A server hosting operation environment monitoring method and system

Abstract

The present application provides a server hosting operation environment monitoring method and system, which introduces a hosting operation feature extraction network to learn and generate a system state path map from past system operation data containing performance status data and scene interaction status data, and further uses the state path retrieval database to quickly retrieve abnormal response feature links related to the system state path map from the abnormal response instance feature library. Finally, based on the retrieved abnormal data, the monitoring results of the server hosting system status are determined, which not only improves the monitoring efficiency and accuracy of the server operation environment, but also can promptly discover and handle potential abnormal situations, thereby ensuring the stability and reliability of the server hosting service, and providing an intelligent and efficient monitoring solution for the server hosting service.

Description

Technical Field

[0001] The present application relates to the technical field of server hosting monitoring, and in particular to a method and system for monitoring a server hosting operating environment. Background Art

[0002] With the rapid development of information technology, server hosting services have become the first choice for many companies and individuals because they can provide a stable and efficient network environment and equipment management. However, as the scale of servers continues to expand and the complexity increases, how to effectively monitor the operating environment of the server to ensure its stable and reliable operation has become an urgent problem to be solved.

[0003] Traditional server operating environment monitoring methods mainly rely on manual inspection and simple automated scripts. Although these methods can monitor the operating status of the server to a certain extent, they have many shortcomings. First, manual inspection is inefficient and prone to errors, and cannot meet the monitoring needs of large-scale server clusters. Second, although simple automated scripts can improve monitoring efficiency, their monitoring range and accuracy are limited, and they often cannot detect potential problems in a timely manner.

[0004] Therefore, it is particularly important to develop a new method that can efficiently and accurately monitor the server hosting operating environment. Summary of the invention

[0005] In view of this, the purpose of this application is to provide a server hosting operating environment monitoring method and system.

[0006] According to a first aspect of the present application, a method for monitoring a server hosting operation environment is provided, the method comprising:

[0007] A system state path diagram corresponding to the server hosting system state data is obtained by using a hosting operation feature extraction network; wherein the hosting operation feature extraction network is generated by network learning using past system operation data, and the past system operation data includes performance state data and scene interaction state data;

[0008] Acquiring abnormal retrieval data corresponding to the system state path diagram using a state path retrieval database; wherein the state path retrieval database is used to retrieve abnormal response feature links related to the loading state path diagram from an abnormal response instance feature library, and the abnormal response feature links in the abnormal response instance feature library are extracted using the managed operation feature extraction network;

[0009] Based on the abnormal retrieval data corresponding to the system status path diagram, the monitoring result corresponding to the server hosting system status data is determined.

[0010] According to the second aspect of the present application, a server hosting operation environment monitoring system is provided, wherein the server hosting operation environment monitoring system comprises a machine-readable storage medium and a processor, wherein the machine-readable storage medium stores machine-executable instructions, and when the processor executes the machine-executable instructions, the server hosting operation environment monitoring system implements the aforementioned server hosting operation environment monitoring method.

[0011] According to a third aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed, the aforementioned server hosting operating environment monitoring method is implemented.

[0012] According to any one of the above aspects, the technical effect of the present application is:

[0013] By utilizing the hosting operation feature extraction network, the system state path diagram corresponding to the server hosting system state data can be effectively obtained, and by utilizing the state path retrieval database, the abnormal retrieval data corresponding to the system state path diagram can be quickly and accurately obtained. The state path retrieval database is specially designed to retrieve abnormal response feature links related to the loading state path diagram from the abnormal response instance feature library, which greatly improves the retrieval efficiency and accuracy of the abnormal response feature links, thereby helping to timely discover and locate possible problems. Finally, based on the acquired abnormal retrieval data, the monitoring results corresponding to the server hosting system state data can be determined, which has an important auxiliary effect on preventing and solving potential problems in the server hosting operation environment, and can help administrators to understand and grasp the operation status of the server in a timely manner, so as to make effective preventive and countermeasures. Therefore, by combining the hosting operation feature extraction network and the state path retrieval database, comprehensive, efficient and accurate monitoring of the server hosting operation environment is achieved, significantly improving the stability and reliability of the server operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0015] Figure 1 A flow chart of a method for monitoring a server hosting operating environment provided in an embodiment of the present application.

[0016] Figure 2 A schematic diagram of the component structure of the server hosting operating environment monitoring system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical scheme and advantages of the embodiment of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below according to the drawings in the embodiment of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description, and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the embodiment of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add multiple other operations to the flowchart under the guidance of the content of the present application, and can also destroy multiple operations from the flowchart.

[0018] Figure 1 The flowchart of the server hosting operation environment monitoring method provided by the embodiment of the present application is shown. It should be understood that in other embodiments, the order of some steps in the server hosting operation environment monitoring method of this embodiment can be shared with each other according to actual needs, or some steps can be omitted or maintained. The detailed steps of the server hosting operation environment monitoring method include:

[0019] Step S110, using the hosting operation feature extraction network to obtain a system state path diagram corresponding to the server hosting system state data. The hosting operation feature extraction network is generated by network learning using past system operation data, and the past system operation data includes performance state data and scene interaction state data.

[0020] In detail, the hosting operation feature extraction network is a neural network specifically used to extract features from the operation data of the server hosting system. These features may include key performance indicators such as CPU usage, memory occupancy, disk I / O, etc. For example, a convolutional neural network (CNN) or a recurrent neural network (RNN) in deep learning can be used to construct this feature extraction network. The feature extraction network is trained with a large amount of past system operation data to learn the ability to extract useful features from raw data.

[0021] The past system operation data refers to the operation data of the server hosting system collected in the historical time period, including the performance status and interaction status of the system in various scenarios. For example, these past system operation data can be collected regularly through system monitoring tools, such as recording every 5 minutes, and stored in the database for subsequent analysis and learning.

[0022] The performance status data refers to data describing the operating performance of the server hosting system, such as CPU usage, memory occupancy, network bandwidth usage, etc. For example, the performance status data can be obtained in real time through system monitoring software and used as input to the feature extraction network.

[0023] The scenario interaction state data refers to data describing the interaction state between the system and the external environment (such as users, other systems, etc.), such as user request response time, system service call success rate, etc. For example, the processing time and success or failure of each user request can be recorded in logs to reflect the interaction state of the system.

[0024] The system state path diagram is a graphical representation that shows the operation path of the server hosting system in different states. Each state may represent a specific performance indicator or interaction state. For example, a directed graph in graph theory can be used to represent the system state path diagram, where nodes in the graph represent different system states and edges represent transitions between states.

[0025] That is, in this embodiment, the server first starts the hosted operation feature extraction network, which is trained with a large amount of past system operation data. These past system operation data include the performance status of the server at different time points, such as CPU usage, memory occupancy, etc., as well as scene interaction status, such as user request response time, system service call success rate, etc.

[0026] Now, the server starts to collect the current server hosting system status data, which reflects the real-time operation status of the server. Then, the server inputs the server hosting system status data into the hosting operation feature extraction network. The hosting operation feature extraction network starts to work, and extracts key feature information by analyzing and processing the input data. These key feature information describe the key features of the current state of the server.

