Fault detection method and device, electronic equipment and medium

Abstract

The embodiment of the invention provides a fault detection method and device, electronic equipment and a medium, and relates to the technical field of computers, and the method comprises the steps: obtaining alarm information of a to-be-detected server, and determining a part corresponding to each piece of alarm information as a target part; for any target component, determining the number of the alarm information corresponding to the target component acquired in the preset time length as the number to be filtered every preset time length; under the condition that the to-be-filtered number is greater than a preset filtering value corresponding to the target component, determining a difference value between the to-be-filtered number and the preset filtering value as a current alarm number, and increasing the current alarm number for a parameter value of an accumulation parameter corresponding to the target component; and when the current parameter value of the accumulation parameter corresponding to the target component is greater than the alarm threshold value corresponding to the target component, generating and outputting fault information. And fault detection of server components is realized.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and in particular, relates to a fault detection method, device, electronic equipment and medium. Background Art

[0002] With the development of computer technology, servers are increasingly used in a variety of fields to provide faster computing or application services to other clients. At the same time, the requirements for server operation status are also greatly increased.

[0003] There are multiple components in the server, and failure of any component will affect the performance of the server. Therefore, how to detect failures of various components in the server in a timely manner has become an urgent problem to be solved. Summary of the invention

[0004] The present application provides a fault detection method, device, electronic device and medium to solve the technical problem of how to timely detect faults of various components in a server in the related art.

[0005] In order to solve the above technical problems, this application is implemented as follows:

[0006] In a first aspect, the present application provides a fault detection method, which is applied to a management end of a fault detection system, wherein the fault detection system further includes at least one server to be detected, and the method includes:

[0007] Acquire the alarm information of the server to be detected, and determine the component corresponding to each alarm information as the target component;

[0008] After each preset time period, for any of the target components, the number of alarm information corresponding to the target component obtained within the preset time period is determined as the number to be filtered;

[0009] In the case where the number to be filtered is greater than the preset filtering value corresponding to the target component, the difference between the number to be filtered and the preset filtering value is determined as the current alarm number, and the current alarm number is increased for the parameter value of the cumulative parameter corresponding to the target component;

[0010] When the current parameter value of the accumulated parameter corresponding to the target component is greater than the alarm threshold corresponding to the target component, fault information is generated and output.

[0011] In a second aspect, the present application provides a fault detection device, which is applied to a management end of a fault detection system, wherein the fault detection system further includes at least one server to be detected, and the device may include:

[0012] An information acquisition module, used to acquire the alarm information of the server to be detected, and determine the component corresponding to each alarm information as the target component;

[0013] A quantity determination module, for determining, for any target component, the quantity of alarm information corresponding to the target component acquired within the preset time period as the quantity to be filtered, every time a preset time period passes;

[0014] An accumulation module, configured to determine the difference between the number to be filtered and the preset filtering value as the current alarm number when the number to be filtered is greater than the preset filtering value corresponding to the target component, and increase the current alarm number for the parameter value of the accumulation parameter corresponding to the target component;

[0015] The information generation module is used to generate and output fault information when the current parameter value of the accumulated parameter corresponding to the target component is greater than the alarm threshold corresponding to the target component.

[0016] In a third aspect, the present application provides an electronic device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method of the first aspect when executing the program.

[0017] In a fourth aspect, the present application provides a readable storage medium, when the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method of the first aspect above.

[0018] In the embodiment of the present application, the management end included in the fault detection system is applied, and the fault detection system also includes at least one server to be detected, by obtaining the alarm information of the server to be detected, and determining the components corresponding to each of the alarm information as the target components; after each preset time period, for any of the target components, the number of alarm information corresponding to the target components obtained within the preset time period is determined as the number to be filtered; when the number to be filtered is greater than the preset filter value corresponding to the target component, the difference between the number to be filtered and the preset filter value is determined as the current alarm number, and the parameter value of the cumulative parameter corresponding to the target component is increased by the current alarm number; when the current parameter value of the cumulative parameter corresponding to the target component is greater than the alarm threshold corresponding to the target component, fault information is generated and output. In this way, by receiving the alarm information of the server to be detected, the embodiment of the present invention can timely detect whether the components of the server to be detected have faults. At the same time, the embodiment of the present invention can avoid the sudden increase of alarms caused by component instability due to other factors by counting the number of alarm information corresponding to the target component within a preset time period, and filtering the counted number to be filtered twice by setting a preset filter value and an alarm threshold, thereby improving the accuracy of fault detection to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the following is a brief introduction to the drawings required for use in the embodiments or the related technical descriptions. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 is a flowchart of a fault detection method provided by an embodiment of the present application;

