file delay generation.

8. A system monitoring apparatus characterized by comprising: comprise: an instruction receiving module configured to receive a monitoring instruction for a target system, and determine a plurality of working nodes in the target system; wherein, in response to a target job in the target system not being completed, a current time and an expected completion time of the target job are determined, and in the case that a time difference between the current time and the expected completion time exceeds a time threshold, the monitoring instruction for the target system is sent; a node determining module configured to determine an abnormal node from the plurality of working nodes according to a node state and a node dependency relationship of each working node; an information determining module configured to determine fault information corresponding to the abnormal node according to the node state of the abnormal node and a system running log; an information returning module configured to generate and return abnormal information corresponding to the target system according to a node identifier and the fault information of the abnormal node; The node determination module is specifically configured to: determine a current node from the plurality of worker nodes; in response to a node state of the current node being ready, acquire a current time and a preset completion time of the current node; and in response to the current time being later than the preset completion time, determine that the current node is an abnormal node. The information determination module is specifically configured to: in response to the node state of the abnormal node being ready, determine whether a ready waiting time length of the abnormal node is greater than a waiting time length threshold according to the system running log; in response to the ready waiting time length being greater than the waiting time length threshold, determine whether a database connection number in the target system is greater than a scheduling resource number; in response to the database connection number being greater than the scheduling resource number, determine that the fault information represents that scheduling resources of the target system are insufficient; and in response to the database connection number not being greater than the scheduling resource number, determine that the fault information represents that a database load of the target system is too high.

9. The apparatus of claim 8, wherein, The node determination module is specifically configured to: determine a current node from the plurality of worker nodes; in response to a node state of the current node being waiting, determine whether at least one preceding node of the current node exists in the plurality of worker nodes according to the node dependency relationship; in response to the at least one preceding node of the current node existing, determine that the current node is an abnormal node in a case where node states of the preceding nodes are all running successfully; in response to the preceding node of the current node not existing, determine that the current node is an abnormal node.

10. The apparatus of claim 8, wherein, The node determination module is specifically configured to: determine a current node from the plurality of worker nodes; in response to a node state of the current node being running, acquire a current time and a preset completion time of the current node; in response to the current time being later than the preset completion time, determine that the current node is an abnormal node.

11. The apparatus of claim 8, wherein, The node determination module is specifically configured to: determine a current node from the plurality of worker nodes; in response to a node state of the current node being running failure, determine that the current node is an abnormal node.

12. An electronic device, comprising: comprise: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method of any one of claims 1-7.

13. A computer readable medium having stored thereon a computer program, characterized in that The program is executed by the processor to implement the method of any one of claims 1-7.

14. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the method of any one of claims 1-7.

Images