[0027] Finally, the managed operation feature extraction network generates a system state path diagram based on these key feature information. The system state path diagram intuitively displays the current state path of the server, including the changing trends of various key performance indicators and their relationships.

[0028] Step S120, using a state path retrieval database to obtain abnormal retrieval data corresponding to the system state path diagram. The state path retrieval database is used to retrieve abnormal response feature links related to the loading state path diagram from an abnormal response instance feature library, and the abnormal response feature links in the abnormal response instance feature library are extracted using the managed operation feature extraction network.

[0029] In detail, the state path retrieval database is a database for storing and retrieving abnormal response feature links related to the system state path graph. For example, a relational database (such as MySQL) or a non-relational database (such as MongoDB) can be used to construct this database. The database stores abnormal response feature links related to various abnormal responses, and these abnormal response feature links are associated with nodes and edges in the system state path graph.

[0030] The abnormal response instance feature library is a database or data set containing various abnormal response features, including a series of abnormal response data and extracting its features, and storing them in this feature library. These features may include abnormal type, occurrence time, duration, impact range, etc.

[0031] The abnormal response feature link refers to a feature sequence related to a specific abnormal response, including the system state before the abnormality occurs, the features when the abnormality occurs, and the change in the system state after the abnormality occurs. For example, an abnormal response feature link may include a series of continuous performance indicator data that have changed significantly before and after the abnormality occurs.

[0032] That is, in this embodiment, once the system state path diagram is generated, the server will compare it with the state path retrieval database, which is specifically used to retrieve abnormal response feature links related to the loading state path diagram from the abnormal response instance feature library.

[0033] During this process, the server can traverse each record in the state path retrieval database to find the abnormal response feature link that is most similar to the current system state path diagram. These abnormal response feature links were previously extracted from past abnormal response instances through the managed operation feature extraction network, representing various abnormal situations that have occurred in the server during historical operation.

[0034] Through comparison and retrieval, the server finally found the abnormal response feature links that were highly matched with the current system status path diagram, and obtained the abnormal retrieval data corresponding to these abnormal response feature links. These abnormal retrieval data recorded in detail the abnormal situations and processing results that occurred in the server under similar conditions in history.

[0035] Step S130: determining the monitoring result corresponding to the server hosting system status data based on the abnormal search data corresponding to the system status path diagram.

[0036] In this embodiment, after obtaining the abnormal search data, the server starts to analyze and process the abnormal search data. For example, it first identifies the possible risk points and abnormal trends in the current system state path diagram, and then compares them with the records in the abnormal search data.

[0037] By comparing, the server can determine whether there are potential abnormal risks in the current system, as well as the possible types and severity of these abnormal risks. For example, if the CPU usage of the current system continues to rise, and the memory usage is also increasing, then by comparing with the abnormal retrieval data, the server can determine that this is a potential performance bottleneck problem that needs to be dealt with in a timely manner.

[0038] Finally, the server can generate a monitoring report based on these analysis results, detailing the current system operating status, potential risk points, and recommended treatment measures. The monitoring report will be sent to system administrators or relevant technical personnel so that they can understand and solve potential problems in a timely manner.

[0039] In addition, it can be understood that in the description of other subsequent embodiments, the monitoring results corresponding to the server hosting system status data can also be determined by other implementation methods, and details can be found in the subsequent embodiment section.

[0040] Based on the above steps, by using the hosting operation feature extraction network, the system state path diagram corresponding to the server hosting system state data can be effectively obtained, and by using the state path retrieval database, the abnormal retrieval data corresponding to the system state path diagram can be quickly and accurately obtained. The state path retrieval database is specially designed to retrieve the abnormal response feature link related to the loading state path diagram from the abnormal response instance feature library, which greatly improves the retrieval efficiency and accuracy of the abnormal response feature link, thereby helping to timely discover and locate possible problems. Finally, based on the acquired abnormal retrieval data, the monitoring results corresponding to the server hosting system state data can be determined, which has an important auxiliary effect on preventing and solving potential problems in the server hosting operation environment, and can help administrators to understand and grasp the operation status of the server in a timely manner, so as to make effective prevention and response measures. Therefore, by combining the hosting operation feature extraction network and the state path retrieval database, comprehensive, efficient and accurate monitoring of the server hosting operation environment is achieved, which significantly improves the stability and reliability of the server operation.

[0041] In a possible implementation, step S110 may include:

[0042] Step S111 , performing feature analysis on the server hosting system state data to generate state features and target state feature nodes.

[0043] In this embodiment, the server begins to perform feature analysis on the server hosting system status data. For example, a series of data processing and analysis techniques, such as statistical analysis, time series analysis, etc., can be used to identify key features and patterns in the server hosting system status data. For example, the server can find that during a certain time period, the CPU usage rate continues to increase, while the memory usage rate remains stable, which can be regarded as a status feature.

[0044] During the feature analysis process, the server also determines the target state feature nodes, which represent the key states in the server hosting system, such as "high load state", "normal operation state", etc. Each target state feature node is defined based on a combination of a series of state features. For example, "high load state" may be defined by features such as high CPU usage, high disk I / O, and high network bandwidth usage.

[0045] Step S112: loading the state feature and the target state feature node into the hosting operation feature extraction network, and generating a system state path diagram corresponding to the server hosting system state data extracted by the hosting operation feature extraction network.

[0046] In this embodiment, after completing the feature analysis and determining the target state feature nodes, the server begins to load the state features and the target state feature nodes into the trained managed operation feature extraction network. The managed operation feature extraction network was previously learned and trained using a large amount of past system operation data, and has the ability to extract useful features from the input data and map them to corresponding states.

[0047] The server passes the state features and target state feature nodes as input data to the managed operation feature extraction network. The managed operation feature extraction network starts working and gradually maps these input data to the system state path diagram through its internal complex calculations and processing. This process is automated and depends on the training results of the managed operation feature extraction network and the characteristics of the input data.

[0048] Finally, the server gets a system status path diagram, which clearly shows the system status path. For example, the system status path diagram may include a path from "normal operation state" to "high load state", as well as the corresponding transition conditions and probabilities. The system status path diagram not only helps server administrators intuitively understand the system's operating status and possible transition paths, but also provides strong support for subsequent anomaly detection and early warning.

[0049] In a possible implementation, step S111 includes:

[0050] Step S1111: extracting status features related to the server hosting system status from the server hosting system status data, wherein the status features include CPU usage, memory occupancy, disk I / O status, and network bandwidth usage.

[0051] Step S1112: construct a state feature vector based on the extracted state features, where the state feature vector is used for the state of the server hosting system at the target time.

[0052] Step S1113, clustering each state feature vector using a clustering algorithm to generate state feature vector clusters of different state categories, and taking the cluster center or representative point of each state feature vector cluster as the corresponding target state feature node.

[0053] In this embodiment, the server first starts a status data collection program, which can monitor and record various status data of the server hosting system in real time. These status data cover multiple aspects such as CPU usage, memory occupancy, disk I / O status, and network bandwidth usage, and together constitute a comprehensive portrait of the current operating status of the server.

[0054] As data is collected, the server begins to pre-process the server-hosted system status data to ensure data accuracy and consistency. For example, abnormal data points caused by sensor failure or network transmission errors can be eliminated.

