Abnormal detection method and device for reading and writing data

Abstract

The embodiment of the present application provides a method and device for abnormal detection of read and write data, wherein the method includes: obtaining a first read and write count corresponding to a first hierarchical structure in a storage node, wherein the first read and write count is used to represent the statistical number of read and write data in the first hierarchical structure, and the read and write data is data input and / or output in the storage node; obtaining a second read and write count corresponding to a second hierarchical structure in the storage node, wherein the second read and write count is used to represent the statistical number of read and write data in the second hierarchical structure; when the first read and write count and / or the second read and write count meet the read and write abnormality condition, obtaining the abnormal detection result corresponding to the storage node, wherein the abnormal detection result is used to represent the abnormal situation of the read and write data in the storage node. Through the present application, the problem of low accuracy of abnormal detection of read and write data is solved, thereby achieving the effect of improving the accuracy of abnormal detection of read and write data.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computers, and more specifically, to a method and device for detecting abnormalities in reading and writing data. Background Art

[0002] In the anomaly detection scenario of read and write data, the commonly used method is to judge anomalies based on setting thresholds or relying on a single statistical indicator. This method can indeed show high detection accuracy when dealing with persistent read and write data anomalies. However, when faced with short-term or sudden read and write data anomalies, it is often difficult to maintain the same level of accuracy due to the limitations of its detection mechanism. This limitation is mainly reflected in the lack of comprehensive consideration of multi-dimensional information and data features of different hierarchical structures, which affects the comprehensiveness and accuracy of anomaly detection. Therefore, there is a problem of low accuracy in anomaly detection of read and write data.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a method and device for detecting abnormalities in read and write data, so as to at least solve the problem of low accuracy in detecting abnormalities in read and write data in the related art.

[0005] According to one embodiment of the present application, a method for detecting anomalies in read and write data is provided, including: obtaining a first read and write count corresponding to a first hierarchical structure in a storage node, wherein the first read and write count is used to represent the statistical number of read and write data in the first hierarchical structure, and the read and write data is data input and / or output in the storage node; obtaining a second read and write count corresponding to a second hierarchical structure in the storage node, wherein the second read and write count is used to represent the statistical number of the read and write data in the second hierarchical structure; in the case where the first read and write count and / or the second read and write count meet a read and write abnormality condition, obtaining an abnormality detection result corresponding to the storage node, wherein the abnormality detection result is used to represent the abnormal situation of the read and write data in the storage node.

[0006] According to another embodiment of the present application, a read-write data anomaly detection device is provided, including: a first acquisition unit, used to acquire a first read-write count corresponding to a first hierarchical structure in a storage node, wherein the first read-write count is used to represent the statistical number of read-write data in the first hierarchical structure, and the read-write data is data input and / or output in the storage node; a second acquisition unit, used to acquire a second read-write count corresponding to a second hierarchical structure in the storage node, wherein the second read-write count is used to represent the statistical number of the read-write data in the second hierarchical structure; a third acquisition unit, used to acquire an anomaly detection result corresponding to the storage node when the first read-write count and / or the second read-write count meet a read-write anomaly condition, wherein the anomaly detection result is used to represent the abnormal situation of the read-write data in the storage node.

[0007] In an exemplary embodiment, the third acquisition unit includes: a first acquisition module, used to acquire a first abnormal result corresponding to the storage node when the first read-write count satisfies a first abnormal condition, wherein the first abnormal result is used to indicate that the read-write data in the storage node is in an abnormal state, the read-write abnormal condition includes the first abnormal condition, and the abnormal detection result includes the first abnormal result; a second acquisition module, used to acquire a second abnormal result corresponding to the storage node when the second read-write count satisfies a second abnormal condition, wherein the second abnormal result is used to indicate detection information corresponding to the abnormal state, the read-write abnormal condition includes the second abnormal condition, and the abnormal detection result includes the second abnormal result.

[0008] In an exemplary embodiment, the above-mentioned second acquisition module includes: a positioning submodule, used to locate the read and write data in the above-mentioned abnormal state in the above-mentioned second hierarchical structure, and determine the target position where the abnormal event occurs in the above-mentioned second hierarchical structure; a collection submodule, used to collect information on the above-mentioned target position and obtain feedback information associated with the above-mentioned abnormal event.

[0009] In an exemplary embodiment, the above-mentioned first acquisition unit includes: a third acquisition module, used to obtain the read and write counts corresponding to the interface class hierarchical structure in the above-mentioned storage node, wherein the above-mentioned first hierarchical structure includes the above-mentioned interface class hierarchical structure, and the above-mentioned interface class hierarchical structure is responsible for data interaction between the above-mentioned storage node and the external connection.

[0010] In an exemplary embodiment, the third acquisition module includes at least one of the following: a first acquisition submodule, used to obtain the read and write counts corresponding to the HL hierarchical structure in the storage node, wherein the interface class hierarchical structure includes the HL hierarchical structure, and the HL hierarchical structure is responsible for the protocol interaction between the storage node and the server; a second acquisition submodule, used to obtain the read and write counts corresponding to the VL hierarchical structure in the storage node, wherein the interface class hierarchical structure includes the VL hierarchical structure, and the VL hierarchical structure is responsible for writing or reading data to or from a physical disk.

[0011] In an exemplary embodiment, the above-mentioned second acquisition unit includes: a fourth acquisition module, used to obtain the read and write counts corresponding to the processing class hierarchy structure in the above-mentioned storage node, wherein the above-mentioned second hierarchy structure includes the above-mentioned processing class hierarchy structure, and the above-mentioned processing class hierarchy structure is responsible for the processing and management of the data of the above-mentioned storage node.

[0012] In an exemplary embodiment, the fourth acquisition module includes at least one of the following: a third acquisition submodule, used to obtain the read and write counts corresponding to the CA hierarchical structure in the storage node, wherein the processing class hierarchical structure includes the CA hierarchical structure, and the CA hierarchical structure is responsible for providing the storage node with a cache mechanism for data; a fourth acquisition submodule, used to obtain the read and write counts corresponding to the RAID hierarchical structure in the storage node, wherein the processing class hierarchical structure includes the RAID hierarchical structure, and the RAID hierarchical structure is responsible for combining multiple independent hard disks.

[0013] In an exemplary embodiment, the fourth acquisition submodule includes at least one of the following: a first acquisition subunit, used to acquire the read and write counts corresponding to the striped RAID hierarchy structure in the storage node, wherein the data in the striped RAID hierarchy structure is distributed in blocks on multiple disks; a second acquisition subunit, used to acquire the read and write counts corresponding to the mirrored RAID hierarchy structure in the storage node, wherein the data in the mirrored RAID hierarchy structure is stored on two or more disks at the same time; a third acquisition subunit, used to acquire the read and write counts corresponding to the distributed parity RAID hierarchy structure in the storage node, wherein the distributed parity RAID hierarchy structure stores the parity information distributedly on all disks; a fourth acquisition subunit, used to acquire the read and write counts corresponding to the dual distributed parity RAID hierarchy structure in the storage node, wherein the dual distributed parity RAID hierarchy structure uses two independent parity information and stores them distributedly on all disks.

[0014] In an exemplary embodiment, the fourth acquisition submodule includes: a fifth acquisition subunit, used to obtain the read and write counts corresponding to the RAID hierarchy structure of the combination class in the storage node, wherein the RAID hierarchy structure of the combination class is a structure combining at least two different types of RAID hierarchy structures.

[0015] In an exemplary embodiment, the fifth acquisition subunit includes at least one of the following: a first acquisition subcomponent, used to obtain the read and write counts corresponding to the RAID hierarchy structure combining the striping class and the mirroring class in the storage node, wherein the data in the RAID hierarchy structure combining the striping class and the mirroring class is mirrored and stored on multiple disks and then striped; a second acquisition subcomponent, used to obtain the read and write counts corresponding to the RAID hierarchy structure combining the striping class and the distributed parity check class in the storage node, wherein the RAID hierarchy structure combining the striping class and the distributed parity check class stripes the data and Apply distributed parity; a third acquisition subcomponent is used to obtain the read and write counts corresponding to the RAID hierarchy structure combining the above-mentioned mirroring class and the above-mentioned distributed parity class in the above-mentioned storage node, wherein the RAID hierarchy structure combining the above-mentioned mirroring class and the distributed parity class removes the data mirror and applies distributed parity; a fourth acquisition subcomponent is used to obtain the read and write counts corresponding to the RAID hierarchy structure combining the above-mentioned striping class and the dual distributed parity class in the above-mentioned storage node, wherein the RAID hierarchy structure combining the above-mentioned striping class and the dual distributed parity class stripes the data and applies dual distributed parity.

[0016] In an exemplary embodiment, the above-mentioned device also includes: a first trigger unit, which is used to trigger a read-write detection request according to a preset detection time window before obtaining the abnormality detection result corresponding to the above-mentioned storage node, wherein the above-mentioned read-write detection request is used to request abnormality detection of the above-mentioned read-write data.

[0017] In an exemplary embodiment, the device further includes: a first detection unit for responding to the read-write detection request to perform a single detection on the read-write data after the read-write detection request is triggered according to the preset detection time window, when the detection time window includes a preset time interval and a preset time width for performing abnormal detection on the read-write data, wherein the duration of the single detection is the preset time width; a second triggering unit for triggering a new read-write detection request for the read-write data after the read-write detection request is triggered according to the preset detection time window, when the detection time window includes a preset time interval and a preset time width for performing abnormal detection on the read-write data, wherein the trigger interval between the new read-write detection request and the read-write detection request is the preset time interval; a second detection unit for responding to the new read-write detection request to perform a secondary detection on the read-write data after the read-write detection request is triggered according to the preset detection time window, when the detection time window includes a preset time interval and a preset time width for performing abnormal detection on the read-write data, wherein the duration of the secondary detection is the preset time width.

[0018] In an exemplary embodiment, the third acquisition unit includes: a fifth acquisition module, which is used to obtain the first fluctuation abnormality result corresponding to the storage node when the first read-write count satisfies the read-write abnormality condition, wherein the first fluctuation abnormality result is used to indicate that there is an abnormality in the read-write fluctuation of the first hierarchical structure; a sixth acquisition module, which is used to obtain the second fluctuation abnormality result corresponding to the storage node when the second read-write count satisfies the read-write abnormality condition, wherein the second fluctuation abnormality result is used to indicate that there is an abnormality in the read-write fluctuation of the second hierarchical structure.

[0019] In an exemplary embodiment, the above-mentioned device also includes: a first determination module, which is used to determine that the above-mentioned first read-write count satisfies the above-mentioned read-write abnormality condition before the above-mentioned first fluctuation abnormality result corresponding to the above-mentioned storage node is obtained, when the read-write performance value corresponding to the above-mentioned first read-write count is less than the preset read-write performance threshold, wherein the read-write performance value corresponding to the above-mentioned first read-write count is positively correlated with the read-write fluctuation degree of the above-mentioned first hierarchical structure; the above-mentioned device also includes: a second determination module, which is used to determine that the above-mentioned second read-write count satisfies the above-mentioned read-write abnormality condition before the above-mentioned second fluctuation abnormality result corresponding to the above-mentioned storage node is obtained, when the read-write performance value corresponding to the above-mentioned second read-write count is less than the above-mentioned read-write performance threshold, wherein the read-write performance value corresponding to the above-mentioned second read-write count is positively correlated with the read-write fluctuation degree of the above-mentioned second hierarchical structure.

[0020] In an exemplary embodiment, the above-mentioned device also includes: a third determination module, which is used to determine, before the above-mentioned determination that the above-mentioned first read-write count satisfies the above-mentioned read-write abnormality condition, a read-write count in the above-mentioned first read-write count whose continuous fluctuation duration is greater than or equal to a preset continuous fluctuation duration threshold as the read-write performance value corresponding to the above-mentioned first read-write count; the above-mentioned device also includes: a fourth determination module, which is used to determine, before the above-mentioned determination that the above-mentioned first read-write count satisfies the above-mentioned read-write abnormality condition, a read-write count in the above-mentioned second read-write count whose continuous fluctuation duration is greater than or equal to the above-mentioned continuous fluctuation duration threshold as the read-write performance value corresponding to the above-mentioned second read-write count.