[0021] Figure 2 is a flow chart of a fault detection method provided by an embodiment of the present application;

[0022] Figure 3 is a structural diagram of a fault detection device provided in an embodiment of the present application;

[0023] Figure 4 It is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0025] Figure 1 is a flowchart of a fault detection method provided in an embodiment of the present application. The method can be applied to a management end included in a fault detection system. The fault detection system can also include at least one server to be detected, such as Figure 1 As shown, the method may include:

[0026] Step 101: Acquire alarm information of the server to be detected, and determine the component corresponding to each alarm information as the target component.

[0027] Step 102: After each preset time period, for any target component, determine the number of alarm information corresponding to the target component obtained within the preset time period as the number to be filtered.

[0028] Step 103: When the number to be filtered is greater than the preset filtering value corresponding to the target component, the difference between the number to be filtered and the preset filtering value is determined as the current alarm number, and the parameter value of the cumulative parameter corresponding to the target component is increased by the current alarm number.

[0029] Step 104: When the current parameter value of the accumulated parameter corresponding to the target component is greater than the alarm threshold corresponding to the target component, generate and output fault information.

[0030] The fault detection system provided in the embodiment of the present invention can be applied to any application or platform that has a server fault detection demand, such as applications in the field of artificial intelligence or big data. Among them, the server in the embodiment of the present invention refers to a computer that runs faster and has a higher load, which has high-speed computing power, long-term reliable operation, strong external data throughput capacity and better scalability. Specifically, the server in the embodiment of the present invention can use the chip of the Feiteng platform, and of course, it can also use the chip of other computer platforms (for example, the Haiguang platform or the Intel platform). The embodiment of the present invention does not limit the chip platform of the server to be detected.

[0031] The management end in the embodiment of the present invention may be a computer device with data processing capabilities. In one case, the management end may be a baseboard management controller (BMC). BMC may serve as the core of server management and may provide functions such as hardware monitoring, remote management, and fault diagnosis. Furthermore, BMC may be directly integrated into the server motherboard as an independent chip or integrated circuit and may be used to collect sensor data of various components of the server.

[0032] Specifically, in the embodiment of the present invention, the management end may be connected to the server to be detected in the fault detection system, and the two may communicate through a network or a preset communication protocol.

[0033] Among them, the above-mentioned alarm information refers to the register information captured by the server to be detected through the specified firmware and generated by itself. Specifically, the server chip can capture the data of relevant registers in real time through the processor basic firmware (Processor Basic Firmware, PBF) of the central processing unit (Central Processing Unit, CPU), and package the abnormal register data as alarm information and send it to the management end. Among them, the above-mentioned related registers may include CPU-related registers, memory-related registers, and high-speed serial computer expansion bus (peripheral component interconnectexpress, PCIE) device-related registers, etc. Furthermore, an embodiment of the present invention can obtain the alarm information of the server to be detected by receiving the packaged data sent by the server to be detected.

[0034] The above components refer to components that require fault detection, and may include CPU, memory, PCIE devices, etc. Further, the embodiment of the present invention can determine the component corresponding to each alarm message through the keyword field carried by the alarm message.

[0035] Optionally, the embodiment of the present invention may also pre-train an alarm information recognition model, and obtain the components corresponding to each alarm information through the trained alarm information recognition model. Specifically, the alarm information recognition model is trained through the following steps:

[0036] Acquire multiple alarm information and information tags; the information tags are used to characterize the components corresponding to each of the alarm information;

[0037] Inputting the plurality of alarm information into an initial recognition model to obtain a recognition result of each of the alarm information;

[0038] Based on the recognition result and the information tag, adjusting the model parameters of the initial recognition model;

[0039] When the training stop condition is met, the current initial recognition model is determined as the alarm information recognition model.