[0055] Next, the server uses specific algorithms and technologies to extract status features directly related to the server hosting system status from the preprocessed server hosting system status data. These status features include but are not limited to the real-time CPU usage, memory occupancy rate, disk read and write speeds, and network interface traffic. These status features can intuitively reflect the server's operating status and performance.

[0056] After successfully extracting the state features, the server begins to combine these state features into a multi-dimensional state feature vector, which not only contains all the key state information of the server at a certain moment, but also facilitates subsequent data analysis and processing.

[0057] Specifically, the server can standardize the value of each state feature to eliminate the impact of the dimensions and value ranges of different features. Then, these standardized feature values ​​are combined into a vector in a certain order. This vector is the state feature vector of the server at the target time, which fully describes the operating status of the server at that time.

[0058] The server now has a data set consisting of multiple state feature vectors, each of which represents the state of the server at a certain moment. In order to find the commonalities and differences from these vectors in order to better understand and predict the behavior patterns of the server, the server decided to use a clustering algorithm to perform cluster analysis on these vectors.

[0059] The server selects a suitable clustering algorithm, such as K-means or DBSCAN, and sets the corresponding parameters. Then, it takes the entire state feature vector dataset as input and starts the clustering operation. During the clustering process, the algorithm divides the vectors into different groups or clusters based on their similarity or distance.

[0060] After clustering, the server obtains state feature vector clusters of several state categories. Each cluster represents a specific server state mode, such as "high load state", "idle state", etc. These clusters provide strong support for subsequent state recognition and prediction.

[0061] After obtaining the clustering results of the state feature vector, the server needs to further determine the representative features of each cluster so that it can quickly identify and predict the state of the server. To this end, it calculates the center or representative point of each cluster, which are called target state feature nodes.

[0062] Specifically, for each cluster, the server calculates the mean or median of all the vectors in it to obtain a state feature vector that can represent the overall characteristics of the cluster. This vector is the target state feature node, which contains the average or typical values ​​of all vectors in the cluster in each dimension.

[0063] These target state feature nodes not only help the server quickly identify and classify new state data, but also provide a reference standard for subsequent anomaly detection and early warning. For example, when the server detects that the current state is significantly different from the target state feature node, it may mean that the server has an abnormal situation or is about to fail.

[0064] In a possible implementation, the method further includes:

[0065] Step A110, using the performance status reverse archive library to obtain the performance knowledge archive graph corresponding to the server hosting system status data. The performance status reverse archive library is used to convert the abnormal response instance in the abnormal response instance feature library into knowledge archive graph data, and retrieve the knowledge archive graph data related to the loading performance status data based on the knowledge archive graph data.

[0066] Step A120, using the managed operation feature extraction network to obtain a system state path diagram of the abnormal response instance corresponding to the performance knowledge archive diagram.

[0067] Step A130, calculate the characteristic distance between the system status path diagram and the abnormal retrieval data, and calculate the characteristic distance between the system status path diagram and the system status path diagram corresponding to the performance knowledge archive diagram, so as to determine the monitoring result corresponding to the server hosting system status data based on the characteristic distance.

[0068] In this embodiment, the server first accesses the performance status reverse archive library, which is a specially designed database used to convert abnormal response instances in the abnormal response instance feature library into knowledge archive graph data. These knowledge archive graph data graphically display the relationship between various performance states and abnormal situations.

[0069] In order to obtain the performance knowledge archive graph corresponding to the current server hosting system status data, the server inputs the current status data as a query condition into the performance status reverse archive library. The archive library retrieves and returns the relevant knowledge archive graph data based on the status data.

[0070] For example, if the current server CPU usage is abnormally high, the performance status reverse archive library will return a performance knowledge archive graph related to the high CPU usage. The performance knowledge archive graph may include information such as common causes of increased CPU usage, possible chain reactions, and recommended solutions.

[0071] After obtaining the performance knowledge profile graph, the server needs to further understand the specific performance of this performance knowledge in actual operation. To this end, the previously trained hosting operation feature extraction network is used to take the performance knowledge profile graph as input to extract the system state path graph of the abnormal response instance related to it.

[0072] This system state path diagram shows the various state transitions and abnormal situations that the server may experience under a specific performance state. By comparing the performance knowledge profile diagram and the system state path diagram, the server can more accurately understand the meaning of the current state data and possible subsequent developments.

[0073] In order to evaluate the similarity between the current server state and the known abnormal state, the server needs to calculate the characteristic distance between the system state path graph and the abnormal state path graph stored in the abnormal retrieval data. The characteristic distance can be calculated based on various algorithms, such as Euclidean distance, cosine similarity, etc.

[0074] The server first extracts the key features of the system state path graph, such as the frequency of state transition, the duration of abnormal state, etc. Then, it retrieves the abnormal state path graphs related to these features from the anomaly retrieval database and calculates the feature distance between them.

[0075] In addition to comparing with the abnormal state, the server also needs to evaluate the gap between the current state and the ideal state or standard state described in the performance knowledge profile map. To this end, the server can calculate the characteristic distance between the system state path map and the system state path map corresponding to the performance knowledge profile map.

[0076] This calculation process is similar to the previous step, but this time the server extracts the key features of the standard state path diagram from the performance knowledge archive and compares it with the current system state path diagram.

[0077] After completing the above two steps of feature distance calculation, the server obtains two key indicators: one is the similarity between the current state and the abnormal state, and the other is the difference between the current state and the standard state. Based on these two indicators, the server can comprehensively judge the operating status of the current hosting system.

[0078] If the current state is close to the abnormal state, it means that the server may be in or about to enter an abnormal state, and an alarm needs to be triggered and appropriate processing needs to be performed. If the current state is far from the standard state, it means that the server's performance may not be optimal and needs to be optimized or adjusted.

[0079] In this way, the server can monitor its own operating status in real time and take appropriate measures when necessary to ensure the stability and performance of the system.

[0080] In a possible implementation, the performance status reverse archiving library is used to convert the abnormal response instance in the abnormal response instance feature library into knowledge archive graph data, and the step of retrieving the knowledge archive graph data related to the loading performance status data according to the knowledge archive graph data includes:

[0081] Step A111, obtaining an abnormal response instance from the abnormal response instance feature library, each of the abnormal response instances includes an error information feature, an error code feature, a trigger time feature, and a system resource occupancy feature.

[0082] In this embodiment, the server first connects to the abnormal response instance feature library, which is a database dedicated to storing server abnormal response data. Each abnormal response instance contains rich information, such as error information features, error code features, trigger time features, and system resource usage features.

[0083] For example, the server may retrieve an exception response instance that contains an error message characteristic of "memory overflow", a specific error code "0x00000008", a trigger time of "2023-07-0514:30:00", and the system resource usage at that time, such as CPU usage of 80% and memory usage of 95%.

[0084] Step A112, parsing the abnormal response instance to extract key data related to the performance status.

[0085] The server will then parse the retrieved exception response instance. It will extract key data related to the performance status, such as error type, triggering conditions, system resource usage, etc.