[0021] In an exemplary embodiment, the above-mentioned device also includes: a fourth acquisition unit, used to obtain fiber task statistical information in the process of obtaining the above-mentioned abnormality detection results corresponding to the above-mentioned storage node, wherein the above-mentioned fiber task statistical information is used to reflect the time consumption of each task in the above-mentioned storage node within a preset time period, and the above-mentioned fiber task statistical information includes at least one of the following: task name, task execution time, task waiting time, number of task executions, single task execution time, waiting time; a first positioning unit, used to locate the position where the above-mentioned read and write data in the above-mentioned storage node has an abnormality according to the above-mentioned fiber task statistical information in the process of obtaining the above-mentioned abnormality detection results corresponding to the above-mentioned storage node.

[0022] In an exemplary embodiment, the above-mentioned device also includes: a fifth acquisition unit, used to obtain call stack information in the process of obtaining the above-mentioned exception detection result corresponding to the above-mentioned storage node, wherein the above-mentioned call stack information provides the function call stack status of each CPU core in the above-mentioned storage node at a specific moment; a second positioning unit, used to locate the position where the above-mentioned read and write data in the above-mentioned storage node has an abnormality according to the above-mentioned call stack information in the process of obtaining the above-mentioned exception detection result corresponding to the above-mentioned storage node.

[0023] According to another embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any one of the above method embodiments when running.

[0024] According to another embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0025] Through this application, the first read and write count corresponding to the first hierarchical structure in the storage node is first obtained. This count not only represents the activity status of the data in the hierarchical structure, but also is a key indicator for evaluating whether the data flow is normal. By real-time monitoring of this count, any abnormal data read and write patterns can be captured, such as a sudden increase or decrease in data access.

[0026] In addition, the present application also focuses on the second read and write counts corresponding to the second-level structure in the storage node. This level of counts provides an additional perspective for understanding the flow of data between different structures, thereby helping to discover anomalies that may be overlooked in the first level. For example, even if the total amount of data read and write in the first level seems to be within the normal range, the data read and write volume of a specific area or category in the second level may show abnormal fluctuations.

[0027] It should be noted that the present application does not rely solely on a single read-write count to make anomaly judgments. Instead, it combines the first read-write count with the second read-write count and performs a comprehensive analysis. This processing method enables us to more comprehensively grasp the data flow status in the storage node and identify those abnormal patterns that may be missed under traditional methods.

[0028] By comprehensively considering multi-level read and write counts, the present application can more accurately detect anomalies in read and write data, regardless of whether these anomalies are continuous or short-term bursts. This can solve the problem of low accuracy in anomaly detection of read and write data, thereby achieving the technical effect of improving the accuracy of anomaly detection of read and write data. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 is a schematic diagram of an application environment of a method for detecting abnormalities in read and write data according to an embodiment of the present application;

[0030] Figure 2 is a flow chart of a method for detecting abnormality in read and write data according to an embodiment of the present application;

[0031] Figure 3 is a schematic diagram of a method for detecting abnormality in read and write data according to an embodiment of the present application;

[0032] Figure 4 is a schematic diagram of a method for detecting abnormality in read and write data according to an embodiment of the present application;

[0033] Figure 5 is a schematic diagram of a method for detecting abnormality in read and write data according to an embodiment of the present application;

[0034] Figure 6 It is a structural block diagram of the abnormality detection device for reading and writing data in an embodiment of the present application. DETAILED DESCRIPTION

[0035] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0036] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0037] The method embodiments provided in the embodiments of the present application can be executed in a server device or a similar computing device. Taking running on a server device as an example, Figure 1 1 is a hardware structure block diagram of a server device of a method for detecting abnormalities in reading and writing data in an embodiment of the present application. Figure 1 As shown, the server device may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the above-mentioned server device may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above server device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0038] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the abnormal detection method for reading and writing data in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the server device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0039] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the server device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0040] In this embodiment, a method for detecting abnormality in read and write data is provided. Figure 2 is a flow chart of a method for detecting abnormality in read and write data according to an embodiment of the present application. Figure 2 As shown, the process includes the following steps:

[0041] Step S202, obtaining a first read / write count corresponding to a first hierarchical structure in a storage node, wherein the first read / write count is used to represent a statistical number of read / write data in the first hierarchical structure, and the read / write data is data input and / or output in the storage node;

[0042] In an exemplary embodiment, the "first level structure" refers to a logical or physical component in a storage node, which can be a directory hierarchy in a file system, a table space in a database, or a specific node or partition in a distributed storage system. This level structure is responsible for organizing and storing data to support efficient data access and operations.

[0043] The "first read and write count" is a numerical value that represents the cumulative number of all data read and write operations that occurred in the first hierarchy. This count usually includes all read and write operations since a certain point in time (such as after the system was started, after the last count was reset, etc.), and is one of the important indicators for evaluating the performance and health of storage nodes.

[0044] Step S204, obtaining a second read-write count corresponding to the second hierarchical structure in the storage node, wherein the second read-write count is used to represent the statistical number of read and write data in the second hierarchical structure;

[0045] In an exemplary embodiment, the "second hierarchical structure" may refer to another logical or physical level within the storage node relative to the first hierarchical structure. This level may be a deeper directory, partition, table, or other data storage unit.

[0046] The "second read and write count" can refer to the cumulative number of read and write operations or the amount of data that occurred in the second level structure. This count is an important indicator of the activity of the data at this level;

[0047] Step S206, when the first read-write count and / or the second read-write count meets the read-write abnormality condition, obtain the abnormality detection result corresponding to the storage node, wherein the abnormality detection result is used to indicate the abnormality of reading and writing data in the storage node.

[0048] In an exemplary embodiment, the "read-write abnormal condition" refers to the threshold or judgment criteria set by the system for the first read-write count and the second read-write count to determine whether these counts are within the normal range. Once the counts meet these conditions (such as exceeding the threshold, showing abnormal fluctuations, etc.), they are considered abnormal.

[0049] "Anomaly detection results" can be reports or information generated by the system after in-depth analysis after detecting abnormal read and write counts. For example, it explains the specific problems that occur in data read and write operations in the storage node, including but not limited to the type of abnormality, time of occurrence, possible causes, etc.

[0050] To further illustrate, an optional distributed file system, in which each node is responsible for storing a specific portion of data and monitoring the read and write status of this data in real time. If the first read and write count of a node suddenly drops significantly, while the second read and write count remains unchanged, this may trigger a preset abnormal condition. At this time, the system will perform an abnormality detection and generate an abnormality detection result, indicating that the node may have a hardware failure or network connection problem, resulting in the inability to read the data normally.

[0051] The execution subject of the above steps may be a server, a terminal, etc., but is not limited thereto.

[0052] The execution order of step S202 and step S204 is interchangeable, that is, step S204 may be executed first, and then step S202.

[0053] According to an optional embodiment of the present application, the first read and write count corresponding to the first hierarchical structure in the storage node is first obtained. This count not only represents the activity status of the data in the hierarchical structure, but also is a key indicator for evaluating whether the data flow is normal. By real-time monitoring of this count, any abnormal data read and write patterns can be captured, such as a sudden increase or decrease in data access.

[0054] In addition, the present application also focuses on the second read and write counts corresponding to the second-level structure in the storage node. This level of counts provides an additional perspective for understanding the flow of data between different structures, thereby helping to discover anomalies that may be overlooked in the first level. For example, even if the total amount of data read and write in the first level seems to be within the normal range, the data read and write volume of a specific area or category in the second level may show abnormal fluctuations.

[0055] It should be noted that the present application does not rely solely on a single read-write count to make anomaly judgments. Instead, it combines the first read-write count with the second read-write count and performs a comprehensive analysis. This processing method enables us to more comprehensively grasp the data flow status in the storage node and identify those abnormal patterns that may be missed under traditional methods.

[0056] By comprehensively considering multi-level read and write counts, the present application can more accurately detect anomalies in read and write data, regardless of whether these anomalies are continuous or short-term bursts. This can solve the problem of low accuracy in anomaly detection of read and write data, thereby achieving the technical effect of improving the accuracy of anomaly detection of read and write data.

[0057] As an optional solution, when the first read-write count and / or the second read-write count meets the read-write abnormality condition, obtaining the abnormality detection result corresponding to the storage node includes:

[0058] S1-1, when the first read-write count satisfies a first abnormal condition, obtaining a first abnormal result corresponding to the storage node, wherein the first abnormal result is used to indicate that the read-write data in the storage node is in an abnormal state, the read-write abnormal condition includes the first abnormal condition, and the abnormal detection result includes the first abnormal result;

[0059] S1-2, when the second read-write count satisfies a second abnormal condition, obtain a second abnormal result corresponding to the storage node, wherein the second abnormal result is used to represent detection information corresponding to the abnormal state, the read-write abnormal condition includes the second abnormal condition, and the abnormal detection result includes the second abnormal result.

[0060] In an optional embodiment, the "first abnormal condition" refers to a preset threshold or determination criterion related to the first read / write count, and when the first read / write count reaches or exceeds these conditions, it is considered abnormal.

[0061] The “first abnormal result” is a conclusion or report obtained by the system after detection and analysis when the first read / write count meets the first abnormal condition, and is used to indicate the abnormal state of the read / write data in the storage node.

[0062] The “second abnormal condition” is a preset threshold or determination criterion related to the second read / write count. When the second read / write count reaches or exceeds these conditions, it is considered abnormal.

[0063] The "second abnormal result" is a detection result generated by the system when the second read / write count meets the second abnormal condition, and provides detailed detection information about the abnormal state.

[0064] It should be noted that this embodiment describes how the system responds and obtains the corresponding abnormal detection result when the first read-write count or the second read-write count of the storage node triggers an abnormal condition. Specifically, if the first read-write count meets the first abnormal condition, the system will obtain the first abnormal result; if the second read-write count meets the second abnormal condition, the system will obtain the second abnormal result. These abnormal results are used to indicate the abnormal state of the read and write data in the storage node and its corresponding detection information.

[0065] By breaking down abnormal conditions and corresponding abnormal results, the system can more accurately locate and diagnose different types of read and write data anomalies. This fine-grained monitoring and detection mechanism helps improve the reliability and performance of storage systems because it allows administrators to respond and resolve data issues at specific levels or areas more quickly.

[0066] As a further example, consider a cloud storage system in which multiple storage nodes are set up and each node monitors its data read and write activities. Assume that the first read and write count represents the data read and write volume of the node as a whole, and the second read and write count represents the data read and write volume of a specific directory in the node.

[0067] When the first read and write counts suddenly surge and exceed the preset normal range threshold (i.e., the first abnormal condition is met), the system will detect and generate a first abnormal result, indicating that the data read and write activities of the entire storage node are abnormal, and it may be necessary to check whether there is a large amount of unexpected data access or the system load is too high.

[0068] Similarly, if the second read and write counts drop abnormally within a certain period of time (meeting the second abnormal condition), the system will generate a second abnormal result, indicating that the data read and write activities of a specific directory are abnormal, and further checking of the access rights, data integrity, or hardware failure of the directory may be required.

[0069] Through the optional embodiments of the present application, when the read and write counts meet the abnormal conditions, the abnormal detection results (including the first abnormal result and the second abnormal result) corresponding to the storage node are obtained, which significantly improves the system's sensitivity and response speed to abnormal situations. This mechanism ensures that even in a complex multi-level storage environment, data read and write abnormalities can be accurately and quickly identified and processed, thereby maintaining the stability of the storage system and the integrity of the data.

[0070] As an optional solution, obtaining the second abnormal result corresponding to the storage node includes:

[0071] S2-1, locating the read / write data in the abnormal state in the second hierarchical structure, and determining a target location where the abnormal event occurs in the second hierarchical structure;

[0072] S2-2, collecting information on the target location to obtain feedback information associated with the abnormal event.

[0073] In an optional embodiment, "positioning" refers to accurately finding the specific area or location where the read and write data anomaly occurs in the second hierarchical structure. "Target location" refers to the specific location in the second hierarchical structure where the abnormal event has occurred and has been located by the system. "Information collection" is the data collection and analysis process of the target location, aiming to obtain detailed information related to the abnormal event. "Feedback information" refers to data or information directly related to the abnormal event obtained through information collection, which helps to understand the nature, cause and impact of the abnormal event.