[0040] In this way, the efficiency of determining the target components can be improved through the alarm information recognition model, thereby improving the efficiency of fault detection.

[0041] Furthermore, during the operation of the server, some components may be unstable due to network factors or other objective factors, which may cause the server to generate more alarm information for the component in a short period of time, while the component itself may not have a fault that requires relevant personnel to repair. In this case, if the fault is directly output based on the alarm information, it is easy to generate false fault reports and unnecessary waste of resources. In order to avoid this situation, the embodiment of the present invention sets a preset time and counts the alarm information within the preset time.

[0042] Specifically, the above preset duration can be set by yourself, and the above preset duration can be set according to the performance of the server itself. Furthermore, the embodiment of the present invention can also set different preset durations for different components, for example, a longer preset duration can be set for components with relatively stable operating status and not easily affected by other factors. Exemplarily, the preset duration can be set to 1s for the CPU and memory, and of course other values ​​can be set, which is not limited by the embodiment of the present invention.

[0043] The preset filter value and alarm threshold may also be pre-set, and different preset filter values ​​and alarm thresholds may be set for different components, which is not limited in the embodiment of the present invention. Specifically, the preset filter value may be the maximum number of alarms of the target component acceptable within a preset time, and the alarm threshold may be the maximum number of acceptable burst alarms. For example, the preset filter value may be set to 60 for the memory, and the alarm threshold may be set to 6000.

[0044] Specifically, the embodiment of the present invention can determine the number of alarm information corresponding to the target component obtained within the preset time length every time a preset time length has passed, and when the determined number to be filtered is greater than the corresponding preset filter value, use the preset filter value to filter it, and accumulate the difference between the number to be filtered and the preset filter value, and accumulate it into the cumulative parameter corresponding to the target component.

[0045] Specifically, when the number to be filtered is greater than the preset filter value corresponding to the target component, the target component generates a large number of alarms within a preset time period. In order to avoid the increase of alarms due to network factors or other objective factors, the embodiment of the present invention sets a preset filter value to perform a first filter on the number of alarms, and only accumulates the difference between the number to be filtered and the preset filter value. Further, when the current parameter value of the cumulative parameter is greater than the corresponding alarm threshold, it indicates that the number of alarms after the first filtration is still large, and the target component itself may have a fault. At this time, fault information can be generated and output. Among them, the above fault information is used to characterize the existence of a fault in the target component, and the above output can be a display component output to the management end, so that relevant personnel can promptly check and repair the target component of the server to be detected.

[0046] Optionally, after generating and outputting the fault information, the embodiment of the present invention may further perform the following step: clearing the current parameter value of the accumulated parameter corresponding to the target component.

[0047] The embodiment of the present invention can facilitate the next round of statistics by clearing the current parameter value of the accumulated parameter corresponding to the target component after generating and outputting the fault information, thereby ensuring the real-time nature of the fault detection to a certain extent.

[0048] In summary, the fault detection method provided by the embodiment of the present application is applied to the management end included in the fault detection system, and the fault detection system also includes at least one server to be detected, by obtaining the alarm information of the server to be detected, and determining the components corresponding to each of the alarm information as the target components; after each preset time period, for any of the target components, the number of alarm information corresponding to the target components obtained within the preset time period is determined as the number to be filtered; when the number to be filtered is greater than the preset filter value corresponding to the target component, the difference between the number to be filtered and the preset filter value is determined as the current alarm number, and the parameter value of the cumulative parameter corresponding to the target component is increased by the current alarm number; when the current parameter value of the cumulative parameter corresponding to the target component is greater than the alarm threshold corresponding to the target component, fault information is generated and output. In this way, by receiving the alarm information of the server to be detected, the embodiment of the present invention can timely detect whether the components of the server to be detected have faults. At the same time, the embodiment of the present invention can avoid the sudden increase of alarms caused by component instability due to other factors by counting the number of alarm information corresponding to the target component within a preset time period, and filtering the counted number to be filtered twice by setting a preset filter value and an alarm threshold, thereby improving the accuracy of fault detection to a certain extent.

