Application exception monitoring method and device, computer equipment and storage medium

Abstract

The invention relates to an application exception monitoring method and device, computer equipment and a storage medium, and the method comprises the steps: reading a plurality of indexes for exception monitoring, and obtaining log data of each index of any application in a set time period; performing normal distribution processing on log data of each index of any application in a set time period to obtain a target mathematical expectation and a target standard deviation of each index of any application; determining an index value interval of each index of any application according to the target mathematical expectation and the target standard deviation of each index of any application; obtaining the real-time value of each index of any current application, and determining the abnormal condition of each index of any application according to the real-time value of each index of any current application and the index value interval of each index; and determining the abnormal condition of any application according to the abnormal condition of each index of any application. According to the method, the abnormal condition of the application can be accurately judged in multiple dimensions without pre-burying point processing.

Description

Technical Field

[0001] The present application relates to the field of application processing technology, and in particular to an application anomaly monitoring method, apparatus, computer equipment and storage medium. Background Art

[0002] With the development of the Internet, traditional monolithic applications can no longer meet the needs of enterprises' growing business volume and user scale. In order to solve this problem, distributed microservice solutions have emerged, and applications are often deployed in clusters. However, as more and more systems are added, the scale of clusters is getting larger and larger, and the interaction between systems is becoming more and more complex. Each service is no longer a separate individual. Whether it is a bottom-level or upper-level service, the relationship between application systems is often a domino effect. In large-scale cluster systems, the abnormal monitoring of application systems is often not much different from that of monolithic applications. That is, based on log tracking, application abnormality monitoring is performed. At this time, it is necessary to estimate the abnormalities that may occur in the application in advance, and then the system will make judgments based on the reports. In this way, the abnormal situation depends entirely on the tracking log or system judgment, and the abnormalities that are not tracked and judged in advance cannot be discovered. Summary of the invention

[0003] Based on this, it is necessary to provide an application anomaly monitoring method, device, computer equipment and storage medium to address the above technical problems, which can accurately determine the abnormal situation of the application in multiple dimensions without the need for pre-processing.

[0004] A method for monitoring application anomalies includes: reading a plurality of indicators for anomaly monitoring, and obtaining log data of a set time period of each indicator of any application; performing normal distribution processing on the log data of the set time period of each indicator of any application to obtain a target mathematical expectation and a target standard deviation of each indicator of any application; determining an indicator value interval of each indicator of any application according to the target mathematical expectation and the target standard deviation of each indicator of any application; obtaining the real-time value of each indicator of any current application, determining an abnormal situation of each indicator of any application according to the real-time value of each indicator of any current application and the indicator value interval of each indicator; and determining an abnormal situation of any application according to the abnormal situation of each indicator of any application.

[0005] In one of the embodiments, the log data of a set time period for each indicator of any application is subjected to normal distribution processing to obtain the target mathematical expectation and target standard deviation of each indicator of any application, including: performing a first normal distribution processing on the log data of a set time period for each indicator of any application to obtain the initial mathematical expectation and initial standard deviation of each indicator of any application; performing noise reduction processing on the log data of a set time period for each indicator of any application based on the initial mathematical expectation and the initial standard deviation to obtain the noise-reduced log data; performing a second normal distribution processing on the noise-reduced log data to obtain the target mathematical expectation and target standard deviation of each indicator of any application.

[0006] In one of the embodiments, log data of a set time period for each indicator of any application is denoised based on an initial mathematical expectation and an initial standard deviation to obtain denoised log data, including: reading a preset first value, calculating the product of the first value and the initial standard deviation; determining a data range according to the initial mathematical expectation and the product of the first value and the initial standard deviation; and eliminating log data outside the data range in the log data of a set time period for each indicator of any application to obtain denoised log data after elimination.

[0007] In one embodiment, the indicator value range of each indicator of any application is determined according to the target mathematical expectation and the target standard deviation of each indicator of any application, including: reading a preset second value and a third value, the second value is greater than the third value; determining the first indicator value range according to the target mathematical expectation of each indicator of any application, and the product of the target standard deviation of each indicator of any application and the second value; determining the second indicator value range according to the target mathematical expectation of each indicator of any application, and the product of the target standard deviation of each indicator of any application and the third value; determining the abnormal situation of each indicator of any application according to the real-time value of each indicator of any application and the indicator value range of each indicator, including: when the real-time value of any indicator of any application currently falls outside the first indicator value range, determining the abnormal situation of any indicator as an urgent alarm abnormality; when the real-time value of any indicator of any application currently falls outside the second indicator value range and falls within the first indicator value range, determining the abnormal situation of any indicator as a relatively urgent alarm abnormality; when the real-time value of any indicator of any application currently falls within the second indicator value range, determining any indicator as non-abnormal.

[0008] In one of the embodiments, the abnormality of any application is determined based on the abnormality of each indicator of any application, including: if any indicator among the indicators of any application is abnormal, it is determined that any application is abnormal, and the abnormal value of any application is determined based on the number of abnormal indicators.