[0074] It should be noted that this embodiment describes the process of obtaining the second abnormal result corresponding to the storage node. Specifically, when the second read and write counts meet the second abnormal condition, indicating that there is an abnormal state of reading and writing data in the second hierarchical structure, the system will perform two main steps: first, locate the specific location where the abnormal event occurs in the second hierarchical structure; second, collect relevant information at the location to obtain feedback information associated with the abnormal event.

[0075] Positioning and information collection are key links in exception handling. Accurate positioning can quickly narrow the scope of the problem and improve processing efficiency; while detailed information collection helps to deeply analyze the root cause of the abnormal event and formulate effective solutions. In addition, this feedback information can also be used to optimize the system's monitoring and early warning mechanisms, and enhance the ability to prevent and respond to similar anomalies in the future.

[0076] To further illustrate, in a distributed file storage system, the second level structure may represent a specific file directory or data block. When the system detects an abnormal read and write count of a file directory, it will first locate the specific file directory (i.e., the target location), and then collect detailed information about the directory, such as checking the directory's access log, permission settings, disk health status, etc., to obtain feedback information about the abnormal read and write events.

[0077] By locating the target location of abnormal events in the second-level structure and collecting feedback information associated with abnormal events, the system can more accurately diagnose and handle abnormal states of read and write data. This refined exception handling mechanism not only improves the stability and reliability of the storage system, but also reduces the risk of data loss or damage, while providing users with a better service experience.

[0078] As an optional solution, obtaining a first read / write count corresponding to a first hierarchical structure in a storage node includes:

[0079] Obtain read and write counts corresponding to the interface class hierarchical structure in the storage node, wherein the first hierarchical structure includes the interface class hierarchical structure, and the interface class hierarchical structure is responsible for data interaction between the storage node and an external connection.

[0080] In an optional embodiment, the "interface class hierarchy structure" refers to the level in the storage node that is responsible for data interaction with external systems. This level usually handles the input and output of data and is the "gateway" for the storage node to communicate with the outside world. "Read and write counts" refers to the number or amount of data read and write operations that occur on this interface class hierarchy structure.

[0081] It should be noted that this embodiment describes a specific aspect of obtaining the first read and write count corresponding to the first hierarchical structure in the storage node. In particular, it refers to obtaining the read and write count of the interface class hierarchical structure in the storage node. The interface class hierarchical structure here belongs to the first hierarchical structure and bears the responsibility of the storage node to interact with the outside world for data.

[0082] The read and write counts of the interface class hierarchy are critical to assessing the performance and health of storage nodes. A high read and write count may mean that the interface is processing a large number of data interactions, while an abnormally low read and write count may indicate a problem with the interface or a decrease in external access. By monitoring these counts, administrators can adjust resource allocation, optimize interface performance, or perform troubleshooting in a timely manner.

[0083] As a further example, consider a database storage system, where the interface class hierarchy may be represented by an API interface specifically used to receive and send data requests. When an external application queries the database or writes data to the database through this API interface, the interface class hierarchy will record the number and amount of these operations as part of the first read and write count.

[0084] Through the optional embodiments of the present application, obtaining the read and write counts corresponding to the interface class hierarchy structure in the storage node can enable the administrator to effectively monitor and evaluate the data interaction between the storage node and the external system. This mechanism not only helps to timely discover and solve interface performance problems, but also provides important data support for capacity planning and performance optimization of the storage system. By continuously monitoring and analyzing these read and write counts, it is possible to ensure that the interface class hierarchy structure of the storage node is always kept in the best working state, thereby improving the reliability and efficiency of the entire storage system.

[0085] As an optional solution, the obtaining the first read and write count corresponding to the interface class hierarchy structure in the storage node includes at least one of the following:

[0086] Obtaining read and write counts corresponding to the HL hierarchical structure in the storage node, wherein the interface class hierarchical structure includes the HL hierarchical structure, and the HL hierarchical structure is responsible for protocol interaction between the storage node and the server;

[0087] Obtaining a read and write count corresponding to a VL hierarchical structure in the storage node, wherein the interface class hierarchical structure includes the VL hierarchical structure, and the VL hierarchical structure is responsible for writing or reading data into or from a physical disk.

[0088] In an optional embodiment, the "HL hierarchical structure" refers to a hierarchical structure in a storage node that is specifically responsible for protocol interaction with a server. It handles the communication protocol with the server to ensure the correct transmission and parsing of data.

[0089] The "VL hierarchy" refers to the hierarchical structure in the storage node that is directly responsible for writing data to the physical disk or reading data from the physical disk. It interacts closely with the underlying storage device to manage the actual storage and retrieval of data.

[0090] It should be noted that this embodiment describes two specific hierarchical structures involved when obtaining the first read and write count corresponding to the interface class hierarchical structure in the storage node: the HL hierarchical structure and the VL hierarchical structure. The HL hierarchical structure is mainly responsible for the protocol interaction between the storage node and the server, while the VL hierarchical structure is responsible for actually writing or reading data to the physical disk. Obtaining the read and write counts of these two hierarchical structures can provide a more comprehensive understanding of the data interaction of the storage node.

[0091] The HL hierarchy and VL hierarchy play different roles in the storage node, but both are indispensable parts of the data interaction process. By obtaining the read and write counts of these two hierarchical structures separately, the performance bottlenecks and potential problems of the storage node can be monitored more accurately. For example, if the read and write counts of the HL hierarchy are abnormally high, it may indicate congestion in the communication with the server or inefficient protocol processing; if the read and write counts of the VL hierarchy are abnormally low, it may mean that the physical disk is faulty or performance is degraded.

[0092] To further illustrate, in a distributed storage system, the HL hierarchy may be a module that processes network protocols such as HTTP or FTP, responsible for exchanging data with remote servers, while the VL hierarchy may be a module that directly communicates with local hard drives, responsible for the physical storage and reading of data.

[0093] By obtaining the read and write counts corresponding to the HL and VL hierarchical structures in the storage nodes, system administrators can have a deeper understanding of the operation status of the storage nodes and the efficiency of data interaction. These detailed read and write count data provide strong support for performance tuning, troubleshooting, and capacity planning, and help improve the overall performance and reliability of the storage system. At the same time, this fine-grained monitoring method also helps to promptly discover and resolve potential data storage problems, ensuring data integrity and availability.

[0094] As an optional solution, obtaining the second read / write count corresponding to the second hierarchical structure in the storage node includes:

[0095] Obtain read and write counts corresponding to a processing class hierarchical structure in the storage node, wherein the second hierarchical structure includes the processing class hierarchical structure, and the processing class hierarchical structure is responsible for processing and managing data of the storage node.

[0096] In an optional embodiment, the "processing class hierarchy" refers to a hierarchy in a storage node that is specifically responsible for data processing and management. This includes but is not limited to operations such as data sorting, classification, indexing, compression, and decompression. The "read and write count" here specifically refers to the number of data reads and writes or the amount of data involved in the data processing and management process of the processing class hierarchy.

[0097] It should be noted that this embodiment describes a specific step of obtaining the second read and write count corresponding to the second hierarchical structure in the storage node, that is, obtaining the read and write count corresponding to the processing class hierarchical structure. The processing class hierarchical structure is part of the second hierarchical structure, and its main responsibility is to process and manage the data of the storage node.

[0098] The read and write counts of the processing class hierarchy are important indicators for evaluating the data processing capabilities of the storage node. High read and write counts may mean that the processing class hierarchy is efficiently processing a large amount of data, while low read and write counts may indicate bottlenecks or problems in the data processing process. By monitoring these counts, you can promptly discover and optimize the data processing process and improve the overall performance of the storage node.

[0099] To further illustrate, in a large data warehouse system, the processing class hierarchy may be a module responsible for data cleaning, transformation, and loading (ETL). When raw data is imported from an external source into the data warehouse, this module will perform a series of processing on the data, such as removing duplicate records, converting data formats, calculating derived fields, etc. During this process, the processing class hierarchy will record the amount of data it reads and writes, and these records are part of the second read and write count.

[0100] Through the optional embodiments of the present application, obtaining the read and write counts corresponding to the processing class hierarchy structure in the storage node helps the administrator to fully understand the performance of the storage node in data processing and management. This fine-grained monitoring method can promptly discover bottlenecks and problems in the data processing process, and provide strong data support for performance tuning and troubleshooting. At the same time, through continuous monitoring and analysis of read and write counts, it can ensure that the processing class hierarchy structure is always kept in the best working state, thereby improving the data processing capability and efficiency of the entire storage system.

[0101] As an optional solution, obtaining the read and write counts corresponding to the processing class hierarchy structure in the storage node includes at least one of the following:

[0102] Obtaining read and write counts corresponding to a CA hierarchical structure in the storage node, wherein the processing class hierarchical structure includes the CA hierarchical structure, and the CA hierarchical structure is responsible for providing a data caching mechanism for the storage node;

[0103] Obtaining read and write counts corresponding to a RAID hierarchical structure in the storage node, wherein the processing class hierarchical structure includes the RAID hierarchical structure, and the RAID hierarchical structure is responsible for combining multiple independent hard disks.

[0104] In an optional embodiment, the "CA hierarchy" refers to the level in the processing class hierarchy that is responsible for providing a caching mechanism for storage nodes to access data. The caching mechanism can significantly increase the speed of data access and reduce direct access to raw storage devices. The "RAID hierarchy" refers to the level in the processing class hierarchy that is responsible for combining multiple independent hard disks to improve the reliability, performance, and capacity of data storage. RAID technology achieves these goals through data redundancy and distributed storage.

[0105] It should be noted that this embodiment further refines the specific method for obtaining the read and write counts corresponding to the processing class hierarchy structure in the storage node. It mentions two hierarchical structures: CA hierarchy structure and RAID hierarchy structure, and explains their roles in the processing class hierarchy structure and how to obtain their read and write counts.

[0106] Obtaining CA-level and RAID-level read and write counts is critical to assessing the performance and health of storage nodes. For example, high CA-level read and write counts may mean that the cache layer is working effectively, reducing access to slow storage devices; while RAID-level read and write counts can reveal the workload and performance bottlenecks of the hard disk array.

[0107] For further example, in a high-performance storage system, the CA hierarchy may be a high-speed SSD cache layer that stores the most recently accessed or most frequently accessed data, thereby accelerating the reading speed of these data. The RAID hierarchy may be an array composed of multiple hard disks, providing data redundancy or improving read and write performance through different configurations such as RAID 0, 1, and 5.

[0108] By obtaining the read and write counts corresponding to the CA hierarchical structure and RAID hierarchical structure in the storage node, the administrator can have a deeper understanding of the performance and efficiency of the storage node in the data processing and management process. This data not only helps to discover and solve performance problems in a timely manner, but also provides strong data support for the optimization and upgrade of the storage system. At the same time, this fine-grained monitoring method also helps to ensure that each hierarchical structure of the storage node can operate in the best state, thereby improving the reliability and performance of the entire storage system.

[0109] As an optional solution, the obtaining of the read and write counts corresponding to the RAID hierarchy structure in the storage node includes at least one of the following:

[0110] Obtaining read and write counts corresponding to a striped RAID hierarchy structure in the storage node, wherein data in the striped RAID hierarchy structure is distributed in blocks on multiple disks;

[0111] Obtaining read and write counts corresponding to a mirrored RAID hierarchical structure in the storage node, wherein data in the mirrored RAID hierarchical structure is stored on two or more disks at the same time;

[0112] Obtaining read and write counts corresponding to a distributed parity check RAID hierarchy structure in the storage node, wherein the distributed parity check RAID hierarchy structure stores parity check information in a distributed manner on all disks;

[0113] Obtain read and write counts corresponding to a dual distributed parity check RAID hierarchy structure in the storage node, wherein the dual distributed parity check RAID hierarchy structure uses two independent parity check information and is distributed and stored on all disks.