[0049] In one implementation, the operation of obtaining the alarm information of the server to be detected may include the following steps:

[0050] S21. Receive an initial alarm file sent by the server to be detected.

[0051] S22: Parse the initial alarm file into a recognizable file according to the parsing rules preset by the server to be detected and the management end.

[0052] S23: Obtaining alarm information of the server to be detected based on the identifiable file.

[0053] The above-mentioned initial alarm file refers to the abnormal register data packaged by the server to be detected. In one case, the above-mentioned initial alarm file can be recorded in the general platform error record format (General platform error records, CPER), and the management end can receive the initial alarm file sent by the server to be detected through the intelligent platform management interface (Intelligent Platform Management Interface, IPMI). Furthermore, the server to be detected can send the initial alarm file when there is abnormal register data, and accordingly, the management end can receive the initial alarm file sent by the server to be detected in real time.

[0054] The above analysis rules are pre-set by the management end and the server to be detected, and include the fields corresponding to the fields in the initial alarm file in the recognizable format of the management end. The above analysis rules can be set according to the platform type of the server to be detected, and the embodiment of the present invention does not limit this.

[0055] Furthermore, the initial alarm file can be parsed into a recognizable file according to a preset parsing rule, so that the management end can obtain the alarm information of the server to be detected from the recognizable file. In one case, the format of the recognizable file can be a lightweight data exchange format (JavaScript Object Notation, JSON). The JSON format is a format that is easy to read and write and can be used for data exchange between multiple languages. The embodiment of the present invention can convert the initial alarm file into a JSON file to facilitate the acquisition of alarm information.

[0056] In the embodiment of the present invention, the initial alarm file sent by the server to be detected is received; the initial alarm file is parsed into a recognizable file according to the parsing rules preset by the server to be detected and the management end; and the alarm information of the server to be detected is obtained based on the recognizable file. In this way, the management end can easily obtain the alarm information from the initial alarm file sent by the server to be detected by receiving the initial alarm file sent by the server to be detected and parsing it into a recognizable file, thereby ensuring the subsequent alarm data processing.

[0057] In one implementation, the above-mentioned component corresponding to each of the alarm information to be determined is used as the operation of the target component. The embodiment of the present invention may specifically include:

[0058] S31. Based on the identifiable file, obtain the component type field and the component location field included in each of the alarm messages.

[0059] S32: Determine the component type corresponding to each piece of the alarm information according to the field value of the component type field included in each piece of the alarm information.

[0060] S33. Determine the component location corresponding to each piece of the alarm information according to the field value of the component location field included in each piece of the alarm information.

[0061] S34. Based on the component type and component position corresponding to each of the alarm information, determine the component corresponding to each of the alarm information as the target component.

[0062] The component type field is used to represent the component type, and the component location field is used to represent the component location. Specifically, each field and the information corresponding to different field values ​​can be specified in a preset parsing rule.

[0063] For example, taking the identifiable file as a JSON file as an example, the "type" field can be used as the component type field, and the "physicalAddress" field can be used as the component location field. For example, when the "type" in the identifiable file is "Platform Memory", it indicates that the component type corresponding to the alarm information is memory, and accordingly, the location of the memory bar corresponding to the alarm information can be further determined according to the "physicalAddress" field.

[0064] Furthermore, the embodiment of the present invention can determine the target component that triggers the alarm information through the component type field and the component location field, so as to facilitate the separate statistics of the alarm information of different components. Accordingly, it is convenient to separately predict the faults of different components.

[0065] In one implementation, the embodiment of the present invention may further include:

[0066] S41: Obtain the alarm type of each alarm information.

[0067] S42: For each alarm message whose alarm type is a repairable type, perform the operation of determining a component corresponding to each alarm message as a target component.

[0068] Among them, the above-mentioned repairable type can also be called a correctable type (Correctable Error, CE), which represents an error that the server can repair by itself. Usually, PCIE devices are more likely to generate CE alarms. Correspondingly, it also includes alarms of unrepairable or uncorrectable types (Uncorrectable Memory Error, UCE). When a UCE alarm occurs, the corresponding component has often failed and cannot be repaired by itself. At this time, there is no need to filter and detect according to the number of alarm messages, and direct output is sufficient. In an embodiment of the present invention, the alarm type of each alarm message can be obtained in turn, and only for the alarm message whose alarm type is a repairable type, the operation of determining its corresponding component is performed.