[0086] Using the previous example, the server can identify that "out of memory" is the type of error, high memory usage is the trigger condition, and CPU usage and memory usage are key system resource usage.

[0087] Step A113, organize the parsed key data according to the preset knowledge profile graph template to form structured knowledge profile entries, each of which includes information such as exception type, trigger condition, performance status data, and associated system resources.

[0088] The server can organize the extracted key data into structured knowledge archive entries according to the preset knowledge archive graph template. Each knowledge archive entry will contain information such as exception type, trigger condition, performance status data, and associated system resources.

[0089] For example, a Knowledge Profile entry might look like this:

[0090] Exception type: Memory overflow

[0091] Trigger condition: Memory usage exceeds 90%

[0092] Performance status data: CPU usage 80%, memory usage 95%

[0093] Related system resources: memory, CPU

[0094] Step A114, using graph database technology, stores the structured knowledge archive entries in the form of nodes and edges to construct knowledge archive graph data, wherein the nodes in the knowledge archive graph data represent different exception types or system resources, and the edges represent the relationships between the nodes.

[0095] In detail, the server can use graph database technology to store these structured knowledge archive entries. In this graph, each node represents a different anomaly type or system resource, and the edges represent the relationship between these nodes.

[0096] For example, "Out of Memory" and "Memory" would be two nodes in the graph, and there would be an edge between them indicating that "Out of Memory" is triggered by high usage of "Memory" resources. Similarly, high "CPU usage" could also be a factor leading to "Out of Memory", so there would also be an edge connecting the two nodes "Out of Memory" and "CPU".

[0097] Step A115, analyzing the performance status data when each abnormal response instance is triggered, and associating the performance status data with the nodes in the corresponding knowledge archive graph data.

[0098] Finally, the server can analyze the performance status data when each abnormal response instance is triggered, and associate this data with the data nodes in the knowledge archive graph. In this way, when the server encounters a similar performance status again, it can quickly retrieve the relevant abnormality type and possible triggering conditions, so as to provide timely warning and processing.

[0099] For example, the server can associate the performance status data of "CPU usage 80%, memory usage 95%" with the abnormal type node of "memory overflow". If the server detects similar performance data again in the future, it can immediately issue a warning of memory overflow and take corresponding measures.

[0100] In a possible implementation, the managed operation feature extraction network includes a performance feature convolution unit, an interactive feature convolution unit, and an integration unit, and the graph convolution results of the performance feature convolution unit and the interactive feature convolution unit are used as loading data of the integration unit. The method also includes a training step of the managed operation feature extraction network, specifically including:

[0101] Step S101, obtaining a sample learning data sequence of this round of training phase, wherein each past system operation data is used as a sample learning data, and the past system operation data includes past abnormal search instructions and corresponding abnormal response instance trigger data.

[0102] In this embodiment, the server starts training the managed operation feature extraction network. First, the sample learning data sequence of this round of training phase is obtained from the repository. These sample learning data sequences are collected from past system operation records. Each record is regarded as a sample learning data. These sample learning data include past abnormal retrieval instructions and corresponding abnormal response instance trigger data.

[0103] For example, the server may obtain a sample learning data, which includes an abnormal search instruction of excessively high CPU usage and system performance data when the abnormal search instruction is triggered.

[0104] Step S102, for each sample learning data, performance status data and scene interaction status data are obtained from past abnormal retrieval instructions, the obtained performance status data is loaded into the performance feature convolution unit, and the obtained scene interaction status data is loaded into the interaction feature convolution unit, and the system state path diagram feature vector extracted by the integrated unit is obtained, and performance status data and scene interaction status data are obtained from abnormal response instance trigger data, the obtained performance status data is loaded into the performance feature convolution unit, and the obtained scene interaction status data is loaded into the interaction feature convolution unit, and the abnormal response feature link vector extracted by the integrated unit is obtained.

[0105] In this embodiment, for each sample learning data, the server can extract performance status data and scene interaction status data from the abnormal retrieval instruction. The performance status data may include CPU usage, memory occupancy, etc., while the scene interaction status data may include the network status at that time, user operations, etc.

[0106] The server loads these performance status data into the performance feature convolution unit, and loads the scene interaction status data into the interaction feature convolution unit. These two convolution units will extract performance features and interaction features respectively.

[0107] Next, the server can obtain the system state path map feature vector from the integration unit, which represents the behavior pattern of the system in a specific performance state and interaction state. At the same time, the server will also extract the performance state and scene interaction state data from the abnormal response instance trigger data, and load them into the two convolution units again, and obtain the abnormal response feature link vector from the integration unit.

[0108] Step S103: taking the sample learning data including the abnormal response instance trigger data as the standard sample data, and extracting a plurality of random comparison sample data and a plurality of fuzzy comparison sample data corresponding to the standard sample data from the sample learning data sequence of the current round of training.

[0109] In this embodiment, the server marks the sample learning data containing abnormal response instance trigger data as standard sample data. These standard sample data are important reference points in the training process because they represent real abnormal situations and system responses.

[0110] In order to enhance the generalization ability of the model, the server will also extract multiple random comparison sample data and multiple fuzzy comparison sample data from the sample learning data sequence of this round of training. Random comparison sample data is randomly selected from the data sequence and may be similar or different from the standard sample data; while fuzzy comparison sample data is standard sample data that has been modified to a certain extent to simulate the noise or uncertainty that may exist in actual situations.

[0111] Step S104, respectively calculate the characteristic distances between the system state path diagram characteristic vectors and the abnormal response characteristic link vectors corresponding to the standard sample data, each random comparison sample data and each fuzzy comparison sample data, and determine the corresponding learning error parameters according to the characteristic distances.

[0112] In this embodiment, the server will then calculate the characteristic distance between the system state path graph feature vector and the abnormal response feature link vector of the standard sample data, each random comparison sample data and each fuzzy comparison sample data respectively. The characteristic distance can measure the similarity between the system state path graph predicted by the model and the actual abnormal response.

[0113] Based on these feature distances, the server can determine the corresponding learning error parameters. If the predicted system state path diagram is significantly different from the actual abnormal response (i.e., the feature distance is far), the learning error parameters will increase accordingly, otherwise they will decrease. These error parameters will be used to adjust the model weights and parameters to improve the model's prediction performance in the next round of training.

[0114] In a possible implementation, each sample learning data includes a state feature node containing a past abnormal retrieval instruction in the past abnormal retrieval instruction, and a scene interaction state related to the state feature node containing the past abnormal retrieval instruction. Step S102 may include: obtaining an abnormal retrieval statement from the past abnormal retrieval instruction, mapping the abnormal retrieval statement into performance state data, and extracting at least one scene interaction state data of system load, memory usage, CPU utilization, and network delay during retrieval.

[0115] In this embodiment, the server starts to process a past abnormal search instruction, which is a detailed log record containing the abnormal situation that occurred in the system at a certain point in time. The server first extracts an abnormal search statement from the instruction, which may be generated by a system administrator or an automated tool to describe and locate a specific system abnormality.

[0116] For example, an abnormal search statement may be: "Search for records where the CPU utilization exceeds 90% between 14:30 and 15:00 on June 10, 2023".