[0009] In one of the embodiments, an application anomaly monitoring method further includes: identifying one or more applications in an application module; and determining a normal ratio of the application module according to the number of abnormal indicators of each application in the one or more applications.

[0010] In one of the embodiments, an application anomaly monitoring method also includes: identifying multiple application modules of a target business process and the upstream and downstream relationships of each application module; determining a normal ratio of each application module and an abnormal value of an application in each application module; displaying each application module according to the upstream and downstream relationship, and displaying the normal ratio of each application module and the abnormal value of an application in each application module in a display area of ​​each application module.

[0011] An application anomaly monitoring device comprises: a log data reading module, used for reading a plurality of indicators for anomaly monitoring, and obtaining log data of a set time period of each indicator of any application; a normal distribution processing module, used for performing normal distribution processing on the log data of a set time period of each indicator of any application, and obtaining a target mathematical expectation and a target standard deviation of each indicator of any application; an indicator value interval determination module, used for determining an indicator value interval of each indicator of any application according to the target mathematical expectation and the target standard deviation of each indicator of any application; an indicator anomaly determination module, used for obtaining the real-time value of each indicator of any current application, and determining the abnormal situation of each indicator of any application according to the real-time value of each indicator of any current application and the indicator value interval of each indicator; and an application anomaly determination module, used for determining the abnormal situation of any application according to the abnormal situation of each indicator of any application.

[0012] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of any of the above-mentioned embodiments are implemented.

[0013] A computer-readable storage medium stores a computer program, which implements the steps of any of the above-mentioned method embodiments when the computer program is executed by a processor.

[0014] The above-mentioned application abnormality monitoring method, device, computer equipment and storage medium read multiple indicators for abnormality monitoring, and obtain the log data of the set time period of each indicator of any application; perform normal distribution processing on the log data of the set time period of each indicator of any application to obtain the target mathematical expectation and target standard deviation of each indicator of any application; determine the indicator value interval of each indicator of any application according to the target mathematical expectation and target standard deviation of each indicator of any application; obtain the real-time value of each indicator of any current application, and determine the abnormal situation of each indicator of any application according to the real-time value of each indicator of any current application and the indicator value interval of each indicator; determine the abnormal situation of any application according to the abnormal situation of each indicator of any application. Therefore, the abnormal situation of the application can be automatically judged from the log data of multiple indicators of abnormal monitoring, and the abnormal situation of the application can be accurately judged in multiple dimensions without pre-point processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 An application environment diagram of an application exception monitoring method in an embodiment;

[0016] Figure 2 A flowchart of an application exception monitoring method in one embodiment;

[0017] Figure 3 is a schematic diagram of a normal distribution of log data in one embodiment;

[0018] Figure 4 A display effect diagram of each application module of a business process in an embodiment;

[0019] Figure 5 A schematic diagram of an interface display of multiple applications of a quota adjustment / price adjustment module and abnormal conditions of indicators corresponding to each application in an embodiment;

[0020] Figure 6 A flowchart of an application exception monitoring method in a specific implementation mode;

[0021] Figure 7 is a structural block diagram of an application abnormality monitoring device in one embodiment;

[0022] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0024] The present application provides an application abnormality monitoring method, which is applied to Figure 1 In the application environment shown. Figure 1 As shown, the application monitoring system 100 is used to execute an application abnormality monitoring method of the present application. Specifically, the monitoring manager configures multiple indicators for abnormal monitoring through the terminal 202, and uploads the multiple indicators for abnormal monitoring to the application monitoring system 100 through a network connection. When the application monitoring system 100 performs abnormal monitoring on any application, it obtains the log data of the set time period of each indicator of any application from the database, performs normal distribution processing on the log data of the set time period of each indicator of any application, obtains the target mathematical expectation and target standard deviation of each indicator of any application, and determines the indicator value interval of each indicator of any application according to the target mathematical expectation and target standard deviation of each indicator of any application. At the same time, the real-time value of each indicator of any current application is obtained from the terminal 204 where any application is installed, and the abnormal situation of each indicator of any application is determined according to the real-time value of each indicator of any current application and the indicator value interval of each indicator, and the abnormal situation of any application is determined according to the abnormal situation of each indicator of any application. In addition, the abnormal situation of any application can also be fed back to the terminal 202, so that the monitoring manager can perform abnormal monitoring on any application.

[0025] In one embodiment, Figure 2 As shown, a method for monitoring application anomalies is provided. Figure 1 The application monitoring system 100 in FIG. 1 is used as an example to illustrate the invention, and includes the following steps:

[0026] S202, reading multiple indicators for abnormal monitoring, and obtaining log data of each indicator of any application in a set time period.