[0114] In an optional embodiment, a "striping-type RAID hierarchy structure" refers to a RAID structure that divides data into small blocks and stores these small blocks in a distributed manner on multiple disks. This structure improves performance by reading and writing multiple disks in parallel. A "mirror-type RAID hierarchy structure" is a RAID structure that stores data on two or more disks at the same time to provide data redundancy and prevent data loss. A "distributed parity-type RAID hierarchy structure" is a RAID structure that provides data redundancy by distributing and storing parity information on all disks. This structure can recover data when a disk fails. A "double distributed parity-type RAID hierarchy structure" uses two independent parity information and stores them in a distributed manner on all disks, thereby providing higher data redundancy and fault tolerance.

[0115] It should be noted that this embodiment describes different aspects of obtaining read and write counts corresponding to a RAID hierarchy structure in a storage node. It distinguishes four different types of RAID hierarchy structures - striping, mirroring, distributed parity, and dual distributed parity, and explains how to obtain read and write counts for these different types of RAID hierarchy structures.

[0116] Different types of RAID hierarchical structures provide different performance, redundancy, and fault tolerance characteristics. By obtaining the read and write counts of these different types of RAID hierarchical structures, administrators can more accurately understand the performance of storage nodes, data redundancy, and potential disk failure risks. This information is crucial for evaluating the health of storage systems, performing performance tuning, and developing disaster recovery plans.

[0117] For further examples, optional striping RAID hierarchical structures such as RAID 0 stripe data across multiple disks to improve read and write performance. Mirroring RAID hierarchical structures such as RAID 1 completely mirror data to another disk to ensure data security. Distributed parity RAID hierarchical structures such as RAID 5 provide data recovery capabilities through distributed parity information. Dual distributed parity RAID hierarchical structures such as RAID 6 use dual parity to tolerate the failure of two disks at the same time.

[0118] By obtaining the read and write counts of different types of RAID hierarchical structures in the storage node through the optional embodiments of the present application, it is possible to help the administrator comprehensively monitor the performance and reliability of the storage system. By comparing and analyzing these data, performance bottlenecks can be discovered in a timely manner, disk life can be predicted, and the effectiveness of data redundancy and fault tolerance can be evaluated. This fine-grained monitoring and management method helps ensure that the storage system can maintain an efficient, stable and secure operating state under various circumstances.

[0119] As an optional solution, the obtaining of the read and write counts corresponding to the RAID hierarchy structure in the storage node includes:

[0120] Obtain read and write counts corresponding to a combined RAID hierarchy structure in the storage node, wherein the combined RAID hierarchy structure is a structure combining at least two different types of RAID hierarchy structures.

[0121] In an optional embodiment, a "combined RAID hierarchy structure" refers to a complex RAID structure formed by combining at least two different types of RAID hierarchy structures in a storage system in order to obtain the advantages of multiple RAID hierarchy structures. This structure can provide a comprehensive effect of multiple RAID features in the same system.

[0122] It should be noted that this embodiment mentions obtaining the read and write counts corresponding to a special type of RAID hierarchy structure in the storage node, namely, a combined RAID hierarchy structure. The combined RAID hierarchy structure refers to a structure that combines at least two different types of RAID hierarchy structures. This combination may be to take into account the advantages of different RAID types, such as performance, capacity, or data redundancy.

[0123] The combined RAID hierarchical structure may be more complex in actual applications, and may involve multiple layers of nesting or the mixed use of multiple RAID technologies. The read and write counts of this structure can reflect the overall performance and efficiency of the system when processing data, including the flow of data between different RAID levels and the contribution of each level to data processing.

[0124] To further illustrate, for example, a storage system may first use RAID 0 (striping) to improve data read and write performance, and then implement RAID 1 (mirroring) on ​​the basis of RAID 0 to increase data redundancy and fault tolerance. In this way, the resulting combined RAID-like hierarchical structure has both the high performance of RAID 0 and the data security of RAID 1.

[0125] Through the optional embodiments of the present application, obtaining the read and write counts corresponding to the RAID hierarchy structure of the combined class in the storage node is crucial for evaluating and optimizing the overall performance of the storage system. These counts not only reveal the activity of data in different RAID levels, but also help administrators identify possible performance bottlenecks or data redundancy issues. Through in-depth analysis of these counts, administrators can more effectively adjust RAID configurations, optimize data storage strategies, and ensure that the storage system remains in optimal condition under various workloads.

[0126] As an optional solution, the obtaining of the read and write counts corresponding to the RAID hierarchy structure of the combination class in the storage node includes at least one of the following:

[0127] Obtaining read and write counts corresponding to a RAID hierarchical structure combining striping and mirroring in the storage node, wherein data in the RAID hierarchical structure combining striping and mirroring is stored in a plurality of disks in a mirrored manner and then in a striped manner;

[0128] Obtaining read and write counts corresponding to the RAID hierarchical structure combining the striping class with the distributed parity check class in the storage node, wherein the RAID hierarchical structure combining the striping class with the distributed parity check class stripes data and applies distributed parity check;

[0129] Obtaining read and write counts corresponding to the RAID hierarchical structure combining the mirroring class with the distributed parity check class in the storage node, wherein the RAID hierarchical structure combining the mirroring class with the distributed parity check class removes data mirroring and applies distributed parity check;

[0130] Obtain read and write counts corresponding to the RAID hierarchy structure combining the striping class with the dual distributed parity class in the storage node, wherein the RAID hierarchy structure combining the striping class with the dual distributed parity class stripes data and applies dual distributed parity.

[0131] In an optional embodiment, a "RAID hierarchy structure combining striping and mirroring" means that the data is first mirrored (i.e., fully copied) to multiple disks, and then the mirrored data is striped (i.e., divided into small blocks and distributedly stored). A "RAID hierarchy structure combining striping and distributed parity" means that the data is first striped, and then distributed parity is applied to provide data redundancy. A "RAID hierarchy structure combining mirroring and distributed parity" means that while the data is mirrored and stored, distributed parity is also applied, thereby combining the high availability of mirroring and the redundancy of parity. A "RAID hierarchy structure combining striping and dual distributed parity" means that dual distributed parity is further applied to the data on the basis of striping to improve data redundancy and fault tolerance.

[0132] It should be noted that this embodiment describes several specific situations for obtaining read and write counts corresponding to a combination class RAID hierarchy structure in a storage node. It lists four different combinations: a combination of striping class and mirroring class, a combination of striping class and distributed parity class, a combination of mirroring class and distributed parity class, and a combination of striping class and dual distributed parity class, and explains how to obtain the read and write counts of these combination class RAID hierarchy structures.

[0133] These combined RAID hierarchies are designed to meet specific performance, capacity, and reliability requirements by combining the advantages of different RAID types. By obtaining read and write counts for these complex RAID structures, administrators can gain insight into the actual workload, performance, and effectiveness of data redundancy on the storage system.

[0134] To further illustrate, a RAID hierarchy that combines optional striping and mirroring classes might be similar to RAID 10, which combines the mirroring of RAID 1 with the striping of RAID 0 to provide high performance and data redundancy. A RAID hierarchy that combines striping with distributed parity classes might be similar to RAID 50, which adds striping to RAID 5 (distributed parity). A RAID that combines mirroring with distributed parity classes might be a custom solution that combines the features of RAID 1 and RAID 5 to provide dual data protection. A RAID hierarchy that combines striping with dual distributed parity classes might be an advanced RAID configuration similar to RAID 60, which provides dual parity while striping.

[0135] Through the optional embodiments of the present application, the read and write counts corresponding to the RAID hierarchical structures of these combined classes in the storage node are obtained, providing the administrator with valuable information about the comprehensive performance of the storage system. This information not only helps to identify and solve potential performance bottlenecks, but also guides the administrator to perform more refined storage resource management, performance optimization and disaster recovery planning. By continuously monitoring and analyzing these read and write counts, it is possible to ensure that the storage system is always in the best state, thereby meeting the ever-changing data storage needs.

[0136] As an optional solution, before obtaining the abnormality detection result corresponding to the storage node, the method further includes:

[0137] According to a preset detection time window, a read / write detection request is triggered, wherein the read / write detection request is used to request an abnormality detection on the read / write data.

[0138] In an optional embodiment, "triggering a read-write detection request according to a preset detection time window" means that within a preset time range, the system automatically issues a request, the purpose of which is to detect whether there is any abnormality in the read and write data of the storage node.

[0139] It should be noted that this embodiment describes a step before obtaining the abnormality detection result corresponding to the storage node, that is, triggering a read / write detection request according to a preset detection time window. The purpose of this request is to perform abnormality detection on the read / write data.

[0140] The preset detection time window can be adjusted according to actual needs. For example, it can be set to be performed after the peak period ends to avoid affecting normal business. At the same time, the frequency of triggering read and write detection requests can also be customized according to factors such as the importance of the storage node and the sensitivity of the data.

[0141] To further illustrate, the system can be set to automatically trigger a read / write detection request during the time period from 2:00 a.m. to 4:00 a.m. every day. During this time period, the system will check the read / write data on the storage node to determine whether there is any abnormal behavior or data.

[0142] By triggering read and write detection requests according to the preset detection time window, you can ensure that the read and write data of the storage node is regularly and systematically detected for anomalies. This method helps to promptly discover and deal with potential data problems or security risks, thereby ensuring the stability and security of the storage system. At the same time, by setting the detection time window reasonably, you can also reduce interference with normal business activities and improve the overall operating efficiency of the system.

[0143] As an optional solution, when the detection time window includes a preset time interval and a preset time width for performing abnormality detection on the read and write data, after triggering the read and write detection request according to the preset detection time window, the method further includes:

[0144] S3-1, responding to the read / write detection request, performing a detection on the read / write data, wherein the duration of the detection is the preset time width;

[0145] S3-2, triggering a new read-write detection request for the read-write data, wherein the triggering interval between the new read-write detection request and the read-write detection request is the preset time interval;

[0146] S3-3, in response to the new read / write detection request, perform a secondary detection on the read / write data, wherein the duration of the secondary detection is the preset time width.

[0147] In an optional embodiment, the "preset time interval" refers to the length of time to wait between two read-write detection requests, and the "preset time width" refers to the duration of each read-write detection operation.

[0148] It should be noted that this embodiment describes the process of how to perform abnormal detection on the read and write data of a storage node within a specific detection time window. It involves the concepts of a preset time interval and a preset time width, and triggers and responds to read and write detection requests according to these preset parameters, and performs multiple detections on the read and write data.

[0149] By adjusting the preset time interval and preset time width, the frequency and depth of anomaly detection can be flexibly controlled. For example, in scenarios where read and write data changes frequently, a shorter time interval and width can be set to improve the real-time nature of detection; while in scenarios where data is relatively stable, a longer time interval can be set to reduce unnecessary detection overhead.

[0150] For further example, it is optional to assume that the preset time interval is 1 hour and the preset time width is 30 minutes. In this case, the system first triggers a read / write test request and performs a test on the read / write data within the next 30 minutes. After completing this test, the system waits for 1 hour (i.e., the preset time interval) and then triggers a new read / write test request and performs a second test for 30 minutes (i.e., the preset time width).

[0151] Through the optional embodiments of the present application, continuous and periodic monitoring of the read and write data of the storage node can be achieved. It not only helps to detect data anomalies in a timely manner, but also improves the accuracy of anomaly identification through multiple detections. At the same time, reasonable preset parameter settings can optimize the efficiency of system resource usage while ensuring the detection effect.

[0152] As an optional solution, when the first read-write count and / or the second read-write count meets the read-write abnormality condition, obtaining the abnormality detection result corresponding to the storage node includes:

[0153] S4-1, when the first read-write count satisfies the read-write abnormality condition, obtaining a first fluctuation abnormality result corresponding to the storage node, wherein the first fluctuation abnormality result is used to indicate that the read-write fluctuation of the first hierarchical structure is abnormal;

[0154] S4-2, when the second read-write count satisfies the read-write abnormality condition, obtaining a second fluctuation abnormality result corresponding to the storage node, wherein the second fluctuation abnormality result is used to indicate that the read-write fluctuation of the second hierarchical structure is abnormal.

[0155] In an optional embodiment, the "first read-write count" refers to the statistics of the number of read-write operations for the first hierarchical structure in the storage node. The "second read-write count" refers to the statistics of the number of read-write operations for the second hierarchical structure in the storage node. The "read-write abnormality condition" is a pre-set standard or threshold for determining whether the read-write count is normal. The "first fluctuation abnormality result" and the "second fluctuation abnormality result" are conclusions or data drawn by the system indicating that the read-write fluctuation of the hierarchical structure is abnormal when the corresponding read-write counts meet the abnormal conditions.

