Dynamic baseline alerting method and system based on historical data and trend analysis of kubernetes

Abstract

The application discloses a dynamic baseline alarm method based on history data and trend analysis of Kubernetes, and belongs to the field; the method comprises the following steps: obtaining history data; inputting the history data into a prediction model for training and prediction to obtain prediction data; judging whether the data is abnormal according to the prediction data and a current value; and if the data is abnormal, alarming; the application further discloses a dynamic baseline alarm system based on history data and trend analysis of Kubernetes; through history data access, data collected by multiple monitoring sources is converged in one place, unified in format, unified in cleaning and filtering, monitoring data with a unified dimension is generated, and the monitoring data is stored in a data warehouse; big data analysis is performed on the history monitoring data stored in the data warehouse to generate a dynamic baseline; abnormal detection is performed on the monitoring data accessed based on the dynamic baseline, a fault condition of a monitoring object is found in real time, and an alarm is generated.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of database technology, in particular to a dynamic baseline alarm method and system based on Kubernetes historical data and trend analysis. BACKGROUND

[0002] Under the traditional architecture, the calling relationship between business services and applications is relatively fixed, and the architecture is biased towards the separation of the front-end display layer, the application layer, the data layer, and the data storage layer. However, in a cloud environment, the architecture of business applications is divided into independent service application modules through function responsibility splitting.

[0003] The continuously split micro-service architecture, when migrated to the Kubernetes platform, also brings better maintainability, better scalability, independent upgradeability, and business robustness, etc. It also makes the resource scheduling of Kubernetes-based pods on the cloud more and more complex, which brings challenges to fault discovery and rapid positioning. In the cloud environment, when there is a running fault or instability in the resource, it can also be rescheduled to other available resources, and the micro-service business runs more stably. On the other hand, it becomes more and more difficult to track historical data, and the dynamic baseline alarm based on historical data and trend analysis becomes more and more important.

[0004] In summary, the demand for using big data to analyze historical monitoring data to generate intelligent prediction of monitoring indicators for dynamic baseline alarm is becoming more and more intense. It fundamentally solves the problem of high false positive and false negative rates caused by using only fixed thresholds for anomaly detection in the past, as well as the problem of alarm storm. Combined with historical data and deep learning algorithms, the future trend of the indicator is predicted and a warning is generated accordingly, which is particularly important for the detection method to avoid risks in advance.

[0005] With the continuous development of micro-service architecture and cloud computing, in the scenario of continuous containerization of business systems, the technology architecture is changing from traditional operation and maintenance to cloud operation and maintenance. The health, safety, stability, and continuous operation of business application systems have become key, and through trend analysis of historical data, confirming the health status of the current business system on Kubernetes has become the most important demand point.

[0006] The existing business system alarm monitoring mainly uses a fixed indicator alarm method, which mainly monitors hardware indicators, regularly inspects and alarms problems of the business system, such as the prometheus monitoring of the current business system in Kubernetes, which provides statistical index analysis of memory, CPU, network traffic, disk read / write and capacity at the host and container application levels, forming an alarm method from the resource perspective. SUMMARY

[0007] The application aims to provide a dynamic baseline alarm method and system based on Kubernetes historical data and trend analysis.

[0008] To solve the above technical problems, the application provides a dynamic baseline alarm method based on Kubernetes historical data and trend analysis, comprising the following steps:

[0009] Obtain historical data; the historical data includes training indicators and prediction indicators;

[0010] Input the training indicators into the prediction model for training to obtain a trained prediction model;

[0011] Input the prediction indicators into the trained prediction model for prediction to obtain prediction data of the prediction indicators;

[0012] Obtain real-time data corresponding to the prediction indicators;

[0013] According to the prediction data and real-time data of the prediction indicators, determine whether the data is abnormal;

[0014] If the data is abnormal, alarm.

[0015] Preferably, the indicator types of the training indicators and the prediction indicators both include periodic indicators and non-periodic indicators.