[0027] In this embodiment, multiple indicators for abnormal monitoring of applications are preset. The multiple indicators may include one or more of the average interface time consumption, error log volume, success response code ratio, HTTP request volume, and error log rate. A set time period is predetermined, and log data of each indicator in the set time period is obtained from the system. For example, the time period is set to a time range of one month from the current time. For example: according to a time unit of 10 minutes, all log data of the past month are counted for each indicator of any application.

[0028] S204, performing normal distribution processing on the log data of each indicator of any application in a set time period to obtain a target mathematical expectation and a target standard deviation of each indicator of any application.

[0029] In this embodiment, the obtained log data of each indicator set time period is processed for normal distribution to obtain the target mathematical expectation and target standard deviation of each indicator.

[0030] In one example, the above-mentioned normal distribution processing is performed on the log data of the set time period of each indicator of any application to obtain the target mathematical expectation and target standard deviation of each indicator of any application, including: performing the first normal distribution processing on the log data of the set time period of each indicator of any application to obtain the initial mathematical expectation and initial standard deviation of each indicator of any application; performing noise reduction processing on the log data of the set time period of each indicator of any application based on the initial mathematical expectation and the initial standard deviation to obtain the noise-reduced log data; performing the second normal distribution processing on the noise-reduced log data to obtain the target mathematical expectation and target standard deviation of each indicator of any application.

[0031] Among them, in one implementation method, the log data of each indicator setting time period of any application is denoised based on the initial mathematical expectation and the initial standard deviation to obtain the denoised log data, including: reading a preset first numerical value, calculating the product of the first numerical value and the initial standard deviation; determining the data range according to the initial mathematical expectation and the product of the first numerical value and the initial standard deviation; and eliminating the log data outside the data range in the log data of each indicator setting time period of any application, and obtaining the denoised log data after elimination.

[0032] Specifically, for each indicator of each application, the normal distribution of all log data in the past month is counted to obtain the mathematical expectation and standard deviation. Furthermore, the log data obtained by statistics is subjected to noise reduction processing, and the log data that is not within 4 times the standard deviation is noise data and needs to be eliminated. Among them, the reason for pre-setting the first numerical position to 4 is that the minimum requirement for 99.99% stability is 4 times the standard deviation. Then, for the denoised log data, the normal distribution is recalculated to obtain the target mathematical expectation and target standard deviation, and then the indicator value range is calculated based on the target mathematical expectation and target standard deviation.

[0033] S206: Determine the index value range of each index of any application according to the target mathematical expectation and target standard deviation of each index of any application.

[0034] In this embodiment, the index value interval can be determined based on the target mathematical expectation and the target standard deviation: the data interval within the range of N1 times the target standard deviation from the target mathematical expectation is used as the index value interval, where N1 is the set value. For example, the normal distribution diagram of the log data of any index setting time period of any application is as follows: Figure 3 As shown in , μ represents the target mathematical expectation, and σ represents the target standard deviation. Figure 3 As shown, the index value interval can be determined to be within a numerical range of 3σ from μ.

[0035] S208, obtaining the real-time value of each indicator of any current application, and determining the abnormal situation of each indicator of any current application according to the real-time value of each indicator of any current application and the indicator value range of each indicator.

[0036] In this embodiment, the indicator value interval of each indicator of any of the above-mentioned applications is determined by the log data within the historical set time range, and the real-time value of each indicator of any current application is obtained. The real-time value is compared with the indicator value interval, and the abnormal situation of each indicator of any application is determined based on the comparison result.

[0037] In one example, the above-mentioned determination of the indicator value range of each indicator of any application according to the target mathematical expectation and the target standard deviation of each indicator of any application includes: reading a preset second value and a third value, the second value being greater than the third value; determining the first indicator value range according to the target mathematical expectation of each indicator of any application, and the product of the target standard deviation of each indicator of any application and the second value; determining the second indicator value range according to the target mathematical expectation of each indicator of any application, and the product of the target standard deviation of each indicator of any application and the third value; the above-mentioned determination of the indicator value range according to the current any application The real-time value of each indicator and the indicator value range of each indicator are used to determine the abnormal situation of each indicator of any application, including: when the real-time value of any indicator among the indicators of any current application falls outside the first indicator value range, the abnormal situation of any indicator is determined to be an urgent alarm abnormality; when the real-time value of any indicator among the indicators of any current application falls outside the second indicator value range and falls within the first indicator value range, the abnormal situation of any indicator is determined to be a relatively urgent alarm abnormality; when the real-time value of any indicator among the indicators of any current application falls within the second indicator value range, any indicator is determined to be non-abnormal.

[0038] In this example, the second value is 4 and the third value is 3. Specifically, the real-time value of each indicator is obtained in real time, and the real-time value is compared with the corresponding indicator value interval. The abnormal situation of the indicator outside 4 times the standard deviation is set as an emergency alarm, the abnormal situation of the indicator within 3 to 4 times the standard deviation is set as a relatively urgent alarm, and the abnormal situation of the indicator within 3 times the standard deviation is set as a normal situation. Among them, as mentioned above, the reason for locating 4 times the standard deviation is: the minimum requirement for 99.99% stability is 4 times the standard deviation.