[0156] It should be noted that this embodiment describes how to obtain the abnormality detection result corresponding to the storage node when the first read-write count or the second read-write count (or both) meets the read-write abnormality condition. Specifically, it involves two situations: the first fluctuation abnormality result obtained when the first read-write count meets the abnormality condition, and the second fluctuation abnormality result obtained when the second read-write count meets the abnormality condition. These two results are used to indicate whether there is an abnormality in the read-write fluctuation of the first hierarchical structure and the second hierarchical structure.

[0157] In actual applications, read and write abnormal conditions may include sudden increases, decreases, and continuous fluctuations in read and write counts, which may be related to storage node performance bottlenecks, hardware failures, data corruption, and other issues. By obtaining fluctuation abnormality results, administrators can quickly locate the problem and take appropriate measures to troubleshoot and repair it.

[0158] For further example, it is optional to assume that in a storage system, the first level structure is RAID 0 (striping) and the second level structure is RAID 1 (mirroring). The system monitors that the read and write counts of RAID 0 suddenly increase significantly and exceed the preset read and write abnormal condition threshold. At this time, the system will obtain and generate a first fluctuation abnormal result, indicating that the read and write fluctuation of RAID 0 is abnormal. Similarly, if the read and write counts of RAID 1 decrease abnormally, the system will also obtain and generate a second fluctuation abnormal result.

[0159] Through the optional embodiments of the present application, the read and write behaviors of different hierarchical structures in the storage node can be monitored in real time, and timely feedback can be provided when anomalies are detected. It helps to improve the stability and reliability of the storage system and reduce the potential data loss or system crash risk caused by read and write anomalies. At the same time, through the segmented fluctuation anomaly results, the administrator can understand the operating status of the storage node more accurately, so as to make more effective maintenance and management decisions.

[0160] As an optional solution, before obtaining the first fluctuation abnormality result corresponding to the storage node, the method further includes: determining that the first read-write count satisfies the read-write abnormality condition when the read-write performance value corresponding to the first read-write count is less than a preset read-write performance threshold, wherein the read-write performance value corresponding to the first read-write count is positively correlated with the read-write fluctuation degree of the first hierarchical structure;

[0161] Before obtaining the second fluctuation abnormality result corresponding to the storage node, the method also includes: when the read-write performance value corresponding to the second read-write count is less than the read-write performance threshold, determining that the second read-write count satisfies the read-write abnormality condition, wherein the read-write performance value corresponding to the second read-write count is positively correlated with the read-write fluctuation degree of the second hierarchical structure.

[0162] In an optional embodiment, the "read-write performance value" is a quantitative indicator used to measure the read-write performance of the hierarchical structure in the storage node. It is usually associated with the degree of fluctuation of the read-write count. The "read-write performance threshold" is a pre-set standard value used to determine whether the read-write performance value is normal. When the read-write performance value is lower than this threshold, it is considered abnormal.

[0163] It should be noted that this embodiment describes a process of determining whether the first read-write count and the second read-write count meet the read-write abnormality condition. Specifically, it is achieved by comparing the read-write performance value corresponding to the read-write count with a preset read-write performance threshold. If the read-write performance value is less than the threshold, it is considered that the corresponding read-write count meets the abnormal condition. In addition, this section also points out that there is a positive correlation between the read-write performance value and the read-write fluctuation degree of the hierarchical structure.

[0164] In actual applications, read and write performance values ​​may be affected by many factors, including hardware performance, system load, network latency, etc. Therefore, setting reasonable read and write performance thresholds is crucial for accurately detecting anomalies. In addition, since read and write performance values ​​are positively correlated with the degree of read and write fluctuations, the stability of storage nodes can be predicted and evaluated by continuously monitoring read and write performance values.

[0165] For further example, it is optional to assume that the preset read / write performance threshold is 1000 IOPS (input / output operations per second). For the first level structure (such as RAID 0), if the read / write performance value corresponding to its read / write count drops to 900 IOPS, since this value is less than the threshold, the system will determine that the first read / write count meets the read / write abnormality condition. Similarly, for the second level structure (such as RAID 1), if its read / write performance value is also less than 1000 IOPS, the system will determine that the second read / write count meets the abnormality condition.

[0166] The optional embodiment of the present application provides an effective and flexible mechanism to monitor the performance status of storage nodes by comparing the read and write performance values ​​corresponding to the read and write counts with a preset threshold to determine whether the abnormal conditions are met. This mechanism can promptly detect performance degradation or increased fluctuations and trigger the corresponding abnormality handling process. This helps to improve the reliability and stability of the storage system and reduce potential risks caused by performance issues. At the same time, by utilizing the positive correlation, administrators can more intuitively understand the performance of storage nodes, thereby making more informed management and decisions.

[0167] As an optional solution, before determining that the first read-write count satisfies the read-write abnormality condition, the method further includes: determining, in the first read-write count, a read-write count whose continuous fluctuation duration is greater than or equal to a preset continuous fluctuation duration threshold as a read-write performance value corresponding to the first read-write count;

[0168] Before determining that the first read-write count satisfies the read-write abnormality condition, the method further includes: determining, in the second read-write count, a read-write count whose continuous fluctuation duration is greater than or equal to the continuous fluctuation duration threshold as a read-write performance value corresponding to the second read-write count.

[0169] In an optional embodiment, "continuous fluctuation duration" refers to the duration that a certain read / write count maintains an upward or downward trend in a continuous period of time. "Continuous fluctuation duration threshold" is a time length standard preset by the system, which is used to determine whether the fluctuation of the read / write count is continuous, so as to serve as an effective basis for evaluating the read / write performance.

[0170] It should be noted that this embodiment describes how to determine whether the read / write count should be included in the calculation of the read / write performance value according to the duration of the continuous fluctuation of the read / write count. Specifically, it involves two steps: for the first read / write count and the second read / write count, only when the duration of the continuous fluctuation of one of the read / write counts reaches or exceeds the preset threshold, the read / write count will be identified as the corresponding read / write performance value.

[0171] This embodiment can help the system more accurately identify those read and write performance changes with long-term impact trends, while ignoring those fluctuations that may be only transient or occasional. By setting a reasonable continuous fluctuation duration threshold, the system can more accurately evaluate the performance status of the storage node and promptly discover possible performance problems.

[0172] To further illustrate, for example, the system preset continuous fluctuation duration threshold is 5 minutes. For the first read / write count, if a certain read / write operation keeps increasing for 6 consecutive minutes, then the read / write count for these 6 minutes will be determined as the read / write performance value corresponding to the first read / write count. Similarly, for the second read / write count, if a certain read / write operation keeps decreasing for 5 consecutive minutes or more, then the read / write count for this time period will be used to calculate the read / write performance value of the second read / write count.

[0173] Through the optional embodiments of the present application, the system can achieve refined management of the read and write performance of storage nodes. It can not only effectively filter out those short-term and meaningless read and write count fluctuations, but also ensure that only those read and write counts that truly reflect the performance status of the storage node are taken into consideration. This helps to improve the accuracy and sensitivity of the system's detection of performance problems, thereby providing administrators with more reliable performance monitoring and fault warning services. At the same time, the flexibility and configurability of this method also enable it to adapt to the performance management needs in different application scenarios.

[0174] As an optional solution, in the process of obtaining the abnormality detection result corresponding to the storage node, the method further includes:

[0175] S5-1, obtaining fiber task statistics information, wherein the fiber task statistics information is used to reflect the time consumption of each task in the storage node within a preset time period, and the fiber task statistics information includes at least one of the following: task name, task execution time, task waiting time, task execution times, single task execution time, and waiting time;

[0176] S5-2, based on the fibre task statistical information, locate the location where the read and write data in the storage node is abnormal.

[0177] In an optional embodiment, "fibre task statistics" refers to statistical data on the execution and time consumption of various tasks in the storage node within a specific time period. "Task name" refers to the identifier or name of the task being executed. "Task execution time" refers to the time it takes for the task to actually execute. "Task waiting time" refers to the time it takes for the task to wait for resources or conditions to be met before it starts executing. "Number of task executions" refers to the number of times a task is executed within a preset time period. "Single task execution time" refers to the time it takes for each task to be executed. "Waiting time" may refer to the total waiting time from the submission of the task to the start of execution, or the cumulative time waiting for certain resources or conditions during the execution of the task.

[0178] It should be noted that in the process of obtaining the abnormality detection results corresponding to the storage node, this embodiment also includes two key steps. First, the fiber task statistics are obtained, which reflect the time consumption of various tasks in the storage node within a preset time period. Second, these fiber task statistics are used to locate the specific location where the abnormality of reading and writing data exists in the storage node.

[0179] By analyzing the fiber task statistics in detail, system administrators can gain in-depth insights into the performance and bottlenecks of storage nodes. For example, if a task is found to have a long waiting time, this may mean that there is contention for I / O resources on the storage node or congestion on the storage network. In addition, if the execution time of a single task fluctuates greatly, it may also indicate a hardware failure or system configuration problem.

[0180] To further illustrate, for example, the fiber task statistics may show that the "data writing task" was executed 100 times in the last hour, with an average execution time of 50 milliseconds, but one execution time was as long as 5 seconds. This abnormally long execution time may indicate some kind of problem in the data writing process, such as disk failure, network latency, or other resource contention issues.

[0181] Through the optional embodiments of the present application, a refined, data-driven problem diagnosis method is provided. By real-time monitoring and analysis of task execution, administrators can quickly discover and resolve performance bottlenecks and abnormal situations in storage nodes, thereby improving the reliability and performance of the entire storage system. This method not only improves the efficiency of problem solving, but also provides data support for preventing similar problems from occurring in the future.

[0182] As an optional solution, in the process of obtaining the abnormality detection result corresponding to the storage node, the method further includes:

[0183] S6-1, obtaining call stack information, wherein the call stack information provides a function call stack status of each CPU core in the storage node at a specific moment;

[0184] S6-2: Locate the location where the read / write data is abnormal in the storage node according to the call stack information.

[0185] In an optional embodiment, "call stack information" refers to the record of each function call level during the program execution at a specific time point, including the order of function calls, the currently executed function, and the function waiting to return, etc. "CPU core" refers to an independent execution unit in the processor that can execute program instructions in parallel. "Function call stack" is a data structure formed by each function call when the program is running, which records the calling relationship between functions.

[0186] It should be noted that, in the process of obtaining the abnormality detection result corresponding to the storage node, this embodiment also involves obtaining call stack information, and using this information to locate the location of the abnormal reading and writing data in the storage node. The call stack information shows the function call stack on each CPU core in the storage node at a specific moment, which is a detailed record of the program execution process.

[0187] The acquisition of call stack information is usually used for debugging and performance analysis. In complex system environments, especially in the case of multi-threaded or multi-core processors, call stack information is crucial for understanding program behavior, identifying performance bottlenecks, and locating errors. In storage systems, by analyzing call stack information, potential problems in the data read and write path can be revealed, such as unreasonable function call sequences, resource contention, or deadlocks.

[0188] To further illustrate, for example, when an exception occurs in a write operation in a storage node, the system can capture the call stack information at this time. This information may show that when the exception occurs, a CPU core is executing a specific disk write function, which is called by a higher-level file system operation function. By analyzing this call stack, developers can accurately find the specific function and operation that caused the exception.

[0189] Through the optional embodiments of the present application, the accuracy and efficiency of problem diagnosis are improved, helping developers or system administrators to quickly identify the specific reasons that lead to storage node performance degradation or data read and write errors. This abnormal location method based on the call stack not only improves the maintainability of the system, but also provides strong support for optimizing the performance and stability of storage nodes.

[0190] As an optional solution, for ease of understanding, the above-mentioned abnormal detection method for reading and writing data is applied to the diagnosis scenario of fluctuations in the input and output (IO) performance of storage devices. The storage system is mainly used to organize a certain number of hard disks and manage the data stored on the hard disks to provide data storage access services for the server. In the process of providing storage services for the server, the storage system first manages the storage space of the back-end hard disks in a unified manner according to certain rules to form a storage pool, and then allocates a part of the storage space in the storage pool according to user needs and maps it to the host in the form of a storage volume. From the perspective of the host, the volume is equivalent to a hard disk directly connected to the server. The server can read and write data (IO business) based on this mapped volume. The storage system can be composed of multiple controllers (also known as storage system nodes).