[0016] Preferably, inputting the training indicators into the prediction model for training to obtain a trained prediction model specifically comprises the following steps:

[0017] According to the indicator types of the training indicators in the historical data, input the training indicators of different indicator types into corresponding prediction models for training to obtain a trained prediction model.

[0018] Preferably, the prediction model is trained, specifically comprising the following steps:

[0019] Preprocess the training indicators in the historical data to obtain preprocessed training indicators;

[0020] Normalize the preprocessed training indicators to obtain normalized training indicators;

[0021] Divide the normalized training indicators into a training set and a test set, use the training set to train the prediction model, and use the test set to test the prediction model to obtain a trained prediction model.

[0022] Preferably, inputting the prediction indicators into the trained prediction model for prediction to obtain prediction data of the prediction indicators specifically comprises the following steps:

[0023] According to the index type of the to-be-predicted index in the historical data, the to-be-predicted index is input into a corresponding trained prediction model for prediction to obtain a prediction result.

[0024] Preferably, the prediction in the trained prediction model specifically comprises the following steps:

[0025] The to-be-predicted index in the historical data is preprocessed to obtain a preprocessed to-be-predicted index.

[0026] The preprocessed to-be-predicted index is normalized to obtain a normalized training index.

[0027] The normalized training index is input into a corresponding trained prediction model for prediction to obtain a prediction result.

[0028] Preferably, the prediction model is an lstm neural network model.

[0029] The application further provides a dynamic baseline alarm system based on Kubernetes historical data and trend analysis, comprising:

[0030] A first acquisition module is configured to acquire historical data, wherein the historical data comprises training indexes and to-be-predicted indexes.

[0031] A training module is configured to input the training indexes into a prediction model for training to obtain a trained prediction model.

[0032] A prediction module is configured to input the to-be-predicted indexes into the trained prediction model for prediction to obtain prediction data of the to-be-predicted indexes.

[0033] A second acquisition module is configured to acquire real-time data corresponding to the to-be-predicted indexes.

[0034] A judgment module is configured to judge whether the data is abnormal according to the prediction data of the to-be-predicted indexes and the real-time data.

[0035] An alarm module is configured to alarm.

[0036] Compared with the prior art, the application has the following beneficial effects:

[0037] The application can effectively reduce the MTTR (mean time to repair), greatly improve the work efficiency of the operation and maintenance department, and ensure the business continuity. Through historical data access, the data collected by multiple monitoring sources are converged, unified in format, and cleaned and filtered to generate standardized monitoring data and store in a data warehouse. The historical monitoring data stored in the data warehouse are analyzed by big data to generate a dynamic baseline. Based on the dynamic baseline, the monitoring data are detected for abnormalities to find the fault conditions of the monitoring objects in real time and generate alarms. BRIEF DESCRIPTION OF DRAWINGS

[0038] The specific embodiments of the application will be further described in detail below with reference to the accompanying drawings.

[0039] Figure 1 The figure is a data training and prediction alarm architecture diagram.

[0040] Figure 2 The figure is an algorithm analysis flowchart.

[0041] Figure 3 The figure is a module assistance flowchart.

[0042] Figure 4 The figure is an index classification module flowchart.

[0043] Figure 5 The figure is an abnormality detection module flowchart.

[0044] Figure 6 The figure is an index classification module flowchart.

[0045] Figure 7 The figure is a flowchart of a dynamic baseline alarm method based on Kubernetes historical data and trend analysis of the application. DETAILED DESCRIPTION

[0046] In the following description, many specific details are set forth in order to provide a thorough understanding of the application. However, the application can be practiced without the specific details set forth in this description, as understood by those skilled in the art. Accordingly, the particular implementation described herein is not intended to limit the scope of the application, but rather it is described so that others skilled in the art can better understand and utilize the application.