[0039] S210, determining the abnormal situation of any application according to the abnormal situation of each indicator of any application.

[0040] In this embodiment, it is determined whether any application is abnormal based on multiple indicators, thereby determining the abnormal situation of any application based on the abnormal situation of each indicator of any application. It can be that the number of indicators with abnormalities is determined based on the abnormal situation of each indicator, and then the number of abnormalities of any application is determined based on the number of indicators with abnormalities. For example, if the number of indicators with abnormalities is zero, the abnormal situation of any application is non-abnormal. If the number of indicators with abnormalities is N2, the abnormal situation of any application is N2 abnormal indicators, and N2 is a positive integer.

[0041] In an example, determining the abnormality of any application based on the abnormality of each indicator of any application includes: if any indicator among the indicators of any application is abnormal, determining that any application is abnormal, and determining the abnormal value of any application according to the number of abnormal indicators.

[0042] Specifically, if any indicator of the application is abnormal, it is determined that the application is abnormal. In addition, the number of abnormal indicators can be counted, and the number of abnormal indicators is used as the abnormal value of the application. For example, if the number of abnormal indicators is 3, the abnormal value of the application is 3. Therefore, not only can the application abnormality be determined, but also the number of abnormal indicators of the application can be directly determined, which is convenient for maintenance personnel to further repair the application.

[0043] The above-mentioned application abnormality monitoring method reads multiple indicators for abnormality monitoring, and obtains the log data of the set time period of each indicator of any application; performs normal distribution processing on the log data of the set time period of each indicator of any application to obtain the target mathematical expectation and target standard deviation of each indicator of any application; determines the indicator value interval of each indicator of any application according to the target mathematical expectation and target standard deviation of each indicator of any application; obtains the real-time value of each indicator of any current application, and determines the abnormal situation of each indicator of any application according to the real-time value of each indicator of any current application and the indicator value interval of each indicator; determines the abnormal situation of any application according to the abnormal situation of each indicator of any application. Therefore, the abnormal situation of the application can be automatically judged from the log data of multiple indicators of abnormal monitoring, and the abnormal situation of the application can be accurately judged in multiple dimensions without pre-point processing.

[0044] In one embodiment, after the above step of determining the abnormal situation of any application based on the abnormal situation of each indicator of any application, it also includes: identifying one or more applications in the application module; determining the normal ratio of the application module based on the number of abnormal indicators of each application in the one or more applications.

[0045] In this embodiment, the application module includes one or more applications, and the application module provides complete services to the outside. For example, in the loan business process, the application module provides registration services, the application module provides application services, etc. The application module includes one or more applications. As mentioned above, any application determines the abnormality of the application through the abnormality of multiple indicators. Therefore, the normal ratio of the application module is determined by counting the proportion of the number of abnormal indicators of all applications in the application module to the total number of indicators of all applications.

[0046] In one example, after determining the normal ratio of application modules according to the number of abnormal indicators of each application in one or more applications, the method further includes: identifying multiple application modules of the target business process and the upstream and downstream relationships of each application module; determining the normal ratio of each application module and the abnormal value of the application in each application module; displaying each application module according to the upstream and downstream relationship, and displaying the normal ratio of each application module and the abnormal value of the application in each application module in the display area of ​​each application module.

[0047] In this example, any business process includes multiple application modules, and there is an upstream and downstream relationship between each application module. Each application module is displayed based on the upstream and downstream relationship of each application module, and the normal ratio of each application module and the abnormal value of the application in each application module are displayed in the display area of ​​each application module.

[0048] For example, Figure 4 As shown in the figure, when the target business process is a credit process, the multiple application modules include a fake registration module, a registration / login module, an application module, a loan reservation module, etc. When the target business process is a risk process, the multiple application modules include an account security protection module, an application fraud identification module, a credit review module, etc. Figure 4 As shown, each application module is displayed according to the upstream and downstream relationship of each application module, and the normal ratio of each application module and the abnormal value of the application in each application module are displayed. For example, the application module is a registration / login module, its normal ratio is 96.88%, and its abnormal value of the application is 1.

[0049] When a user clicks to trigger any application module, multiple applications of any application module and multiple indicators of each application and abnormal conditions of each indicator are displayed. For example, when the application module is a quota adjustment / price adjustment module, the multiple applications it contains and the abnormal conditions of the indicators corresponding to each application are displayed as follows: Figure 5 See Figure 5 As shown, the calculation method of the normal ratio of the application module being the quota adjustment / price adjustment module is: the number of abnormal indicators is 1, the total number of indicators is 15, the normal ratio = (15-1) / 15 = 93.3333%, and the abnormal value of the application is 1.