[0069] In one implementation, the embodiment of the present invention may further include:

[0070] Each alarm information whose alarm type is an irreparable type is used as information to be output, and prompt information is generated and output based on the information to be output.

[0071] The above-mentioned irreparable type refers to UCE. Accordingly, when a UCE alarm is detected, the embodiment of the present invention can directly generate and output prompt information. Specifically, the above-mentioned prompt information is used to indicate that an irreparable fault exists in the server to be detected.

[0072] In this way, the alarm information of the irreparable type can be output in time, so that the relevant personnel can repair it as soon as possible, avoiding irreparable problems or losses on the server to be detected.

[0073] Specifically, in the above step S41, the alarm type of each alarm information can be determined by the alarm type field of each alarm information in the identifiable file. Exemplarily, taking the identifiable file as a JSON file as an example, the "code" field can be used as the alarm type field. When the "code" field is 0, the alarm type can be determined to be a repairable type. Correspondingly, when the "code" field is 1, the alarm type can be determined to be an unrepairable type. Specifically, the format of the above alarm type field can also be set according to a preset parsing rule, and the embodiment of the present invention does not limit this.

[0074] In the embodiment of the present invention, the alarm type of each alarm information is obtained; for each alarm information whose alarm type is a repairable type, the operation of determining the component corresponding to each alarm information as the target component is performed. In this way, subsequent filtering and accumulation operations are performed only on the repairable type alarm information, which can reduce the amount of data processing to a certain extent, thereby improving the fault detection efficiency.

[0075] In one implementation, the embodiment of the present invention may further include:

[0076] S51. In response to a parameter update command, obtain preset filter values ​​and alarm thresholds corresponding to various components included in the server to be detected based on the parameter update command, and store them in a preset memory.

[0077] Before the operation of determining, for any of the target components, the number of alarm information corresponding to the target component acquired within the preset time period as the number to be filtered, the embodiment of the present invention may further include:

[0078] S52: Obtaining preset filter values ​​and alarm thresholds corresponding to each of the target components from the preset memory.

[0079] Wherein, the above-mentioned parameter update command can be pre-set in the instruction set of the management end, and the above-mentioned parameter update command is used to dynamically adjust the parameters of each component. In one case, the above-mentioned parameter update command can be an IPMI command, and the form of the above-mentioned parameter update command can be ipmi oem cmd. Furthermore, the above-mentioned parameter update command can be manually input by relevant personnel. When the management end receives the parameter update command, it can obtain and store the preset filter value and alarm threshold corresponding to each component based on the operand carried by the command. Wherein, the above-mentioned preset memory can be an electrically erasable programmable memory (Electrically Erasable Programmable, EEPROM), and of course it can also be other types of memory, which is not limited by the embodiment of the present invention.

[0080] Furthermore, before obtaining the number of alarm information corresponding to the target component, the embodiment of the present invention may first obtain the preset filter value and the alarm threshold corresponding to each target component from the preset memory.

[0081] In the embodiment of the present invention, by responding to the parameter update command, the preset filter value and alarm threshold corresponding to each component included in the server to be detected are obtained based on the parameter update command and stored in a preset memory; the preset filter value and alarm threshold corresponding to each target component are obtained from the preset memory. In this way, through the parameter update command, the preset filter value and alarm threshold of each component can be dynamically adjusted to achieve the flexibility of fault detection.

[0082] In one implementation, the operation of obtaining the preset filter value and the alarm threshold corresponding to each of the target components from the preset memory may specifically include:

[0083] S61, receiving a detection switching command, and when the detection switching command indicates starting detection, obtaining a preset filter value and an alarm threshold corresponding to each of the target components from the preset memory.

[0084] The detection switching command can also be pre-set in the instruction set of the management end for switching the switch state of fault detection. Specifically, when the detection switching command indicates the start of detection, the preset filter value and the alarm threshold are obtained. Accordingly, when the detection switching command indicates the shutdown of detection, there is no need to perform the operation of step S52, and the identified target component and the alarm information can be directly output. Specifically, the detection switching command can also be manually input by relevant personnel.