[0047] The terminology used in this disclosure of one or more embodiments is for the purpose of describing particular embodiments only and is not intended to be limiting of this disclosure of one or more embodiments. As used in this disclosure and the appended claims, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that the term "and / or," as used herein, refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0048] It will be understood that, although the terms first, second, etc. can be used herein to describe various information, these terms are not intended to denote

[0049] The application is further described below in connection with the appended drawings:

[0050] As shown in the figure, a dynamic baseline alarm method based on Kubernetes historical data and trend analysis includes the following steps: Figure 1

[0051] Obtaining historical data; the historical data includes training indicators and prediction indicators;

[0052] Inputting the training indicators into the prediction model for training to obtain a trained prediction model;

[0053] Inputting the prediction indicators into the trained prediction model for prediction to obtain prediction data of the prediction indicators;

[0054] Obtaining real-time data corresponding to the prediction indicators;

[0055] According to the prediction data and the real-time data of the prediction indicators, determining whether the data is abnormal;

[0056] If the data is abnormal, alarming.

[0057] Preferably, the indicator types of the training indicators and the prediction indicators both include periodic indicators and non-periodic indicators.

[0058] Preferably, inputting the training indicators into the prediction model for training to obtain a trained prediction model includes the following steps:

[0059] ​According to the index type of the training index in the historical data, the training index of different index types is input into the corresponding prediction model for training to obtain the trained prediction model.

[0060] Preferably, the prediction model is trained, specifically including the following steps:

[0061] The training index in the historical data is preprocessed to obtain the preprocessed training index.

[0062] The preprocessed training index is normalized to obtain the normalized training index.

[0063] The normalized training index is divided into a training set and a test set, the training set is used to train the prediction model, and the test set is used to test the prediction model to obtain the trained prediction model.

[0064] Preferably, the prediction model is trained, specifically including the following steps:

[0065] According to the index type of the training index in the historical data, the training index of different index types is input into the corresponding prediction model for training to obtain the trained prediction model.

[0066] Preferably, the prediction model is trained, specifically including the following steps:

[0067] The training index in the historical data is preprocessed to obtain the preprocessed training index.

[0068] The preprocessed training index is normalized to obtain the normalized training index.

[0069] The normalized training index is input into the corresponding trained prediction model for prediction to obtain the prediction result.

[0070] Preferably, the prediction model is an lstm neural network model.

[0071] The application also provides a dynamic baseline alarm system based on Kubernetes historical data and trend analysis, comprising:

[0072] A first acquisition module is configured to acquire historical data; the historical data includes training indexes and prediction indexes.

[0073] A training module is configured to input the training indexes into a prediction model for training to obtain a trained prediction model.

[0074] A prediction module is configured to input the prediction indexes into the trained prediction model for prediction to obtain prediction data of the prediction indexes.

[0075] The second acquisition module is configured to acquire real-time data corresponding to the index to be predicted.

[0076] The judgment module is configured to judge whether the data is abnormal according to the prediction data and the real-time data of the index to be predicted.

[0077] The alarm module is configured to alarm.

[0078] The present application realizes intelligent operation and maintenance of infrastructure facing business perspective through full-dimensional, multi-directional monitoring of historical data access, aggregation, analysis of infrastructure hardware, host, network, application, middleware, etc. Through data cleaning, intelligent fault delimitation, fault root cause analysis, alarm compression and filtering, etc. The problems and abnormalities in the operation and maintenance system are diagnosed, focusing on the discovery, positioning and auxiliary decision of faults, discovering where and where the fault occurs in the business system, and indicating the direction for fault handling, and assisting in troubleshooting.

[0079] In order to better illustrate the technical effects of the present application, the present application provides the following specific embodiment to illustrate the above technical process:

[0080] Embodiment 1, a dynamic baseline alarm method based on Kubernetes historical data and trend analysis, comprising:

[0081] The historical data and trend analysis method based on Kubernetes provided by the present application trains and analyzes prediction through the way of full-dimensional monitoring data access. The following scheme is described in detail by taking the abnormality detection condition based on the accessed kafka monitoring data as an example.

[0082] 1. Cloud-edge collaborative design scheme

[0083] Data acquisition access: monitoring data is collected through Kafka, Zabbix, Prometheus, APM tools, etc. It is suitable for hardware infrastructure resources, network equipment resources, host system resources, databases, middleware, applications and other multiple dimensions.