[0191] In an optional embodiment, if Figure 3As shown in the figure, the storage nodes are divided into several layers, as follows:

[0192] HL layer: used to handle protocol interactions of the server, such as connection establishment, IO communication, fault handling, and failure retransmission;

[0193] CA layer: used to manage IO cache. The cache layer also provides functions such as read-ahead and write-back that help improve performance.

[0194] RAID layer: RAID (Redundant Array of IndependentDisks) is a data storage technology that combines multiple independent hard disks to form a logical hard disk array to provide higher data reliability, better performance or larger storage capacity. RAID can provide different levels of data protection and performance gains through data distribution and redundancy mechanisms. The following are some common RAID levels:

[0195] RAID 0: Striping, data is distributed in blocks across multiple disks, providing higher performance and capacity. However, RAID 0 has no redundancy mechanism, and a failed disk will result in complete data loss.

[0196] RAID 1: Mirroring, data is stored on two or more disks at the same time, providing data redundancy and reliability. Read performance can be improved, but write performance is equivalent to a single disk. RAID 1 requires at least two disks.

[0197] RAID 5: Distributed Parity, which stores parity information on all disks, providing fault tolerance and performance improvement. RAID 5 requires at least three disks.

[0198] RAID 6: Double Distributed Parity, similar to RAID 5, but uses two independent parity information to provide higher fault tolerance. RAID 6 requires at least four disks.

[0199] RAID 10 (RAID 1+0): combines RAID 1 and RAID 0. Data is mirrored and stored on multiple disks, and then striped. It provides high performance and fault tolerance. At least four disks are required.

[0200] VL layer: handles the backend IO to disk, including read IO to read data from the real disk, write IO to write the IO sent by the raid layer to the real disk, and corresponding fault detection and reporting functions.

[0201] It should be noted that a common problem encountered in IO delivery is IO fluctuation. For example, during the IO process, there is a one-second fluctuation. Generally speaking, if the fluctuation continues, it is relatively easy to locate. The most difficult problem is that IO fluctuations occur and then return to normal. This is felt on the server side as business lag. Usually, this problem is very difficult to locate and there is no effective means of locating it.

[0202] In this regard, this embodiment implements a diagnostic framework for IO fluctuation problems within the storage system to address the above pain points, which can help locate IO fluctuation problems.

[0203] To further illustrate, the optional Figure 4 As shown, the diagnostic framework of this embodiment consists of three parts, namely:

[0204] The IO detection module is used to detect the IO quantity of each layer. When fluctuation occurs, it does not mean that all layers do not have IO. It is possible that there is IO in the upper layer, but the lower layer cannot flush it, or is blocked. Therefore, the IO quantity of each layer is required to facilitate the location of the problematic layer.

[0205] Threshold management module: used to control the time granularity of detection. Usually, the minimum fluctuation time of IO observed from the server is more than 1s, so the time granularity of observation should be lower than this value to grasp the time point of the problem as much as possible, so it can be set;

[0206] Information capture module: In order to locate the cause of IO fluctuations, two types of information are captured as reference. The first is the fiber task snapshot, which is the task statistics within a period of time (the default is 100ms) during the fluctuation process, sorted by the length of task execution time, which represents the overall statistical information before and after the problem occurs; the second is the random capture of call stacks. The randomly captured call stacks have a certain degree of randomness. This can help locate thread hangs, dead loops, and extremely long tasks, and serves as supplementary information for the above task statistics.

[0207] In an optional embodiment of the present application, the work of the IO detection module is mainly to record the IO counts of each layer, such as Figure 5 As shown, the details are as follows:

[0208] Start the detection timer with a period of 100ms. If the IO drops to 0 for 100ms, it will be recorded once (the period is configurable).

[0209] Record the IO counts of HL, CA, and RAID modules;

[0210] Subtract the IO count of the previous stage to get the 100ms IO count of HL, CA, and RAID;

[0211] Determine whether the IO of HL is 0. If HL is 0, it is considered that IO fluctuation has occurred;

[0212] Here is an explanation as to why we only detect HL's IO, because HL's lack of IO is the real fluctuation for customers. In fact, there is a situation where RAID IO is 0, and the IO may be cached in CA at this time, which is not considered a fluctuation. CA IO is 0, which is also a fluctuation, but there is no scenario where CA IO is 0 and HL is not 0. In summary, if IO is determined to be 0, HL can be detected, and the data collection of CA and RAID is to assist in positioning later.

[0213] Trigger information collection, which is the result of detection. The collected information is used to locate fluctuation problems.

[0214] In an optional embodiment of the present application, the threshold management module mainly provides three configurable parameters, as follows:

[0215] IO time width: manages the IO detection width, such as every second, every 0.1 second, and every 5 seconds. This should be designed according to the problem site and can be modified according to the situation at the problem site. For example, when a problem occurs, there is a drop of 0 for 1 second, so it is recommended to configure it to 1 or 0.5;

[0216] Definition of decline: For example, if it is 50% lower than the mean, writing 100 is fluctuation detection; this value can be configured for tool scalability, and can locate fluctuations or performance fluctuations;

[0217] Decline duration: How long does a decline last before it is considered a decline? Usually, a value equal to 1 is sufficient. It can be configured in special cases to indicate how long a decline lasts before triggering information collection.

[0218] In an optional embodiment of the present application, the information collection module is the key to locating the problem and needs to collect two types of information, as follows:

[0219] 1. Fibre task statistics: This is the cumulative value of continuous information within a time period, which can indicate the time consumption of tasks within this period and is used to locate the main function causing fluctuations. It includes the following information: task name, task execution time, task waiting time, number of task executions, single task execution time, and waiting time. The examples are as follows:

[0220] [0x055] : vl_erp_io_complete_from_batch fast_batch4.86551E+11470830081841718685313134113

[0221] [0x065] : vl_ent_complete_io_from_batch fast_batch2.53756E+11202707112981718499477005

[0222] [0x045] : vl_tach_io_execute_from_batch fast_batch1.18068E+113888123599217180493332110

[0223] [0x05b] : vl_ent_submit_drive_io_from_batch fast_batch3.38119E+115446787246417048786994115

[0224] [0x05d] : Rd6_Vol_IoDone3 fast_batch1.8151E+12262173341081227884070703110

[0225] [0x05a] : rd_rk_hamgr_inbound_deliver_msg fast_batch5.99336E+111353452694281718983434907

[0226] [0x09e] : hl_rw_done_all_from_batch fast_batch35386503760167699055106820406224111

[0227] [0x09f] : hl_start_transfer_from_batch fast_batch40107576554184935501726820402227112

[0228] [0x05f] : ca_disk_submit_from_batch_upper fast_batch1.09428E+11741373653946819191776551

[0229] [0x053] : ca_pio_data_transfer_done_from_batch fast_batch90440504524368867819666819189663225

[0230] [0x064] : ca_vio_done_from_batch fast_batch55789534420185731030946819189338112

[0231] [0x058] : Rd6_StartPhase1FromBatch fast_batch6.35255E+1126093881274617272648489220

[0232] [0x057] : Rd6_FinishStripOperationsBatch fast_batch6.13973E+1122213833152613956347475117

[0233] [0x062] : Rd6_Xor_BatchToXorDone fast_batch6.9272E+1134561315224613956253537226

[0234] [0x066] : plmm_xor_batch fast_batch58520032566357961297046136749445227

[0235] [0x044] : lv_node_sequence_notify fast_flbre303804358009258778150578163822507

[0236] [0x063] : lv_omq_send_outbound_messages fast_flbre58647936782233325853545470678551220

[0237] [0x056] : Rd6_StartPhase1FromBatchread fast_batch4.89575E+1110366800596477603748487110

[0238] [0x05e] : rd_agt_submit_start_tcb_from_batchread fast_batch6.41235E+1124585699962477603763639224

[0239] [0x059]: Rd6_StartPhase2_Read fast_batch4.50185E+11861429686847760334444808

[0240] 2. Call stack information: The call stack information of each core is supplemented by the above content. The following is an example: 5403

[0242] [ <ffffffff810cd84f>] get_futex_value_locked+0x26 / 0x4c

[0243] [ <ffffffff810cde01>] futex_wait_queue_me+0xbd / 0xfe

[0244] [ <ffffffff810ce9de>] futex_wait+0xe6 / 0x1f0

[0245] [ <ffffffff810b75db>] check_preempt_curr+0x45 / 0x67

[0246] [ <ffffffff810b7611>] ttwu_do_wakeup+0x14 / 0xef

[0247] [ <ffffffff810b9764>] try_to_wake_up+0x26d / 0x27b

[0248] [ <ffffffff810cfdc5>] do_futex+0xaa / 0x475

[0249] [ <ffffffff8104766a>] syscall_trace_leave+0x144 / 0x182

[0250] [ <ffffffff810c4c4a>] cpuacct_account_field+0x16 / 0x58

[0251] [ <ffffffff810d024c>] SyS_futex+0xbc / 0x138

[0252] [ <ffffffff816bafe9>] tracesys+0xd0 / 0xd5

[0253] [ <ffffffffffffffff>] 0xffffffffffffffff 5404

[0255] [ <ffffffff810cd84f>] get_futex_value_locked+0x26 / 0x4c

[0256] [ <ffffffff810cde01>] futex_wait_queue_me+0xbd / 0xfe

[0257] [ <ffffffff810ce9de>] futex_wait+0xe6 / 0x1f0

[0258] [ <ffffffff810cfdc5>] do_futex+0xaa / 0x475

[0259] [ <ffffffff8104766a>] syscall_trace_leave+0x144 / 0x182

[0260] [ <ffffffff810c4c4a>] cpuacct_account_field+0x16 / 0x58

[0261] [ <ffffffff810d024c>] SyS_futex+0xbc / 0x138

[0262] [ <ffffffff816bafe9>] tracesys+0xd0 / 0xd5

[0263] [ <ffffffffffffffff>] 0xffffffffffffffff 5405

[0265] [ <ffffffff810cd84f>] get_futex_value_locked+0x26 / 0x4c

[0266] [ <ffffffff810cde01>] futex_wait_queue_me+0xbd / 0xfe

[0267] [ <ffffffff810ce9de>] futex_wait+0xe6 / 0x1f0

[0268] [ <ffffffff810cfdc5>] do_futex+0xaa / 0x475

[0269] [ <ffffffff8104766a>] syscall_trace_leave+0x144 / 0x182

[0270] [ <ffffffff810c4c4a>] cpuacct_account_field+0x16 / 0x58

[0271] [ <ffffffff810d024c>] SyS_futex+0xbc / 0x138

[0272] [ <ffffffff816bafe9>] tracesys+0xd0 / 0xd5

[0273] [ <ffffffffffffffff>] 0xffffffffffffffff 5406

[0275] [ <ffffffff810cd84f>] get_futex_value_locked+0x26 / 0x4c

[0276] [ <ffffffff810cde01>] futex_wait_queue_me+0xbd / 0xfe

[0277] [ <ffffffff810ce9de>] futex_wait+0xe6 / 0x1f0

[0278] [ <ffffffff810cfdc5>] do_futex+0xaa / 0x475

[0279] [ <ffffffff8104766a>] syscall_trace_leave+0x144 / 0x182

[0280] [ <ffffffff810c4c4a>] cpuacct_account_field+0x16 / 0x58

[0281] [ <ffffffff810d024c>] SyS_futex+0xbc / 0x138

[0282] [ <ffffffff816bafe9>] tracesys+0xd0 / 0xd5

[0283] [ <ffffffffffffffff>] 0xffffffffffffffff 5407

[0285] [ <ffffffff810cd84f>] get_futex_value_locked+0x26 / 0x4c

[0286] [ <ffffffff810cde01>] futex_wait_queue_me+0xbd / 0xfe

[0287] [ <ffffffff810ce9de>] futex_wait+0xe6 / 0x1f0

[0288] [ <ffffffff810cfdc5>] do_futex+0xaa / 0x475

[0289] [ <ffffffff8104766a>] syscall_trace_leave+0x144 / 0x182

[0290] [ <ffffffff810c4c4a>] cpuacct_account_field+0x16 / 0x58

[0291] [ <ffffffff810d024c>] SyS_futex+0xbc / 0x138

[0292] [ <ffffffff816bafe9>] tracesys+0xd0 / 0xd5

[0293] [ <ffffffffffffffff>] 0xffffffffffffffff

[0294] Based on the above content, we prioritize the task time for analysis. For example, the vl_erp_io_complete_from_batch function takes the longest time and can be used as a priority suspect. Then we can analyze and locate the problem based on other information of this module.