[0117] The server will then map this abnormal search statement into specific performance status data. In this process, the server can parse the key information in the statement, such as time range, performance indicators and their thresholds, and convert this information into quantifiable performance status data.

[0118] Taking the previous abnormal search statement as an example, the server can map it to the following performance status data:

[0119] Time range: 14:30 to 15:00, June 10, 2023

[0120] CPU utilization: over 90%

[0121] In this way, the server can clearly know what performance status needs to be retrieved and in which time period this status occurs.

[0122] After mapping the performance status data, the server can continue to extract scene interaction status data from past exception retrieval instructions. These data describe the overall operating environment of the system when the exception occurs, including system load, memory usage, CPU utilization, network latency, etc.

[0123] Taking the previous example, the server can extract the following scene interaction status data:

[0124] System load: High load because multiple processes are running simultaneously.

[0125] Memory usage: The memory usage is as high as 85%.

[0126] Network latency: Due to network congestion, average latency increased by 50%.

[0127] This data provides the server with a comprehensive view of the overall system status when the exception occurred, helping to more accurately understand and analyze the cause of the exception.

[0128] As a result, the server can effectively obtain performance status data and scene interaction status data from past exception retrieval instructions, providing rich input information for subsequent feature extraction and model training.

[0129] In a possible implementation, the abnormal response instance triggering data included in each sample learning data contains the abnormal response instance triggered in the past, and the scene interaction state related to the abnormal response instance triggered in the past. Step S102 may include: obtaining at least one performance state data of the error code state data and abnormal crash state data of the abnormal response instance from the abnormal response instance triggering data, and extracting at least one scene interaction state data of the system resource occupancy, network communication state, concurrent processing volume, and process activity state when the abnormality occurs.

[0130] In this embodiment, when processing an abnormal response instance trigger data, the server first focuses on the performance status data therein, and the performance status data generally includes error code status data and abnormal crash status data of the abnormal response instance.

[0131] For example, a server can encounter an exception response instance that contains the error code "E001", which indicates a specific memory access violation. At the same time, the instance may also contain exception crash status data indicating that the system crashed while trying to perform a certain operation.

[0132] The server can extract key performance status information from this data. In this example, the error code "E001" and the crash status data will be recorded as an important basis for analyzing system performance and stability.

[0133] In addition to the performance status data, the server also extracts scene interaction status data from the exception response instance trigger data, which describes the overall environment and status of the system when the exception occurs.

[0134] Continuing with the previous example, when the server encounters the memory access violation error code "E001", it will further check the scene interaction state data when the exception occurred. This data can include:

[0135] System resource usage: For example, if the memory usage is as high as 90%, this may indicate that memory resource shortage is a factor causing the exception.

[0136] Network communication status: If the network communication status shows a large amount of data transfer or high network latency when the exception occurs, this may indicate that network problems have affected system performance.

[0137] Concurrent processing volume: The server can view the current concurrent processing volume. If the concurrent volume is abnormally high, it may mean that system resources are over-consumed.

[0138] Process activity status: For example, a critical process may be in a zombie state or have high resource usage, which may also be related to the occurrence of the exception.

[0139] By integrating these scene interaction status data, the server can have a more comprehensive understanding of the context in which the exception occurred, thereby more accurately locating and solving the problem. This not only helps to improve the stability and performance of the system, but also provides valuable reference information for future system optimization and fault prevention.

[0140] In a possible implementation, the interactive feature convolution unit is used to perform multi-dimensional abstract processing on the input scene interaction state data and then perform feature graph convolution on the obtained abstract information.

[0141] In this embodiment, the server starts to execute the operation of the interactive feature convolution unit. First, the server inputs the scene interaction state data into the interactive feature convolution unit. This data may include diversified information such as system load, memory usage, CPU utilization, network latency, system resource usage, network communication status, concurrent processing volume, and process activity status.

[0142] For example, the input data may reflect that at a certain point in time, the server's CPU utilization was 70%, the memory usage was 60%, the network communication status was normal, the concurrent processing volume was at a medium level, and several key processes were active.

[0143] After receiving this data, the interactive feature convolution unit will perform multi-dimensional abstraction processing. During this process, the original scene interaction state data will be converted into a higher-level representation to capture the potential patterns and relationships in the data.

[0144] Taking the previous data as an example, the interactive feature convolution unit can abstract these specific values ​​(such as CPU utilization 70%, memory occupancy 60%, etc.) into a series of feature vectors, each of which represents a specific dimension or attribute. These feature vectors can more comprehensively describe the overall state and behavior of the system.

[0145] After completing the abstraction processing, the interactive feature convolution unit will perform feature map convolution on the obtained abstract information. This process is similar to the convolution operation in image processing, but here it is applied to multi-dimensional abstract data.

[0146] Continuing with the previous example, the interactive feature convolution unit will convolve these feature vectors to capture the correlation and local features between different dimensions. Through the convolution operation, the spatial structure and pattern in the data can be extracted, which is crucial for subsequent system status analysis and anomaly detection.

[0147] After the convolution operation is completed, the interactive feature convolution unit will output a feature map, which contains the key information and potential structure in the original scene interaction state data, providing valuable input for subsequent performance feature convolution units and integration units.

[0148] In this way, through the processing of the interactive feature convolution unit, the server can more effectively understand and analyze the overall status and behavior patterns of the system, thereby improving the accuracy of anomaly detection and performance optimization.

[0149] In a possible implementation, the process of obtaining the scene interaction state related to the target state feature node or the abnormal response instance includes:

[0150] A. Based on the spatiotemporal information of a target state feature node or an abnormal response instance, a scene interaction state sequence located in a spatiotemporal interval where the target state feature node or the abnormal response instance is located is obtained.

[0151] B. Arrange the scene interaction states in the scene interaction state sequence in descending order of the trigger processing volume, and select the scene interaction state in a preset sorting interval as the target state feature node or the scene interaction state related to the abnormal response instance.

[0152] In this embodiment, when processing a target state characteristic node or an abnormal response instance, the server first focuses on its spatiotemporal information, which includes the time point when the target state characteristic node or instance occurs and its location in the network or system.

[0153] For example, suppose the server detects an abnormal response instance that occurs at 3:15 p.m. and is located in a specific module of the system. Based on this information, the server can retrieve all scene interaction states that occurred at this time point and in this module from the record to form a scene interaction state sequence.

[0154] This scene interaction state sequence may include the system load, memory usage, CPU utilization, network communication status, etc. before and after that time point. This information is arranged in chronological order.

[0155] The server will then analyze the scene interaction state sequence, especially focusing on the trigger processing volume of each state. The trigger processing volume can be understood as the frequency or number of times a state is triggered or processed.

[0156] Continuing with the above example, the server can view the trigger processing volume of each scene interaction state, such as how many times the CPU utilization is triggered at a certain point in time, or how the network communication status changes over a certain period of time.

[0157] The server can then sort the scene interaction state sequence in descending order according to the amount of trigger processing, which means that the most frequently triggered state will be ranked first, and the less frequently triggered state will be ranked later.

[0158] After the arrangement is completed, the server can select the relevant scene interaction state according to a preset sorting interval, and the preset sorting interval can be the first N states or the state where the trigger processing volume exceeds a certain threshold.