[0084] Abnormality detection module: the main module is responsible for the detection of real-time data, which is the entrance module of the abnormality detection module, and receives real-time data from the historical data to judge the detection type. According to the index classification, the statistical method is used to judge the abnormality. The case takes the real-time access of Kafka module as an example.

[0085] Historical data training and prediction: the index classification module is responsible for the classification of the index, the calculation of the statistical threshold, the initiation of the predictor module and the unsupervised training module tasks. According to the classification, the prediction or unsupervised training task is initiated. If the index is a periodic index, the prediction task is sent to the predictor module, indicating that it is a short-term prediction. If the index is a non-periodic index, the training task is sent to the unsupervised training module.

[0086] Alarm notification: in the alarm management center platform, the predicted abnormality is alarmed, and the associated prediction data information is provided.

[0087] 2. Overall algorithm design scheme

[0088] The specific implementation steps of the anomaly detection are as follows, as shown in Figure 5

[0089] (1) Real-time reception of index data from kafka, judgment of detection type; if the detection type is a fixed threshold detection set by the user, go to step 2; if the detection type is a non-fixed threshold detection, go to step 3.

[0090] (2) Direct threshold judgment, go to step 9.

[0091] (3) Determine whether the index is a new index or whether the related detection parameters (index type, index statistical threshold) of the index are missing; if the index is a new index or the related detection parameters of the index are missing, go to step 4; otherwise, go to step 5.

[0092] (4) Send a classification task to the index classification module and end the detection.

[0093] (5) According to the abnormality rule, judge whether each index is abnormal one by one and perform statistics; since the statistical method has low false negative rate and high false positive rate, the detection is ended when the statistical method judges that the data is normal, and goes to step 6.

[0094] For example, the abnormality rule is to set the default threshold of resource utilization, and to determine whether each index exceeds the default threshold of resource utilization.

[0095] (6) If the statistical method detects an anomaly, further detection is performed according to the index type.

[0096] If the index is a periodic type, go to step 7.

[0097] If the index is a non-periodic type, go to step 8.

[0098] ​(7) If the indicator is a periodic type, the threshold-based detection method is called. This detection method reads historical data and short-term prediction data generated by the predictor, generates a residual sequence, and judges the abnormal probability of the current value (3-sigma) based on the residual sequence. If it is not abnormal, the detection ends; if it is abnormal, it jumps to step 9.

[0099] (8) If the indicator is a non-periodic type (stable, trending), the unsupervised learning detection method is called. This method reads historical data and the model trained by the unsupervised training module, extracts time-series features from the data and makes a judgment. If the real-time anomaly is judged to be abnormal, it jumps to step 9; otherwise, the detection ends.

[0100] (9) Encapsulate the exception information and send it out from Kafka.

[0101] The specific implementation steps of the indicator classification module are as follows:

[0102] (1) Receive Kafka classification tasks from the anomaly detection main module in real time, and start reclassification tasks of metrics periodically.

[0103] (2) Read historical data to calculate indicator classification, and the indicator types are divided as follows: Figure 6 As shown.

[0104] (3) Calculate the statistical threshold parameters according to the classification, and store the classification results and threshold parameters in MySQL.

[0105] (4) Initiate prediction or unsupervised training tasks based on the classification. If the indicator is a periodic indicator, send a prediction task to the predictor module, indicating that it is a short-term prediction; if the indicator is a non-periodic indicator, send a training task to the unsupervised training module. The "predictor module" and the "unsupervised training module" use the same offline training algorithm model, and input different periodic and non-periodic indicators respectively for data analysis.

[0106] 3. Main Training Method Algorithm Design Scheme

[0107] The main training method is offline training mode, and the specific implementation steps are as follows:

[0108] (1) Obtain the training metrics: Retrieve the manually set metric data to be predicted from the configuration item (cfg_item) table in the MySQL database. After setting, the predicted value (predict_flag) of the metric will become 1. Check if the training time (train_time) of the metric is empty. If it is empty, it means that the data has not been trained. At the same time, the difference between the current time and the current time must be greater than the default retraining time, which is 1 day. The retraining time can be modified in the algorithm configuration file. If the retraining conditions are met, add it to the training metric queue (list).