[0295] An optional embodiment of the present application proposes a tool for detecting input / output (IO) fluctuations in a storage system. The tool can not only effectively identify IO fluctuation problems in the storage system, but also accurately locate the root causes of these problems, thereby providing a new technical means for solving performance bottlenecks.

[0296] Furthermore, the optional embodiments of the present application fill the gap in the current technology in storage system performance monitoring and diagnosis. This improvement not only improves the stability of system performance, but also provides an efficient and convenient performance optimization method for system administrators and developers.

[0297] The technical effects of this embodiment are mainly reflected in the following aspects: First, by detecting IO fluctuations in real time, potential performance problems can be quickly discovered and resolved, thereby ensuring that the storage system provides continuous and stable performance output; second, the optimized system performance will significantly improve the user experience and meet the user's needs for high-speed and smooth data storage; finally, the application of the present invention can also effectively improve the approval rate of centralized procurement and enhance the competitiveness of products in the market.

[0298] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of each embodiment of the present application.

[0299] In this embodiment, a device for detecting abnormalities in read and write data is also provided, and the device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0300] Figure 6 is a structural block diagram of a device for detecting abnormality in reading and writing data according to an embodiment of the present application, such as Figure 6 As shown, the device comprises:

[0301] A first acquisition unit 602 is used to acquire a first read / write count corresponding to a first hierarchical structure in a storage node, wherein the first read / write count is used to represent a statistical number of read / write data in the first hierarchical structure, and the read / write data is data input and / or output in the storage node;

[0302] A second acquisition unit 604 is used to acquire a second read-write count corresponding to a second hierarchical structure in the storage node, wherein the second read-write count is used to represent a statistical number of the read-write data in the second hierarchical structure;

[0303] The third acquisition unit 606 is used to acquire the abnormality detection result corresponding to the storage node when the first read-write count and / or the second read-write count meets the read-write abnormality condition, wherein the abnormality detection result is used to indicate the abnormality of the read and write data in the storage node.

[0304] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0305] As an optional solution, the third obtaining unit 606 includes:

[0306] A first acquisition module, configured to acquire a first abnormal result corresponding to the storage node when the first read-write count satisfies a first abnormal condition, wherein the first abnormal result is used to indicate that the read-write data in the storage node is in an abnormal state, the read-write abnormal condition includes the first abnormal condition, and the abnormal detection result includes the first abnormal result;

[0307] A second acquisition module is used to acquire a second abnormal result corresponding to the storage node when the second read and write count meets a second abnormal condition, wherein the second abnormal result is used to represent detection information corresponding to the abnormal state, the read and write abnormal condition includes the second abnormal condition, and the abnormal detection result includes the second abnormal result.

[0308] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0309] As an optional solution, the second acquisition module includes:

[0310] a positioning submodule, used for locating the read and write data in the abnormal state in the second hierarchical structure, and determining a target position where the abnormal event occurs in the second hierarchical structure;

[0311] The collection submodule is used to collect information on the target location and obtain feedback information associated with the abnormal event.

[0312] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0313] As an optional solution, the first acquiring unit 602 includes:

[0314] The third acquisition module is used to obtain the read and write counts corresponding to the interface class hierarchical structure in the storage node, wherein the first hierarchical structure includes the interface class hierarchical structure, and the interface class hierarchical structure is responsible for data interaction between the storage node and the external connection.

[0315] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0316] As an optional solution, the third acquisition module includes at least one of the following:

[0317] A first acquisition submodule is used to acquire the read and write counts corresponding to the HL hierarchical structure in the storage node, wherein the interface class hierarchical structure includes the HL hierarchical structure, and the HL hierarchical structure is responsible for the protocol interaction between the storage node and the server;

[0318] The second acquisition submodule is used to obtain the read and write counts corresponding to the VL hierarchical structure in the storage node, wherein the interface class hierarchical structure includes the VL hierarchical structure, and the VL hierarchical structure is responsible for writing or reading data into or from the physical disk.

[0319] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0320] As an optional solution, the second obtaining unit 604 includes:

[0321] A fourth acquisition module is used to obtain the read and write counts corresponding to the processing class hierarchy structure in the storage node, wherein the second hierarchy structure includes the processing class hierarchy structure, and the processing class hierarchy structure is responsible for processing and managing data of the storage node.

[0322] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0323] As an optional solution, the fourth acquisition module includes at least one of the following:

[0324] A third acquisition submodule is used to obtain the read and write counts corresponding to the CA hierarchical structure in the storage node, wherein the processing class hierarchical structure includes the CA hierarchical structure, and the CA hierarchical structure is responsible for providing a cache mechanism for data in the storage node;

[0325] The fourth acquisition submodule is used to obtain the read and write counts corresponding to the RAID hierarchical structure in the storage node, wherein the processing class hierarchical structure includes the RAID hierarchical structure, and the RAID hierarchical structure is responsible for combining multiple independent hard disks.

[0326] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0327] As an optional solution, the fourth acquisition submodule includes at least one of the following:

[0328] A first acquisition subunit is used to acquire a read and write count corresponding to a striped RAID hierarchical structure in the storage node, wherein data in the striped RAID hierarchical structure is distributed in blocks on multiple disks;

[0329] A second acquisition subunit is used to acquire read and write counts corresponding to a mirrored RAID hierarchical structure in the storage node, wherein data in the mirrored RAID hierarchical structure is stored on two or more disks at the same time;

[0330] A third acquisition subunit is used to obtain the read and write counts corresponding to the distributed parity check RAID hierarchy structure in the storage node, wherein the distributed parity check RAID hierarchy structure stores the parity check information in a distributed manner on all disks;

[0331] The fourth acquisition subunit is used to obtain the read and write counts corresponding to the dual distributed parity check RAID hierarchy structure in the storage node, wherein the dual distributed parity check RAID hierarchy structure uses two independent parity check information and is distributed and stored on all disks.

[0332] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0333] As an optional solution, the fourth acquisition submodule includes:

[0334] The fifth acquisition subunit is used to acquire the read and write counts corresponding to the combined RAID hierarchy structure in the storage node, wherein the combined RAID hierarchy structure is a structure combining at least two different types of RAID hierarchy structures.

[0335] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0336] As an optional solution, the fifth acquisition subunit includes at least one of the following:

[0337] A first acquisition subcomponent is used to acquire read and write counts corresponding to a RAID hierarchical structure combining a striping class and a mirroring class in the storage node, wherein data in the RAID hierarchical structure combining a striping class and a mirroring class is stored in a plurality of disks in a mirrored manner and then stored in a striped manner;

[0338] a second acquisition subcomponent, configured to acquire read and write counts corresponding to the RAID hierarchical structure combining the striping class with the distributed parity check class in the storage node, wherein the RAID hierarchical structure combining the striping class with the distributed parity check class stripes data and applies distributed parity check;

[0339] A third acquisition subcomponent is used to obtain the read and write counts corresponding to the RAID hierarchical structure combining the mirroring class with the distributed parity check class in the storage node, wherein the RAID hierarchical structure combining the mirroring class with the distributed parity check class removes data mirroring and applies distributed parity check;

[0340] The fourth acquisition subcomponent is used to obtain the read and write counts corresponding to the RAID hierarchy structure combining the striping class and the dual distributed parity class in the storage node, wherein the RAID hierarchy structure combining the striping class and the dual distributed parity class stripes the data and applies dual distributed parity.

[0341] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0342] As an optional solution, the device further includes:

[0343] The first trigger unit is used to trigger a read-write detection request according to a preset detection time window before obtaining the abnormality detection result corresponding to the storage node, wherein the read-write detection request is used to request abnormality detection of the read-write data.

[0344] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0345] As an optional solution, the device further includes:

[0346] A first detection unit is used for, in a case where the detection time window includes a preset time interval and a preset time width for performing abnormality detection on the read-write data, responding to the read-write detection request after triggering the read-write detection request according to the preset detection time window, to perform a detection on the read-write data, wherein the duration of the one detection is the preset time width;

[0347] A second triggering unit is used for triggering a new read-write detection request for the read-write data after the read-write detection request is triggered according to the preset detection time window, when the detection time window includes a preset time interval and a preset time width for performing abnormality detection on the read-write data, wherein the triggering interval between the new read-write detection request and the read-write detection request is the preset time interval;

[0348] A second detection unit is used for performing a secondary detection on the read-write data in response to the new read-write detection request after triggering the read-write detection request according to the preset detection time window, when the detection time window includes a preset time interval and a preset time width for performing abnormal detection on the read-write data, wherein the duration of the secondary detection is the preset time width.

[0349] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0350] As an optional solution, the third obtaining unit 606 includes:

[0351] A fifth acquisition module, configured to acquire a first fluctuation abnormality result corresponding to the storage node when the first read-write count satisfies the read-write abnormality condition, wherein the first fluctuation abnormality result is used to indicate that the read-write fluctuation of the first hierarchical structure is abnormal;

[0352] The sixth acquisition module is used to acquire a second fluctuation abnormal result corresponding to the storage node when the second read-write count meets the read-write abnormal condition, wherein the second fluctuation abnormal result is used to indicate that the read-write fluctuation of the second hierarchical structure is abnormal.

[0353] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0354] As an optional solution, the device further includes: a first determination module, which is used to determine that the first read-write count satisfies the read-write abnormality condition before obtaining the first fluctuation abnormality result corresponding to the storage node, when the read-write performance value corresponding to the first read-write count is less than a preset read-write performance threshold, wherein the read-write performance value corresponding to the first read-write count is positively correlated with the read-write fluctuation degree of the first hierarchical structure;

[0355] The device also includes: a second determination module, which is used to determine that the second read-write count satisfies the read-write exception condition before obtaining the second fluctuation exception result corresponding to the storage node, when the read-write performance value corresponding to the second read-write count is less than the read-write performance threshold, wherein there is a positive correlation between the read-write performance value corresponding to the second read-write count and the degree of read-write fluctuation of the second hierarchical structure.

[0356] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0357] As an optional solution, the device further includes: a third determination module, which is used to determine, before determining that the first read-write count satisfies the read-write abnormality condition, a read-write count in the first read-write count whose continuous fluctuation duration is greater than or equal to a preset continuous fluctuation duration threshold as a read-write performance value corresponding to the first read-write count;

[0358] The device also includes: a fourth determination module, which is used to determine, before determining that the first read-write count satisfies the read-write abnormality condition, a read-write count in the second read-write count whose continuous fluctuation duration is greater than or equal to the continuous fluctuation duration threshold as the read-write performance value corresponding to the second read-write count.

[0359] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0360] As an optional solution, the device further includes:

[0361] a fourth acquisition unit, configured to acquire fiber task statistics information in the process of acquiring the abnormality detection result corresponding to the storage node, wherein the fiber task statistics information is used to reflect the time consumption of each task in the storage node within a preset time period, and the fiber task statistics information includes at least one of the following: task name, task execution time, task waiting time, number of task executions, single task execution time, and waiting time;

[0362] The first positioning unit is used to locate the position where the read and write data in the storage node is abnormal according to the fibre task statistical information during the process of obtaining the abnormality detection result corresponding to the storage node.

[0363] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0364] As an optional solution, the device further includes:

[0365] A fifth acquisition unit is used to acquire call stack information in the process of acquiring the abnormality detection result corresponding to the storage node, wherein the call stack information provides the function call stack situation of each CPU core in the storage node at a specific moment;

[0366] A second positioning unit is configured to locate, in the process of obtaining the abnormality detection result corresponding to the storage node, a position where the abnormality of the read and write data exists in the storage node according to the call stack information.