[0159] For example, if the preset sorting interval is the first five states, the server will select the first five scene interaction states that trigger the largest processing volume as the scene interaction states associated with the target state feature node or the abnormal response instance.

[0160] These selected states will be used for subsequent analysis and processing, such as training models, predicting future system behavior, or detecting potential anomalies.

[0161] As a result, the server can accurately obtain the scene interaction state that is most relevant to the target state feature node or abnormal response instance, providing valuable data support for subsequent work.

[0162] In a possible implementation, the state path search database is a state path search database for setting a managed service search scope. The method further includes:

[0163] Step B110, constructing an ordered search list for the abnormal response feature links in the abnormal response instance feature library according to the relevance sorting.

[0164] In this embodiment, the server first processes the abnormal response feature links in the abnormal response instance feature library, and these feature links represent different abnormal response modes or sequences.

[0165] For example, the abnormal response instance feature library may contain multiple abnormal response feature links, such as "memory leak-increased CPU usage-system crash", "increased network delay-data transmission error", etc. The server can sort the relevance of these feature links based on factors such as their importance in system abnormalities, frequency, or relevance in historical data.

[0166] After the sorting is completed, the server constructs these sorted feature links into an ordered search list, which is arranged from high to low according to the relevance, so that in the subsequent search process, the abnormal response features with higher relevance can be given priority.

[0167] Step B120: construct a hash mapping list of the ordered search list according to the set association depth threshold.

[0168] Next, the server may construct a hash map list of the ordered search list according to a set association depth threshold. The association depth threshold is a preset parameter used to determine the depth or length of the feature links considered when constructing the hash map.

[0169] For example, if the association depth threshold is set to 3, the server can take the first 3 features of each feature link in the ordered retrieval list for hash mapping. The purpose of hash mapping is to quickly locate and retrieve a specific feature link.

[0170] Through the hash function, the server can generate a unique hash value for each feature link, and store this hash value and the corresponding feature link in a hash mapping list. In this way, in the subsequent retrieval process, the corresponding feature link can be directly found by only the hash value, which greatly improves the retrieval efficiency.

[0171] Step B130, the ordered retrieval list and the hash mapping list constitute a state path retrieval database for setting the retrieval scope of the managed service, so as to obtain the abnormal retrieval data corresponding to the system state path diagram by using the configured state path retrieval database for setting the retrieval scope of the managed service.

[0172] Finally, the server will form a state path retrieval database that sets the retrieval scope of the managed service by using an ordered retrieval list and a hash mapping list. This database is specially designed for managed services and is used to quickly retrieve and locate abnormal retrieval data related to the system state path diagram.

[0173] When the server needs to obtain the abnormal retrieval data corresponding to the system state path diagram, it first queries the state path retrieval database. Through the ordered retrieval list, the server can quickly find the most relevant abnormal response feature; and through the hash mapping list, the server can quickly locate the specific feature link.

[0174] By using this state path retrieval database, the server can efficiently obtain abnormal retrieval data related to the system state path diagram, providing strong support for subsequent system abnormality analysis and processing.

[0175] In a possible implementation, step B110 may include:

[0176] Step B111, extracting all abnormal response feature links from the abnormal response instance feature library, analyzing each abnormal response feature link, and obtaining link data of each abnormal response feature link, wherein the link data includes the abnormal type, frequency, severity, and correlation with other abnormal response feature links triggered by the abnormal response feature link.

[0177] In this embodiment, the server first accesses the abnormal response instance feature library, which stores various abnormal response instances and their feature links that appeared in the past operation of the system. The server uses a specific algorithm and data structure, such as traversing a tree or a graph, to extract all abnormal response feature links from the feature library.

[0178] For each exception response feature link, the server performs in-depth analysis to obtain detailed data of the exception response feature link, such as the type of exception triggered by the link (such as memory leak, null pointer exception, etc.), the triggering frequency (that is, the number of times the exception occurs per unit time), the severity (the degree of impact of the exception on system stability), and the correlation with other exception response feature links (for example, whether a certain exception is often the predecessor or successor of another exception).

[0179] Step B112, defining a relevance scoring model, the relevance scoring model includes multiple dimensions, the dimensions including the importance of the anomaly type, the triggering frequency, the impact scope, and the historical processing difficulty.

[0180] The server then defines a relevance scoring model to quantitatively evaluate the relevance of each anomaly response feature link. The relevance scoring model includes multiple evaluation dimensions, such as the importance of the anomaly type (some types of anomalies may have a greater impact on the system), trigger frequency (frequently occurring anomalies may require more attention), scope of impact (the part of the system or user group affected by the anomaly), and historical processing difficulty (the complexity and time-consuming of handling such anomalies in the past).

[0181] Step B113, setting a corresponding weight for each dimension, and applying the relevance scoring model to score each abnormal response feature link to obtain a relevance score for each abnormal response feature link.

[0182] The server sets a weight for each evaluation dimension, which reflects the importance of each dimension in evaluating the relevance of the abnormal response feature link. For example, the server can give higher weights to abnormal types that have a critical business impact.

[0183] The server then applies this relevance scoring model to score each abnormal response feature link. During the scoring process, the server can calculate the relevance score of each link through a specific algorithm based on the link data (such as abnormal type, frequency, etc.) and the weight of the dimension.

[0184] Step B114, according to the relevance score, all abnormal response feature links are sorted in descending order, and after deleting the abnormal response feature links with a relevance score not greater than a preset relevance threshold, the sorted abnormal response feature links are stored in order in an ordered data structure to construct an ordered retrieval list.

[0185] After obtaining the relevance score of each abnormal response feature link, the server can sort these abnormal response feature links in descending order, that is, abnormal response feature links with high relevance scores are placed in front, so that in subsequent retrieval and use, anomalies with higher relevance can be given priority and processed.

[0186] To further improve efficiency, the server will also set a relevance threshold. Abnormal response feature links with relevance scores lower than this relevance threshold are considered to have low relevance and can be deleted or ignored by the server.

[0187] Finally, the server stores the sorted and filtered abnormal response feature links in order in an ordered data structure (such as a balanced binary tree, linked list, etc.), thereby constructing an ordered retrieval list, which will serve as the basis for subsequent rapid retrieval and positioning of abnormal response features.

[0188] In a possible implementation, step B120 may include:

[0189] Step B121, analyzing each abnormal response feature link in the abnormal response instance feature library, and determining the direct correlation features and indirect correlation features between each abnormal response feature link.

[0190] In this embodiment, the server first accesses the abnormal response instance feature library, which stores multiple abnormal response feature links. By deeply analyzing each abnormal response feature link, the server can identify which features are directly related and which are indirectly related.

[0191] For example, for the abnormal response feature link of "memory leak", directly related features may include "increased memory usage" and "degraded system performance", while indirectly related features may be "system crash" or "application unresponsiveness" because these situations are usually indirectly caused by memory leaks.

[0192] Step B122: Use a graph data structure to represent the directly associated features and the indirectly associated features, wherein nodes represent abnormal response feature links and edges represent associations between abnormal response feature links.