[0050] Traditional technology is based on prior judgment of possible exceptions to perform code judgment and log tracking, and then directly report the exceptions according to the plug-in, relying on various monitoring systems. If there is a problem with the judgment or the report is inaccurate, factors such as monitoring system abnormalities may cause monitoring failure. An application exception monitoring method in each of the above embodiments is based on massive logs, and judges the quality of the application according to the changes in the logs of various indicators. It does not need to track points in advance, and can more accurately judge whether the application is abnormal in multiple dimensions. In addition, all applications are a whole, such as application modules and business processes. The abnormality of a single application will inevitably cause fluctuations in the quality of the entire link application. According to the business module flow chain, the scope of the entire abnormal impact can be intuitively seen.

[0051] Based on the above embodiments, a specific implementation method is provided below. Figure 6 As shown:

[0052] 1. Statistical indicator types include five dimensions: average interface time consumption, error log volume, success response code ratio, HTTP request volume, error log rate, etc.

[0053] 2. For each indicator of each application, calculate the normal distribution of all log data in the past month in 10-minute time units to obtain the mathematical expectation and standard deviation.

[0054] 3. Perform noise reduction on the obtained normal distribution data. Data that is not within 4 times the standard deviation is noise data and needs to be excluded. The reason for locating 4 times the standard deviation is: the minimum requirement for 99.99% stability is 4 times the standard deviation.

[0055] 4. Recalculate the normal distribution of the denoised data to obtain the mathematical expectation and standard deviation, and calculate the index value range.

[0056] 5. Obtain the real-time value of each type of indicator in real time and compare it with the corresponding indicator value range. The value outside 4 times the standard deviation is an emergency alarm, the value between 3 and 4 times the standard deviation is a relatively urgent alarm, and the value within 3 times the standard deviation is normal data. The reason for locating 4 times the standard deviation is: the minimum requirement for 99.99% stability is 4 times the standard deviation.

[0057] 6. According to the indicator type, the alarm status of the application is calculated, and the alarm status of the application module is obtained based on the alarm status of the application.

[0058] Therefore, it is possible to comprehensively analyze the quality of applications in multiple dimensions and control the quality of applications. Traditional early warning can only issue warnings based on anomalies set in advance, and cannot issue warnings for fluctuations in application quality. This application method can issue warnings for changes in application quality. In addition, application warnings often affect the entire system. Traditional solutions can only issue warnings for a single node and a single anomaly, while this application method can easily view the impact of anomalies on the entire link.

[0059] It should be understood that, although the steps in the flowchart are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0060] The present application also provides an application abnormality monitoring device, such as Figure 7 As shown, an application abnormality monitoring device includes a log data reading module 702, a normal distribution processing module 704, an indicator value interval determination module 706, an indicator abnormality determination module 708, and an application abnormality determination module 710. The log data reading module 702 is used to read multiple indicators for abnormality monitoring and obtain log data of a set time period of each indicator of any application; the normal distribution processing module 704 is used to perform normal distribution processing on the log data of a set time period of each indicator of any application to obtain the target mathematical expectation and target standard deviation of each indicator of any application; the indicator value interval determination module 706 is used to determine the indicator value interval of each indicator of any application according to the target mathematical expectation and target standard deviation of each indicator of any application; the indicator abnormality determination module 708 is used to obtain the real-time value of each indicator of any current application, and determine the abnormal situation of each indicator of any application according to the real-time value of each indicator of any current application and the indicator value interval of each indicator; the application abnormality determination module 710 is used to determine the abnormal situation of any application according to the abnormal situation of each indicator of any application.

[0061] In one of the embodiments, the log data of a set time period for each indicator of any application is subjected to normal distribution processing to obtain the target mathematical expectation and target standard deviation of each indicator of any application, including: performing a first normal distribution processing on the log data of a set time period for each indicator of any application to obtain the initial mathematical expectation and initial standard deviation of each indicator of any application; performing noise reduction processing on the log data of a set time period for each indicator of any application based on the initial mathematical expectation and the initial standard deviation to obtain the noise-reduced log data; performing a second normal distribution processing on the noise-reduced log data to obtain the target mathematical expectation and target standard deviation of each indicator of any application.

[0062] In one of the embodiments, log data of a set time period for each indicator of any application is denoised based on an initial mathematical expectation and an initial standard deviation to obtain denoised log data, including: reading a preset first value, calculating the product of the first value and the initial standard deviation; determining a data range according to the initial mathematical expectation and the product of the first value and the initial standard deviation; and eliminating log data outside the data range in the log data of a set time period for each indicator of any application to obtain denoised log data after elimination.