[0367] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting abnormalities in reading and writing data, which will not be described in detail in this example.

[0368] It should be noted that the above-mentioned virtual devices (modules, units, sub-modules, sub-units, components, etc.) can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to this: the above-mentioned virtual devices are all located in the same processor; or, the above-mentioned virtual devices are located in different processors in any combination.

[0369] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0370] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0371] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0372] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0373] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0374] Obviously, those skilled in the art should understand that the above-mentioned virtual devices or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0375] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present application shall be included in the protection scope of the present application.< / ffffffffffffffff> < / ffffffffffffffff> < / ffffffffffffffff> < / ffffffffffffffff> < / ffffffffffffffff>

Claims

1. A method for detecting abnormality in read and write data, characterized in that: include: Obtaining a first read-write count corresponding to a first hierarchical structure in a storage node, wherein the first read-write count is used to represent a statistical number of read-write data in the first hierarchical structure, the read-write data is data input and / or output in the storage node, and the first hierarchical structure includes an interface class hierarchical structure, and the interface class hierarchical structure is responsible for data interaction between the storage node and the outside world; Obtaining a second read-write count corresponding to a second hierarchical structure in the storage node, wherein the second read-write count is used to represent a statistical quantity of the read-write data in the second hierarchical structure, and the second hierarchical structure includes a processing class hierarchical structure, and the processing class hierarchical structure is responsible for processing and management of data of the storage node; When the first read-write count and / or the second read-write count meets a read-write abnormality condition, obtaining an abnormality detection result corresponding to the storage node, wherein the abnormality detection result is used to indicate an abnormality of the read-write data in the storage node; The obtaining, when the first read-write count and / or the second read-write count meets a read-write abnormality condition, an abnormality detection result corresponding to the storage node includes: When the first read / write count satisfies a first abnormal condition, obtaining a first abnormal result corresponding to the storage node, wherein the first abnormal result is used to indicate that the read / write data in the storage node is in an abnormal state, the read / write abnormal condition includes the first abnormal condition, and the abnormal detection result includes the first abnormal result; When the second read / write count satisfies a second abnormal condition, obtaining a second abnormal result corresponding to the storage node, wherein the second abnormal result is used to indicate detection information corresponding to the abnormal state, the read / write abnormal condition includes the second abnormal condition, and the abnormal detection result includes the second abnormal result; The obtaining the second abnormal result corresponding to the storage node includes: Positioning the read / write data in the abnormal state in the second hierarchical structure to determine a target location where the abnormal event occurs in the second hierarchical structure; Collecting information about the target location to obtain feedback information related to the abnormal event; In the process of obtaining the abnormality detection result corresponding to the storage node, the method further includes: Obtain fiber task statistics information, wherein the fiber task statistics information is used to reflect the time consumption of each task in the storage node within a preset time period; According to the fiber task statistical information, locate the location where the read and write data in the storage node is abnormal; Randomly grab the call stack as supplementary information to the fiber task statistics.

2. The method according to claim 1, characterized in that The obtaining of a first read / write count corresponding to a first hierarchical structure in a storage node includes: Obtaining read and write counts corresponding to the interface class hierarchy structure in the storage node; The obtaining of the read and write counts corresponding to the interface class hierarchy structure in the storage node includes at least one of the following: Obtaining read and write counts corresponding to the HL hierarchical structure in the storage node, wherein the interface class hierarchical structure includes the HL hierarchical structure, and the HL hierarchical structure is responsible for protocol interaction between the storage node and the server; Obtaining a read and write count corresponding to a VL hierarchical structure in the storage node, wherein the interface class hierarchical structure includes the VL hierarchical structure, and the VL hierarchical structure is responsible for writing or reading data into or from a physical disk.

3. The method according to claim 1, characterized in that The obtaining a second read / write count corresponding to the second hierarchical structure in the storage node includes: Obtaining read and write counts corresponding to the processing class hierarchy structure in the storage node; The obtaining of the read and write counts corresponding to the processing class hierarchy structure in the storage node includes at least one of the following: Obtaining read and write counts corresponding to a CA hierarchical structure in the storage node, wherein the processing class hierarchical structure includes the CA hierarchical structure, and the CA hierarchical structure is responsible for providing a data caching mechanism for the storage node; Obtaining read and write counts corresponding to a RAID hierarchical structure in the storage node, wherein the processing class hierarchical structure includes the RAID hierarchical structure, and the RAID hierarchical structure is responsible for combining multiple independent hard disks.

4. The method according to claim 3, characterized in that The obtaining of the read and write counts corresponding to the RAID hierarchy structure in the storage node includes at least one of the following: Obtaining read and write counts corresponding to a striped RAID hierarchy structure in the storage node, wherein data in the striped RAID hierarchy structure is distributed in blocks on multiple disks; Obtaining read and write counts corresponding to a mirrored RAID hierarchical structure in the storage node, wherein data in the mirrored RAID hierarchical structure is stored on two or more disks at the same time; Obtaining read and write counts corresponding to a distributed parity check RAID hierarchy structure in the storage node, wherein the distributed parity check RAID hierarchy structure stores parity check information in a distributed manner on all disks; Obtain read and write counts corresponding to a dual distributed parity check RAID hierarchy structure in the storage node, wherein the dual distributed parity check RAID hierarchy structure uses two independent parity check information and is distributed and stored on all disks.

5. The method according to claim 3, characterized in that: The obtaining of the read and write counts corresponding to the RAID hierarchical structure in the storage node includes: Obtain read and write counts corresponding to a combined RAID hierarchy structure in the storage node, wherein the combined RAID hierarchy structure is a structure combining at least two different types of RAID hierarchy structures.

6. The method according to claim 5, characterized in that The obtaining of the read and write counts corresponding to the RAID hierarchical structure of the combined class in the storage node includes at least one of the following: Obtaining read and write counts corresponding to a RAID hierarchical structure combining striping and mirroring in the storage node, wherein data in the RAID hierarchical structure combining striping and mirroring is stored in a plurality of disks in a mirrored manner and then in a striped manner; Obtaining read and write counts corresponding to the RAID hierarchical structure combining the striping class with the distributed parity check class in the storage node, wherein the RAID hierarchical structure combining the striping class with the distributed parity check class stripes data and applies distributed parity check; Obtaining read and write counts corresponding to the RAID hierarchical structure combining the mirroring class with the distributed parity check class in the storage node, wherein the RAID hierarchical structure combining the mirroring class with the distributed parity check class processes data mirroring and applies distributed parity check; Obtain read and write counts corresponding to the RAID hierarchy structure combining the striping class with the dual distributed parity class in the storage node, wherein the RAID hierarchy structure combining the striping class with the dual distributed parity class stripes data and applies dual distributed parity.

7. The method according to claim 1, characterized in that Before obtaining the abnormality detection result corresponding to the storage node, the method further includes: According to a preset detection time window, a read / write detection request is triggered, wherein the read / write detection request is used to request an abnormality detection on the read / write data.

8. The method according to claim 7, characterized in that In a case where the detection time window includes a preset time interval and a preset time width for performing abnormality detection on the read and write data, after triggering the read and write detection request according to the preset detection time window, the method further includes: In response to the read / write detection request, a detection is performed on the read / write data, wherein the duration of the detection is the preset time width; triggering a new read-write detection request for the read-write data, wherein a triggering interval between the new read-write detection request and the read-write detection request is the preset time interval; In response to the new read / write detection request, a secondary detection is performed on the read / write data, wherein the duration of the secondary detection is the preset time width.

9. The method according to claim 1, characterized in that: The obtaining, when the first read-write count and / or the second read-write count meets a read-write abnormality condition, an abnormality detection result corresponding to the storage node includes: When the first read / write count satisfies the read / write abnormality condition, obtaining a first fluctuation abnormality result corresponding to the storage node, wherein the first fluctuation abnormality result is used to indicate that the read / write fluctuation of the first hierarchical structure is abnormal; When the second read / write count satisfies the read / write abnormality condition, a second fluctuation abnormality result corresponding to the storage node is obtained, wherein the second fluctuation abnormality result is used to indicate that the read / write fluctuation of the second hierarchical structure is abnormal.

10. The method according to claim 9, characterized in that Before obtaining the first fluctuation abnormality result corresponding to the storage node, the method further includes: determining that the first read-write count satisfies the read-write abnormality condition when the read-write performance value corresponding to the first read-write count is less than a preset read-write performance threshold, wherein the read-write performance value corresponding to the first read-write count is positively correlated with the read-write fluctuation degree of the first hierarchical structure; Before obtaining the second fluctuation abnormality result corresponding to the storage node, the method also includes: when the read-write performance value corresponding to the second read-write count is less than the read-write performance threshold, determining that the second read-write count satisfies the read-write abnormality condition, wherein the read-write performance value corresponding to the second read-write count is positively correlated with the read-write fluctuation degree of the second hierarchical structure.

11. The method according to claim 10, characterized in that Before determining that the first read / write count satisfies the read / write abnormality condition, the method further includes: determining, in the first read / write count, a read / write count whose continuous fluctuation duration is greater than or equal to a preset continuous fluctuation duration threshold as a read / write performance value corresponding to the first read / write count; Before determining that the first read-write count satisfies the read-write abnormality condition, the method further includes: determining, in the second read-write count, a read-write count whose continuous fluctuation duration is greater than or equal to the continuous fluctuation duration threshold as a read-write performance value corresponding to the second read-write count.

12. The method according to any one of claims 1 to 11, characterized in that In the process of obtaining the abnormality detection result corresponding to the storage node, the method further includes: Acquire call stack information, wherein the call stack information provides a function call stack status of each CPU core in the storage node at a specific moment; According to the call stack information, a location where the read / write data is abnormal in the storage node is located.

13. A device for detecting abnormality in reading and writing data, characterized in that: include: A first acquisition unit is used to acquire a first read-write count corresponding to a first hierarchical structure in a storage node, wherein the first read-write count is used to represent a statistical number of read-write data in the first hierarchical structure, the read-write data is data input and / or output in the storage node, and the first hierarchical structure includes an interface class hierarchical structure, and the interface class hierarchical structure is responsible for data interaction between the storage node and the outside world; A second acquisition unit is used to acquire a second read-write count corresponding to a second hierarchical structure in the storage node, wherein the second read-write count is used to represent a statistical number of the read-write data in the second hierarchical structure, and the second hierarchical structure includes a processing class hierarchical structure, and the processing class hierarchical structure is responsible for processing and management of data of the storage node; A third acquisition unit is used to acquire an abnormality detection result corresponding to the storage node when the first read-write count and / or the second read-write count meet the read-write abnormality condition, wherein the abnormality detection result is used to indicate the abnormality of the read-write data in the storage node; The third acquisition unit includes: A first acquisition module, configured to acquire a first abnormal result corresponding to the storage node when the first read-write count satisfies a first abnormal condition, wherein the first abnormal result is used to indicate that the read-write data in the storage node is in an abnormal state, the read-write abnormal condition includes the first abnormal condition, and the abnormal detection result includes the first abnormal result; A second acquisition module, configured to acquire a second abnormal result corresponding to the storage node when the second read / write count satisfies a second abnormal condition, wherein the second abnormal result is used to indicate detection information corresponding to the abnormal state, the read / write abnormal condition includes the second abnormal condition, and the abnormal detection result includes the second abnormal result; The second acquisition module includes: a positioning submodule, used for locating the read and write data in the abnormal state in the second hierarchical structure, and determining a target position where the abnormal event occurs in the second hierarchical structure; A collection submodule, used to collect information about the target location and obtain feedback information associated with the abnormal event; The device also includes: A fourth acquisition unit is used to acquire fiber task statistics information in the process of acquiring the abnormality detection result corresponding to the storage node, wherein the fiber task statistics information is used to reflect the time consumption of each task in the storage node within a preset time period; A first positioning unit is used to locate the position where the read and write data in the storage node has an abnormality according to the fibre task statistical information during the process of obtaining the abnormality detection result corresponding to the storage node; The device is also used for: Randomly grab the call stack as supplementary information to the fiber task statistics.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 12 when executed by a processor.

15. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method described in any one of claims 1 to 12 are implemented.

Images