[0193] In this embodiment, the server may use a graph data structure to represent these direct and indirect association features. In this graph data structure, each node represents an abnormal response feature link, and the edge represents the association between these links.

[0194] Continuing with the example of "memory leak", the server can create a node to represent "memory leak" and connect it to other related nodes (such as "increased memory usage", "degraded system performance", etc.) through edges to indicate the association relationship between them.

[0195] Step B123, for each abnormal response feature link, calculate the association depth between the abnormal response feature link and other abnormal response feature links, the association depth is used to determine by traversing the path length in the graph data structure, the association depth reflects the closeness between the abnormal response feature links, the larger the association depth, the closer the association.

[0196] For each node in the graph data structure (ie, each abnormal response feature link), the server may calculate its association depth with other nodes, which is determined by traversing the path length in the graph data structure.

[0197] For example, the path from "memory leak" to "system crash" may pass through "increased memory usage" and "degraded system performance", then the length of this path (i.e., the association depth) is 3, which reflects the closeness between the abnormal response feature links.

[0198] Step B124, create an empty hash map list for storing abnormal response feature links and their associated ordered retrieval lists.

[0199] The server may initialize an empty hash map list, which will be used to store exception response feature links and their associated ordered retrieval lists.

[0200] Step B125, traverse each abnormal response feature link, for each abnormal response feature link, compare the association depth of the abnormal response feature link with the set association depth threshold, if the association depth of the abnormal response feature link is less than or equal to the set association depth threshold, then use the abnormal response feature link as the key and the corresponding ordered retrieval list as the value, and add it to the hash mapping list.

[0201] The server may traverse each node in the graph (ie, each abnormal response feature link). For each node, the server may compare its association depth with a set association depth threshold.

[0202] If the association depth of a node is less than or equal to the set threshold, the server can add this node (abnormal response feature link) as the key and its corresponding ordered retrieval list as the value to the hash map list.

[0203] For example, if the set association depth threshold is 3, then "memory leak" and its associated ordered retrieval list can be added to the hash map list because its association depth with "system crash" is exactly 3. Nodes with an association depth exceeding 3 will not be added to the list.

[0204] In this way, the server builds a hash map list based on the association depth, which can quickly locate the ordered retrieval list associated with a specific exception response feature link, thereby improving the processing efficiency of the exception response.

[0205] Figure 2 The server-hosted operating environment monitoring system 100 shown includes: a processor 1001 and a memory 1003. The processor 1001 and the memory 1003 are connected, such as through a bus 1002. Optionally, the server-hosted operating environment monitoring system 100 may also include a transceiver 1004, which can be used for data interaction between the server and other servers, such as sending data and / or receiving data. It should be noted that in actual scheduling, the transceiver 1004 is not limited to one, and the structure of the server-hosted operating environment monitoring system 100 does not constitute a limitation on the embodiments of the present application.

[0206] Processor 1001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 1001 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0207] The bus 1002 may include a path to transmit information between the above components. The bus 1002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 1002 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 2Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0208] The memory 1003 can be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), magnetic disk storage medium, other magnetic storage devices, or any other medium that can be used to carry or store program code and can be read by a computer, without limitation herein.

[0209] The memory 1003 is used to store program codes for executing the embodiments of the present application, and the execution is controlled by the processor 1001. The processor 1001 is used to execute the program codes stored in the memory 1003 to implement the steps shown in the above method embodiments.

[0210] An embodiment of the present application provides a computer-readable storage medium having program code stored thereon. When the program code is executed by a processor, the steps and corresponding contents of the aforementioned method embodiment can be implemented.

[0211] It should be understood that, although each operation step is indicated by arrows in the flowchart of the embodiment of the present application, the implementation order of these steps is not limited to the order indicated by the arrows. Unless there is clear explanation in this article, in some implementation scenarios of the embodiment of the present application, the implementation steps in each flowchart can be performed in other orders based on demand. In addition, some or all of the steps in each flowchart may include multiple sub-steps or multiple stages according to the actual implementation scenario, and some or all of these sub-steps or stages may be executed at the same time, and each sub-step or stage in these sub-steps or stages may also be executed at different times respectively. In different scenarios at the execution time, the execution order of these sub-steps or stages can be flexibly configured based on demand, and the embodiment of the present application does not limit this.

[0212] The above is only an optional implementation method for some implementation scenarios of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the technical concept of the scheme of the present application, other similar implementation methods based on the technical ideas of the present application are also within the protection scope of the embodiments of the present application.

Claims

1. A server hosting operation environment monitoring method, characterized in that: The method comprises: A system state path diagram corresponding to the server hosting system state data is obtained by using a hosting operation feature extraction network; wherein the hosting operation feature extraction network is generated by network learning using past system operation data, the past system operation data includes performance state data and scene interaction state data, and the system state path diagram is a graphical representation showing the operation path of the server hosting system in different states, each state representing a performance indicator or interaction state; The abnormality retrieval data corresponding to the system state path diagram is obtained by using a state path retrieval database; wherein the state path retrieval database is used to retrieve an abnormal response feature link related to the loading state path diagram from an abnormal response instance feature library, the abnormal response feature link in the abnormal response instance feature library is extracted by using the managed operation feature extraction network, and the abnormal response feature link refers to a feature sequence related to a specific abnormal response, including the system state before the abnormality occurs, the feature when the abnormality occurs, and the system state change after the abnormality occurs; Determine the monitoring result corresponding to the server hosting system status data based on the abnormal search data corresponding to the system status path diagram; The method of using the hosting operation feature extraction network to obtain a system status path diagram corresponding to the server hosting system status data includes: Performing feature analysis on the server hosting system state data to generate state features and target state feature nodes; Loading the state feature and the target state feature node into the hosting operation feature extraction network, generating a system state path graph corresponding to the server hosting system state data extracted by the hosting operation feature extraction network; The step of performing feature analysis on the server hosting system state data to generate state features and target state feature nodes includes: Extracting status features related to the server hosting system status from the server hosting system status data, the status features including CPU usage, memory occupancy, disk I / O status, and network bandwidth usage; Based on the extracted state features, a state feature vector is constructed, where the state feature vector is used to represent the state of the server hosting system at a target time; The state feature vectors are clustered using a clustering algorithm to generate state feature vector clusters of different state categories, and the cluster center or representative point of each state feature vector cluster is used as the corresponding target state feature node.