[0063] In one embodiment, the indicator value range of each indicator of any application is determined according to the target mathematical expectation and the target standard deviation of each indicator of any application, including: reading a preset second value and a third value, the second value is greater than the third value; determining the first indicator value range according to the target mathematical expectation of each indicator of any application, and the product of the target standard deviation of each indicator of any application and the second value; determining the second indicator value range according to the target mathematical expectation of each indicator of any application, and the product of the target standard deviation of each indicator of any application and the third value; determining the abnormal situation of each indicator of any application according to the real-time value of each indicator of any application and the indicator value range of each indicator, including: when the real-time value of any indicator of any application currently falls outside the first indicator value range, determining the abnormal situation of any indicator as an urgent alarm abnormality; when the real-time value of any indicator of any application currently falls outside the second indicator value range and falls within the first indicator value range, determining the abnormal situation of any indicator as a relatively urgent alarm abnormality; when the real-time value of any indicator of any application currently falls within the second indicator value range, determining any indicator as non-abnormal.

[0064] In one embodiment, the abnormal situation of any application is determined according to the abnormal situation of each indicator of any application, including: if any indicator among the indicators of any application is abnormal, it is determined that any application is abnormal, and the abnormal value of any application is determined according to the number of abnormal indicators.

[0065] In one of the embodiments, an application anomaly monitoring device further includes a normal ratio determination module for identifying one or more applications in an application module; and determining a normal ratio of the application module according to the number of abnormal indicators of each application in the one or more applications.

[0066] In one of the embodiments, an application anomaly monitoring device also includes a display module, which is used to identify multiple application modules of a target business process and the upstream and downstream relationships of each application module; determine the normal ratio of each application module and the abnormal value of the application in each application module; display each application module according to the upstream and downstream relationship, and display the normal ratio of each application module and the abnormal value of the application in each application module in the display area of ​​each application module.

[0067] For the specific definition of an application anomaly monitoring device, please refer to the definition of an application anomaly monitoring method above, which will not be repeated here. Each module in the above-mentioned application anomaly monitoring device can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0068] In one embodiment, a computer device is provided. The computer device may be a server supporting the operation of the application monitoring system 100. The internal structure diagram thereof may be as shown in FIG. Figure 8 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to receive multiple indicators configured by the terminal for abnormal monitoring, etc. When the computer program is executed by the processor, the above-mentioned application abnormality monitoring method is implemented.

[0069] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0070] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program: reading a plurality of indicators for abnormal monitoring, and obtaining log data of a set time period for each indicator of any application; performing normal distribution processing on the log data of a set time period for each indicator of any application to obtain a target mathematical expectation and a target standard deviation for each indicator of any application; determining an indicator value range for each indicator of any application based on the target mathematical expectation and the target standard deviation for each indicator of any application; obtaining the real-time value of each indicator of any current application, and determining the abnormal situation of each indicator of any application based on the real-time value of each indicator of any current application and the indicator value range of each indicator; determining the abnormal situation of any application based on the abnormal situation of each indicator of any application.

[0071] In one of the embodiments, when the processor executes a computer program to implement the above-mentioned step of performing normal distribution processing on the log data of a set time period for each indicator of any application to obtain the target mathematical expectation and target standard deviation of each indicator of any application, the following steps are specifically implemented: performing a first normal distribution processing on the log data of a set time period for each indicator of any application to obtain the initial mathematical expectation and initial standard deviation of each indicator of any application; performing noise reduction processing on the log data of a set time period for each indicator of any application based on the initial mathematical expectation and the initial standard deviation to obtain the noise-reduced log data; performing a second normal distribution processing on the noise-reduced log data to obtain the target mathematical expectation and target standard deviation of each indicator of any application.

[0072] In one of the embodiments, when a processor executes a computer program to implement the above-mentioned step of performing noise reduction processing on the log data of a set time period for each indicator of any application based on the initial mathematical expectation and the initial standard deviation to obtain the noise-reduced log data, the following steps are specifically implemented: reading a preset first numerical value, and calculating the product of the first numerical value and the initial standard deviation; determining the data range according to the initial mathematical expectation and the product of the first numerical value and the initial standard deviation; and eliminating the log data outside the data range in the log data of a set time period for each indicator of any application, and obtaining the noise-reduced log data after elimination.

[0073] In one embodiment, when the processor executes a computer program to implement the above-mentioned step of determining the indicator value range of each indicator of any application according to the target mathematical expectation and the target standard deviation of each indicator of any application, the following steps are specifically implemented: reading a preset second value and a third value, the second value is greater than the third value; determining a first indicator value range according to the target mathematical expectation of each indicator of any application, and the product of the target standard deviation of each indicator of any application and the second value; determining a second indicator value range according to the target mathematical expectation of each indicator of any application, and the product of the target standard deviation of each indicator of any application and the third value; the processor executes the computer program When implementing the above-mentioned step of determining the abnormal situation of each indicator of any application according to the real-time value of each indicator of any current application and the indicator value range of each indicator, the following steps are specifically implemented: when the real-time value of any indicator of any current application falls outside the first indicator value range, the abnormal situation of any indicator is determined to be an urgent alarm abnormality; when the real-time value of any indicator of any current application falls outside the second indicator value range and falls within the first indicator value range, the abnormal situation of any indicator is determined to be a relatively urgent alarm abnormality; when the real-time value of any indicator of any current application falls within the second indicator value range, any indicator is determined to be non-abnormal.