[0109] (2) Sampling data at a set interval size, which can be modified in the step of offline training configuration in the algorithm configuration file (algorithm_config.py). After sampling, the data is stored in the sample item table of the mongodb database. The data in this table only has two fields, recordTime and value, because the data is only used for prediction and does not require other fields. The sampling method will first determine whether there is data in sample_item (whether the index has been sampled), if there is no data, initiate the first sampling, get all the original data in the required time range from the item table of the mongodb database, and then use the resample method of pandas to sample the data at a set interval size; if there is data, get the most recent time in the sampling data, read all the historical data from this time to the current time for sampling. Finally, store the sampling data in the sample_item table of the mongodb database.

[0110] (3) Get historical data from the sample_item table of the mongodb database according to item_id. The time length of the historical data is related to the data duration required for training, which can be modified in the train_period of the offline training configuration in the algorithm configuration file (algorithm_config.py).

[0111] (4) Data preprocessing:

[0112] Null processing and filling of the original data, time deduplication and processing of the data interval, and generation of standard TimeSeries data.

[0113] (5) Model training:

[0114] 1) Use feature scaling to normalize the data, that is, process the data to be a decimal between 0 and 1.

[0115] 2), the time series data is divided into (input_shape, out_shape) input and output tensor format sample data by sliding window processing. For example, data in the format of (50, 20) represents that the input x of each data is the first 50 values (including the current point), and the output y is the next 20 values. Therefore, this model will learn the rule between the first 50 points and the next 20 points, and the generated model can predict the next 20 points for each input x. Wherein input_shape and output_shape can be modified in the algorithm configuration file (algorithm_config.py) offline training configuration.

[0116] 3), use lstm neural network for training.

[0117] (6) The trained model is stored in the specified path, such as: “.. / model” path. The file naming rule uses element + index value: the model file name of the index with item_id 10 is named 10.h5.

[0118] 4, online prediction algorithm design scheme

[0119] (1) Obtain the predicted index: obtain the index with predict_flag = 1 from the cfg_item table in the mysql database, check whether the next prediction time (predict_time) is empty (not predicted) or less than the current time, if it meets the re-prediction condition, add it to the prediction index queue (list), here the fields that need to be predicted include item id (item_id), data standardization (unit_scale), prediction threshold (pre_threshold).

[0120] (2) Sample the data according to the set interval size, the interval size can be modified in the step of the offline training configuration in the algorithm configuration file (algorithm_config.py), and the sampled data is stored in the sample_item table in the mongodb database. The data in this table only has two fields of record time (recordTime) and prediction value (value), because this data is only used for prediction, it does not need other fields. The sampling method here gets the time closest to the sampling data from the item table in the mongodb database, reads all the historical data from this time to the current time for sampling. Finally, the sampled data is stored in the sample_item table in the mongodb database.

[0121] (3) Get historical data from the sample_item table of the mongodb database according to item_id. The length of the historical data is related to the size of the input data required by the prediction model, which can be modified in the algorithm configuration file (algorithm_config.py) in the input of the training dictionary (TRAIN_DICT).

[0122] (4) Data preprocessing:

[0123] Null processing and filling of the original data, time deduplication and processing of data intervals, and generation of standard time series (TimeSeries) data.

[0124] (5) Read model:

[0125] Read the trained model from the model directory according to item_id. If the model does not exist, it means that the model has not been trained, and a prompt log is output, ending the current prediction task.

[0126] (6) Use the model to make predictions:

[0127] 1) Normalize using feature scaling processing method;

[0128] 2) Encapsulate the data into (input_shape, out_shape) format data as model input, and the result of model predict is the prediction result.

[0129] (7) Determine whether there is a warning

[0130] Determine whether there is an abnormal point in the prediction point according to the threshold set by the user. If there is an abnormal point, the first prediction threshold configuration point is alarmed, and the warning information is sent.