2. The server hosting operation environment monitoring method according to claim 1, characterized in that: The method further comprises: The performance knowledge archive graph corresponding to the server hosting system status data is obtained by using the performance status reverse archive library; wherein the performance status reverse archive library is used to convert the abnormal response instance in the abnormal response instance feature library into knowledge archive graph data, and retrieve the knowledge archive graph data related to the loading performance status data based on the knowledge archive graph data; Using the managed operation feature extraction network to obtain a system state path diagram of an abnormal response instance corresponding to the performance knowledge archive diagram; Calculating a characteristic distance between the system state path diagram and the abnormal search data, and calculating a characteristic distance between the system state path diagram and the system state path diagram corresponding to the performance knowledge archive diagram, so as to determine a monitoring result corresponding to the server hosting system state data based on the characteristic distance; The performance status reverse archiving library is used to convert the abnormal response instance in the abnormal response instance feature library into knowledge archive graph data, and the steps of retrieving the knowledge archive graph data related to the loading performance status data according to the knowledge archive graph data include: Acquire an exception response instance from the exception response instance feature library, each of the exception response instances comprising an error information feature, an error code feature, a trigger time feature, and a system resource occupancy feature; Parsing the abnormal response instance to extract key data related to the performance status; The parsed key data is organized according to the preset knowledge archive diagram template to form structured knowledge archive entries. Each knowledge archive entry includes the exception type, trigger condition, performance status data, and associated system resources. Using graph database technology, the structured knowledge archive entries are stored in the form of nodes and edges to construct knowledge archive graph data, wherein the nodes in the knowledge archive graph data represent different abnormality types or system resources, and the edges represent the relationship between the nodes; The performance status data when each abnormal response instance is triggered is analyzed, and the performance status data is associated with the nodes in the corresponding knowledge archive graph data.

3. The server hosting operation environment monitoring method according to claim 1, characterized in that: The hosted operation feature extraction network includes a performance feature convolution unit, an interactive feature convolution unit and an integration unit, and the graph convolution results of the performance feature convolution unit and the interactive feature convolution unit are used as loading data of the integration unit; The method further includes a training step of the hosted running feature extraction network, specifically including: Obtaining a sample learning data sequence for this round of training; wherein each past system operation data is used as a sample learning data, wherein the past system operation data includes past abnormal retrieval instructions and corresponding abnormal response instance triggering data; For each sample learning data, performance status data and scene interaction status data are obtained from past abnormal retrieval instructions, the obtained performance status data are loaded into the performance feature convolution unit, and the obtained scene interaction status data are loaded into the interaction feature convolution unit, and the system state path diagram feature vector extracted by the integration unit is obtained, and performance status data and scene interaction status data are obtained from abnormal response instance trigger data, the obtained performance status data are loaded into the performance feature convolution unit, and the obtained scene interaction status data are loaded into the interaction feature convolution unit, and the abnormal response feature link vector extracted by the integration unit is obtained; Using the sample learning data containing the abnormal response instance trigger data as the standard sample data, and extracting a plurality of random comparison sample data and a plurality of fuzzy comparison sample data corresponding to the standard sample data from the sample learning data sequence of the current round of training; The characteristic distances between the system state path diagram characteristic vectors and the abnormal response characteristic link vectors corresponding to the standard sample data, each random comparison sample data and each fuzzy comparison sample data are calculated respectively, and the corresponding learning error parameters are determined according to the characteristic distances.

4. The server hosting operation environment monitoring method according to claim 3, characterized in that: The past abnormal retrieval instructions included in each sample learning data include a state feature node containing the past abnormal retrieval instruction, and a scene interaction state related to the state feature node containing the past abnormal retrieval instruction; The obtaining of performance status data and scene interaction status data from past abnormal retrieval instructions includes: Exception search statements are obtained from past exception search instructions, the exception search statements are mapped into performance status data, and at least one scenario interaction status data of system load, memory usage, CPU utilization, and network delay during retrieval is extracted.

5. The server hosting operation environment monitoring method according to claim 3, characterized in that: The abnormal response instance triggering data included in each sample learning data includes the abnormal response instance triggered in the past, and the scene interaction state related to the abnormal response instance triggered in the past; The obtaining of performance status data and scene interaction status data from the abnormal response instance trigger data includes: At least one performance status data including the error code status data and the abnormal crash status data of the abnormal response instance is obtained from the abnormal response instance trigger data, and at least one scenario interaction status data including the system resource occupancy, network communication status, concurrent processing volume, and process activity status when the exception occurs is extracted.

6. The server hosting operation environment monitoring method according to claim 4 or 5, characterized in that: The interactive feature convolution unit is used to perform multi-dimensional abstract processing on the input scene interaction state data and then perform feature graph convolution on the obtained abstract information.

7. The server hosting operation environment monitoring method according to claim 4 or 5, characterized in that: The process of obtaining the scene interaction state related to the target state feature node or the abnormal response instance includes: Based on the spatiotemporal information of the target state feature node or the abnormal response instance, acquiring a scene interaction state sequence located in the spatiotemporal interval where the target state feature node or the abnormal response instance is located; The scene interaction states in the scene interaction state sequence are arranged in descending order of the trigger processing volume, and the scene interaction states in a preset sorting interval are selected as the target state feature node or the scene interaction state related to the abnormal response instance.

8. The server hosting operation environment monitoring method according to claim 1, characterized in that: The state path search database is a state path search database for setting a search range for managed services; the method further includes: Constructing an ordered search list for the abnormal response feature links in the abnormal response instance feature library according to the relevance sorting; Constructing a hash mapping list of the ordered search list according to a set association depth threshold; The ordered search list and the hash map list constitute a state path search database for setting a trusteeship service search scope, so as to obtain abnormal search data corresponding to the system state path diagram by using the configured state path search database for setting a trusteeship service search scope; The step of constructing an ordered search list according to the relevance order of the abnormal response feature links in the abnormal response instance feature library comprises: Extracting all abnormal response feature links from the abnormal response instance feature library, analyzing each abnormal response feature link, and acquiring link data of each abnormal response feature link, wherein the link data includes the abnormal type, frequency, severity, and correlation with other abnormal response feature links triggered by the abnormal response feature link; A relevance scoring model is defined, wherein the relevance scoring model includes multiple dimensions, including the importance of the anomaly type, the triggering frequency, the impact scope, and the historical processing difficulty; A corresponding weight is set for each dimension, and the relevance scoring model is applied to score each abnormal response feature link to obtain a relevance score for each abnormal response feature link; According to the relevance score, all abnormal response feature links are sorted in descending order, and after the abnormal response feature links with a relevance score not greater than a preset relevance threshold are deleted, the sorted abnormal response feature links are stored in order in an ordered data structure to construct an ordered search list; The step of constructing a hash mapping list of the ordered search list according to the set association depth threshold comprises: Analyze each abnormal response feature link in the abnormal response instance feature library to determine the direct correlation features and indirect correlation features between the abnormal response feature links; Using a graph data structure to represent the directly associated features and the indirectly associated features, wherein nodes represent abnormal response feature links, and edges represent associations between abnormal response feature links; For each abnormal response feature link, calculate the association depth between the abnormal response feature link and other abnormal response feature links, the association depth is used to determine by traversing the path length in the graph data structure, the association depth reflects the closeness between the abnormal response feature links, the larger the association depth, the closer the association; Create an empty hash map list to store exception response feature links and their associated ordered retrieval lists; Traverse each abnormal response feature link, and for each abnormal response feature link, compare the association depth of the abnormal response feature link with the set association depth threshold. If the association depth of the abnormal response feature link is less than or equal to the set association depth threshold, then use the abnormal response feature link as the key and the corresponding ordered retrieval list as the value to add it to the hash mapping list.

9. A server hosting operation environment monitoring system, characterized in that: It includes a processor and a computer-readable storage medium, wherein the computer-readable storage medium stores machine-executable instructions, and when the machine-executable instructions are executed by the processor, the server hosting operating environment monitoring method described in any one of claims 1-8 is implemented.

Images