[0074] In one of the embodiments, when the processor executes a computer program to implement the above-mentioned step of determining the abnormal situation of any application based on the abnormal situation of each indicator of any application, the following steps are specifically implemented: if any indicator among the indicators of any application is abnormal, it is determined that any application is abnormal, and the abnormal value of any application is determined according to the number of abnormal indicators.

[0075] In one of the embodiments, when the processor executes the computer program, the following steps are implemented: identifying one or more applications in the application module; and determining a normal ratio of the application module according to the number of abnormal indicators of each application in the one or more applications.

[0076] In one of the embodiments, the processor implements the following steps when executing the computer program: identifying multiple application modules of the target business process and the upstream and downstream relationships of each application module; determining the normal ratio of each application module and the abnormal value of the application in each application module; displaying each application module according to the upstream and downstream relationship, and displaying the normal ratio of each application module and the abnormal value of the application in each application module in the display area of ​​each application module.

[0077] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: reading multiple indicators for abnormal monitoring, and obtaining log data of a set time period for each indicator of any application; performing normal distribution processing on the log data of a set time period for each indicator of any application to obtain a target mathematical expectation and a target standard deviation for each indicator of any application; determining an indicator value range for each indicator of any application based on the target mathematical expectation and the target standard deviation for each indicator of any application; obtaining the real-time value of each indicator of any current application, and determining the abnormal situation of each indicator of any application based on the real-time value of each indicator of any current application and the indicator value range of each indicator; determining the abnormal situation of any application based on the abnormal situation of each indicator of any application.

[0078] In one of the embodiments, when a computer program is executed by a processor to implement the above-mentioned steps of performing normal distribution processing on the log data of a set time period for each indicator of any application to obtain the target mathematical expectation and target standard deviation of each indicator of any application, the following steps are specifically implemented: performing a first normal distribution processing on the log data of a set time period for each indicator of any application to obtain the initial mathematical expectation and initial standard deviation of each indicator of any application; performing noise reduction processing on the log data of a set time period for each indicator of any application based on the initial mathematical expectation and the initial standard deviation to obtain the noise-reduced log data; performing a second normal distribution processing on the noise-reduced log data to obtain the target mathematical expectation and target standard deviation of each indicator of any application.

[0079] In one embodiment, when a computer program is executed by a processor to implement the above-mentioned step of performing noise reduction processing on the log data of a set time period of each indicator of any application based on the initial mathematical expectation and the initial standard deviation to obtain the noise-reduced log data, the following steps are specifically implemented: reading a preset first numerical value, and calculating the product of the first numerical value and the initial standard deviation; determining the data range according to the initial mathematical expectation and the product of the first numerical value and the initial standard deviation; and eliminating the log data outside the data range in the log data of the set time period of each indicator of any application, and obtaining the noise-reduced log data after elimination.

[0080] In one embodiment, when a computer program is executed by a processor to implement the above-mentioned steps of determining the index value range of each indicator of any application according to the target mathematical expectation and the target standard deviation of each indicator of any application, the following steps are specifically implemented: reading a preset second value and a third value, the second value being greater than the third value; determining a first index value range according to the target mathematical expectation of each indicator of any application, and the product of the target standard deviation of each indicator of any application and the second value; determining a second index value range according to the target mathematical expectation of each indicator of any application, and the product of the target standard deviation of each indicator of any application and the third value; the computer program is executed by a processor to implement the above-mentioned steps of determining the index value range of each indicator of any application according to the target mathematical expectation and the target standard deviation of each indicator of any application and the third value. When executing the above-mentioned steps of determining the abnormal situation of each indicator of any application based on the real-time value of each indicator of any current application and the indicator value range of each indicator, the following steps are specifically implemented: when the real-time value of any indicator of any current application falls outside the first indicator value range, the abnormal situation of any indicator is determined to be an emergency alarm abnormality; when the real-time value of any indicator of any current application falls outside the second indicator value range and falls within the first indicator value range, the abnormal situation of any indicator is determined to be a relatively urgent alarm abnormality; when the real-time value of any indicator of any current application falls within the second indicator value range, any indicator is determined to be non-abnormal.

[0081] In one of the embodiments, when the computer program is executed by the processor to implement the above-mentioned steps of determining the abnormal situation of any application based on the abnormal situation of each indicator of any application, the following steps are specifically implemented: if any indicator among the indicators of any application is abnormal, it is determined that any application is abnormal, and the abnormal value of any application is determined according to the number of abnormal indicators.

[0082] In one embodiment, when the computer program is executed by a processor, the following steps are implemented: identifying one or more applications in an application module; and determining a normal ratio of the application module according to the number of abnormal indicators of each application in the one or more applications.