[0085] In the embodiment of the present invention, by receiving a detection switching command and obtaining the preset filter value and alarm threshold corresponding to each target component from the preset memory when the detection switching command indicates starting detection, the dynamic switching of fault detection can be realized, thereby improving the flexibility of fault detection.

[0086] It should be noted that the server has high-speed CPU computing power, long-term reliable operation, strong external data throughput capacity and better scalability. According to the services provided by the server, generally speaking, the server has the ability to respond to service requests, provide services, and guarantee services. Among the main characteristics of the server, there is another important characteristic, that is, the "manageability" of the server. Although the server has sufficient guarantee in terms of stability, it should also have necessary measures to avoid errors, so as to find problems in time, and to be maintained in time when a fault occurs. This can not only reduce the chance of server errors, but also greatly improve the efficiency of server maintenance. Users not only have extremely high requirements for server business performance, but also gradually pay attention to the health status of the server. Therefore, BMC, as the server health monitoring butler, has received more and more attention.

[0087] BMC is an important module in server hardware. As the core of server management, it provides support for hardware monitoring, remote management and fault diagnosis. The BMC module is usually integrated directly into the server motherboard as a separate chip or integrated circuit. It is interconnected with other components of the server and transmits and communicates data through a dedicated bus (such as I2C, SMBUS, etc.). The BMC module monitors and collects sensor data from various parts of the server, including temperature, fan speed, voltage, power consumption, etc. It is also responsible for controlling and managing various hardware resources of the server, such as power supply, fan, indicator light, etc. Through these functions, the BMC module can realize remote monitoring, management and fault diagnosis of the server. Server health monitoring, the BMC module can monitor the temperature, voltage, fan status of the server in real time to ensure that the server operates within a safe range. If an abnormality occurs, the BMC module can send an alarm to notify the administrator to take necessary measures. Remote management and maintenance, the BMC module allows administrators to manage the server through remote connections, such as configuring BIOS settings, updating firmware, monitoring performance, etc. This can reduce dependence on physical servers and improve management efficiency. Fault diagnosis and troubleshooting, the BMC module can help administrators quickly identify and locate server faults and record relevant log information. This is critical for quickly restoring services and reducing downtime. Security management: The BMC module can provide security authentication and permission control to ensure that only authorized personnel can access and manage the server. It can also monitor and record user operations for security audits and compliance checks.

[0088] In order to ensure the reliability, availability and serviceability (RAS) of the server, on this basis, the embodiment of the present invention takes the management end as BMC as an example. Figure 2 is a flow chart of a fault detection method provided by an embodiment of the present application, such as Figure 2As shown, the package file sent by the server can be received, and the package file can be parsed into JSON format. After the parsing is completed (post complete), for each alarm message, the component type field (get JSON type) is obtained, and the component type corresponding to the alarm message is determined according to the field value. For example, if the field value is ARM, the component type is a CPU device, the field value is Platform Memory, the component type is a memory, and the field value is PCIE, the component type is a PCIE device. Further, the component location is obtained according to the component location field, and the component type is located. For example, the CPU is located according to the component location field "mpi drEl1", the memory is located according to the component location field "physicalAddres", and the PCIE device is located according to the component location field "SBDF".

[0089] Furthermore, in response to the ipmi oem command, when the command indicates to start detection, the preset filter value (Funnel) and the alarm threshold (Threshold) corresponding to the target component can be obtained. Furthermore, the timing can be started according to the timer (timer). Figure 2 Taking the preset duration of 1s as an example, within the preset duration, it is determined whether the number of alarm information of the target component is greater than Funnel, and if it is greater, the difference between the number of alarm information and Funnel is accumulated and accumulated into the accumulation parameter (Cnt). Furthermore, when Cnt is greater than the alarm threshold, the corresponding fault information is generated.

[0090] Optionally, the fault information can be added to the fault log (In-Depth Logging, IDL) of the BMC for output. Optionally, when the ipmi oem command indicates to close the detection, the server system event log (System Event Log, SEL) can also be output.