[0131] (8) Update the next prediction and warning time

[0132] If there is an alarm in the current prediction point, the next second of the first alarm point is the next prediction and warning time; if there is no alarm in the prediction point, the prediction and warning time is the default re-warning time interval, which can be modified in the algorithm configuration file.

[0133] The application discloses a dynamic baseline warning method based on historical data and trend analysis of Kubernetes, and designs a method for processing system historical data and trend analysis on Kubernetes. In the kubernetes environment, the historical monitoring data in the data warehouse of the container is analyzed by big data, and a dynamic baseline is generated. Based on the dynamic baseline, the abnormal detection of the accessed monitoring data is carried out, the fault condition of the monitoring object is found in real time, and the warning is generated.

[0134] The application is based on full-dimension monitoring data centralized access, breaking through the vertical barriers before the monitoring data of hardware, network, application, middleware, etc.

[0135] The application is based on machine learning intelligent algorithm to analyze the root cause of the fault, combined with the existing data, issue a warning information, give the fault root cause recommendation, improve the troubleshooting efficiency.

[0136] More specific examples of computer-readable storage media can include but are not limited to: an electrical connection having one or more conductive wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0137] In the present application, the computer readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or apparatus. In the present application, the computer readable signal medium can include a data signal carried in a baseband or as a part of a carrier wave, which carries computer readable program code. Such a propagated data signal can take many forms, including but not limited to electro-magnetic signal, optical signal or any suitable combination of the foregoing. The computer readable signal medium can also be any computer readable medium other than the computer readable storage medium that can send, propagate or transmit a program for use by or in connection with an instruction execution system, device or apparatus. The program code contained on the computer readable medium can be transmitted by any suitable medium, including but not limited to wireless, wire, optical cable, RF, etc. or any suitable combination of the foregoing.

[0138] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative, for example, the division of the modules, modules or units is only a logical function division, and actual implementation can have another division mode, for example, a plurality of units, modules or components can be combined or integrated into another device, or some features can be ignored or not executed.

[0139] The units can or can not be physically separate, and the components displayed as units can be one physical unit or multiple physical units, i.e., can be located in one place, or can also be distributed to multiple different places. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment of the present application.

[0140] In addition, each functional unit in various embodiments of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0141] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, the embodiments of the present application include a computer program product comprising a computer program carried on a computer readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network by a communication part, and / or installed from a detachable medium. When the computer program is executed by a central processing unit (CPU), the above-mentioned functions defined in the method of the present application are executed. It should be noted that the above-mentioned computer readable medium of the present application can be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared ray segment, or semiconductor system, device or apparatus, or any combination of the above.

[0142] The flowcharts and block diagrams in the drawings illustrate the possible implementation architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each block in the flowchart or block diagram can represent a module, a program segment, or a part of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different orders than those noted in the drawings. For example, two blocks indicated in succession can actually be executed substantially in parallel, and sometimes they can be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be realized by a dedicated hardware-based system that performs the specified function or operation, or can be realized by a combination of dedicated hardware and computer instructions.