[0083] In one embodiment, when the computer program is executed by a processor, the following steps are implemented: identifying multiple application modules of a target business process and the upstream and downstream relationships of each application module; determining the normal ratio of each application module and the abnormal value of the application in each application module; displaying each application module according to the upstream and downstream relationship, and displaying the normal ratio of each application module and the abnormal value of the application in each application module in the display area of ​​each application module.

[0084] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0085] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0086] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for monitoring application anomalies, characterized in that: The method comprises: Read multiple indicators for anomaly monitoring and obtain log data for each indicator of any application within a set time period; Performing normal distribution processing on the log data of each indicator of any application in a set time period to obtain a target mathematical expectation and a target standard deviation of each indicator of any application; Determining the index value range of each index of any one of the applications according to the target mathematical expectation and target standard deviation of each index of any one of the applications; Acquire the real-time value of each indicator of any current application, and determine the abnormal situation of each indicator of any current application according to the real-time value of each indicator of any current application and the indicator value range of each indicator; The abnormal situation of any application is determined according to the abnormal situation of each indicator of any application.

2. The method according to claim 1, characterized in that: The performing normal distribution processing on the log data of the set time period of each indicator of any application to obtain the target mathematical expectation and target standard deviation of each indicator of any application includes: Performing a first normal distribution processing on the log data of a set time period of each indicator of any application to obtain the initial mathematical expectation and initial standard deviation of each indicator of any application; Based on the initial mathematical expectation and the initial standard deviation, the log data of each indicator set time period of any application is subjected to noise reduction processing to obtain the noise-reduced log data; The denoised log data is subjected to a second normal distribution process to obtain the target mathematical expectation and target standard deviation of each indicator of any application.

3. The method according to claim 2, characterized in that The performing denoising processing on the log data of the set time period of each indicator of any application based on the initial mathematical expectation and the initial standard deviation to obtain the denoised log data includes: Reading a preset first value, and calculating the product of the first value and the initial standard deviation; Determine a data range according to the initial mathematical expectation and the product of the first value and the initial standard deviation; The log data outside the data range in the log data of each indicator set time period of any application is eliminated, and the denoised log data is obtained after the elimination.

4. The method according to any one of claims 1 to 3, characterized in that Determining the index value range of each index of any application according to the target mathematical expectation and target standard deviation of each index of any application includes: Reading a preset second value and a third value, wherein the second value is greater than the third value; Determine a first indicator value interval according to a target mathematical expectation of each indicator of any one of the applications and a product of a target standard deviation of each indicator of any one of the applications and the second value; Determine a second indicator value interval according to a target mathematical expectation of each indicator of any one of the applications and a product of a target standard deviation of each indicator of any one of the applications and the third value; Determining the abnormality of each indicator of any application according to the real-time value of each indicator of any current application and the indicator value range of each indicator includes: When the real-time value of any indicator among the indicators of any current application falls outside the first indicator value range, determining that the abnormality of any indicator is an emergency alarm abnormality; When the real-time value of any indicator among the indicators of any current application falls outside the second indicator value interval and falls within the first indicator value interval, it is determined that the abnormality of any indicator is a relatively urgent alarm abnormality; When the real-time value of any indicator among the indicators of any current application falls within the second indicator value range, it is determined that the any indicator is non-abnormal.

5. The method according to claim 1, characterized in that: Determining the abnormal situation of any application according to the abnormal situation of each indicator of any application includes: If any one of the indicators of any one of the applications is abnormal, it is determined that any one of the applications is abnormal, and an abnormal value of the application is determined according to the number of abnormal indicators.

6. The method according to claim 5, characterized in that The method further comprises: identifying one or more applications in the application module; The normal ratio of the application module is determined according to the number of abnormal indicators of each application in the one or more applications.

7. The method according to claim 6, characterized in that The method further comprises: Identify multiple application modules of the target business process and the upstream and downstream relationships of each application module; Determine the normal ratio of each application module and the abnormal value of applications in each application module; Each application module is displayed according to the upstream and downstream relationship, and the normal ratio of each application module and the abnormal value of the application in each application module are displayed in the display area of ​​each application module.

8. An application abnormality monitoring device, characterized in that: The device comprises: The log data reading module is used to read multiple indicators for abnormal monitoring and obtain the log data of each indicator of any application within a set time period; A normal distribution processing module, used to perform normal distribution processing on the log data of each indicator of any application in a set time period to obtain a target mathematical expectation and a target standard deviation of each indicator of any application; An indicator value interval determination module, used to determine the indicator value interval of each indicator of any application according to the target mathematical expectation and target standard deviation of each indicator of any application; An indicator abnormality determination module is used to obtain the real-time value of each indicator of any of the current applications, and determine the abnormality of each indicator of any of the current applications according to the real-time value of each indicator of any of the current applications and the indicator value interval of each indicator; The application anomaly determination module is used to determine the abnormal situation of any application according to the abnormal situation of each indicator of any application.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images