[0143] The above merely illustrates the specific embodiments of the present application, but the protection scope of the present application is not limited thereto, any change or replacement within the technical scope disclosed by the present application should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A dynamic baseline alerting method based on Kubernetes' historical data and trend analysis, characterized in that, The method comprises the following steps: Obtain historical data; the historical data comprises training indicators and indicators to be predicted; the types of the training indicators and the indicators to be predicted both comprise periodic indicators and non-periodic indicators; According to the types of the training indicators in the historical data, the training indicators of different types are respectively input into corresponding prediction models for training to obtain trained prediction models; The indicators to be predicted are input into the trained prediction models for prediction to obtain prediction data of the indicators to be predicted; Real-time data corresponding to the indicators to be predicted is obtained; According to the prediction data and the real-time data of the indicators to be predicted, it is judged whether the data is abnormal; If the data is abnormal, an alarm is given; The training process of the prediction model comprises the following steps: Obtain training indicators: obtain manually set indicator data to be predicted from a configuration item table of a mysql database, set the indicator prediction value to 1, check whether the training time of the indicator is empty, and if the training time is empty, it is untrained data; at the same time, the difference between the current time and the training time is greater than the default retraining time, the default value is 1 day, the retraining time is modified in the algorithm configuration file, and if the retraining condition is met, the training indicator is added to the training indicator queue; Sample the data according to the set interval size, modify the step in the offline training configuration in the algorithm configuration file, and store the sampled data in the sampling item table of the mongodb database; the sampling method first judges whether there is data in the sampling item table, if there is no data, initial sampling is initiated, all original data in the training required time range is obtained from the sampling item table of the mongodb database, and the resample method of pandas is used to sample the data according to the set interval size; if there is data, the time closest to the sampling data is obtained, all historical data from the time to the current time is read for sampling; finally, the sampling data is stored in the sampling item table of the mongodb database; Obtain historical data from the sampling item table of the mongodb database according to item_id, the time length of the historical data is related to the data length required for training, and the training period in the offline training configuration in the algorithm configuration file is modified; Perform null value processing and filling on the original data, remove data according to time, and process the interval of the data to generate standard time series data; Use the feature scaling processing method for normalization, that is, process the data to be a decimal between 0 and 1; Divide the time series data into sample data in the form of input and output tensor data format through sliding window processing; Use the lstm neural network for training; Store the generated model to a specified path; The prediction process of the trained prediction model comprises the following steps: Obtain indicators to be predicted: obtain indicators with a prediction value of 1 from a configuration item table of a mysql database, check whether the next time to be predicted in the indicator is empty or less than the current time, if the re-prediction condition is met, add the indicator to the prediction indicator queue, and the fields required for subsequent prediction processes include project id, data standardization and prediction threshold. Sampling data according to the set interval size, the interval size is modified in the algorithm configuration file, the step of offline training configuration, and the sampled data is stored in the sampling project table of the mongodb database after sampling processing. The data in the table only has two fields of record time and prediction value. The sampling method here obtains the time closest to the sampling data from the sampling project table of the mongodb database, reads all historical data from the current time to the time, and samples; finally, the sampling data is stored in the sampling project table of the mongodb database; According to the item_id, the historical data is obtained from the sampling project table of the mongodb database. The length of the historical data is related to the size of the input data required by the prediction model, and the input in the training dictionary can be modified in the algorithm configuration file; Null value processing and filling are performed on the original data, and the interval of the data is processed according to time to generate standard time series data; According to item_id, the trained model is read from the model directory. If the model does not exist, it means that the model has not been trained, and a prompt log is output, and the current prediction task is ended; Normalization is performed using the feature scaling processing method; The data is packaged as format data as model input, and the result of the model predict is the prediction result; According to the threshold set by the user, it is judged whether there is an abnormal point in the prediction point. If there is an abnormal point, the first prediction threshold configuration point is alarmed, and the warning information is sent; Update the next prediction and warning time: if there is an alarm in the current prediction point, the next second of the first alarm point is taken as the next prediction and warning time; if there is no alarm in the prediction point, the prediction and warning time is the default re-warning time interval, and the prediction threshold is modified in the algorithm configuration file.

2. The dynamic baseline alarm method based on Kubernetes historical data and trend analysis according to claim 1, characterized in that: The prediction model is an lstm neural network model.

3. A dynamic baseline alerting system based on Kubernetes historical data and trend analysis, for implementing the dynamic baseline alerting method based on Kubernetes historical data and trend analysis according to any one of claims 1-2, characterized in that, It includes: A first acquisition module for acquiring historical data; the historical data includes training indicators and indicators to be predicted; A training module for inputting the training indicators into the prediction model for training to obtain a trained prediction model; A prediction module for inputting the indicators to be predicted into the trained prediction model for prediction to obtain prediction data of the indicators to be predicted; A second acquisition module for acquiring real-time data corresponding to the indicators to be predicted; A judgment module for judging whether the data is abnormal according to the prediction data of the indicators to be predicted and the real-time data; An alarm module for alarming.

Images