[0091] Optionally, in one case, if the sum of the current alarm quantities corresponding to each target component reaches a preset quantity threshold, it can be determined that a CE storm has occurred. At this time, there is no need to separately count the cumulative parameters of each target component, and fault information can be directly generated and the IDL log can be output.

[0092] like Figure 2 As shown, the embodiment of the present invention performs fault detection through Funnel and Threshold, and realizes fault prediction based on Dynamic Threshold Funnel (DTF). It can avoid the sudden increase of alarms caused by component instability due to other factors, and can improve the accuracy of fault detection to a certain extent.

[0093] Figure 3 20 is a structural diagram of a fault detection device provided in an embodiment of the present application. The device is applied to a management end of a fault detection system. The fault detection system also includes at least one server to be detected. The device 20 may include:

[0094] The information acquisition module 201 is used to acquire the alarm information of the server to be detected, and determine the component corresponding to each alarm information as the target component;

[0095] The quantity determination module 202 is used to determine, for any target component, the quantity of alarm information corresponding to the target component obtained within the preset time period as the quantity to be filtered after each preset time period.

[0096] An accumulation module 203 is used to determine the difference between the number to be filtered and the preset filtering value as the current alarm number when the number to be filtered is greater than the preset filtering value corresponding to the target component, and increase the current alarm number for the parameter value of the accumulation parameter corresponding to the target component;

[0097] The information generating module 204 is used to generate and output fault information when the current parameter value of the accumulated parameter corresponding to the target component is greater than the alarm threshold corresponding to the target component.

[0098] Optionally, the information acquisition module 201 includes:

[0099] A receiving submodule, used for receiving the initial alarm file sent by the server to be detected;

[0100] A parsing submodule, used to parse the initial alarm file into a recognizable file according to the parsing rules preset by the server to be detected and the management end;

[0101] The acquisition submodule is used to acquire the alarm information of the server to be detected based on the identifiable file.

[0102] Optionally, the information acquisition module 201 further includes:

[0103] A field acquisition submodule, used to acquire the component type field and the component location field contained in each of the alarm information through the identifiable file;

[0104] A type determination submodule, used to determine the component type corresponding to each of the alarm messages according to the field value of the component type field contained in each of the alarm messages;

[0105] A position determination submodule, used to determine the component position corresponding to each of the alarm messages according to the field value of the component position field contained in each of the alarm messages;

[0106] The component determination submodule is used to determine the component corresponding to each of the alarm information as the target component based on the component type and component position corresponding to each of the alarm information.

[0107] Optionally, the device further comprises:

[0108] An alarm type acquisition module is used to obtain the alarm type of each alarm information;

[0109] The execution module is used to execute the operation of determining the component corresponding to each alarm information as the target component for each alarm information whose alarm type is a repairable type.

[0110] Optionally, the device further comprises:

[0111] The generating module is used to take each alarm information of the alarm type being the irreparable type as the information to be output, generate prompt information based on the information to be output, and output it.

[0112] Optionally, the device further comprises:

[0113] A storage module, configured to respond to a parameter update command, obtain preset filter values ​​and alarm thresholds corresponding to the components included in the server to be detected based on the parameter update command, and store them in a preset memory;

[0114] The threshold acquisition module is used to acquire the preset filter value and the alarm threshold corresponding to each of the target components from the preset memory.

[0115] Optionally, the threshold acquisition module is specifically used to:

[0116] A detection switching command is received, and when the detection switching command indicates starting detection, a preset filter value and an alarm threshold corresponding to each of the target components are acquired from the preset memory.

[0117] In summary, the fault detection device provided by the embodiment of the present application is applied to the management end included in the fault detection system, and the fault detection system also includes at least one server to be detected, by obtaining the alarm information of the server to be detected, and determining the components corresponding to each of the alarm information as the target components; after each preset time period, for any of the target components, the number of alarm information corresponding to the target components obtained within the preset time period is determined as the number to be filtered; when the number to be filtered is greater than the preset filter value corresponding to the target component, the difference between the number to be filtered and the preset filter value is determined as the current alarm number, and the parameter value of the cumulative parameter corresponding to the target component is increased by the current alarm number; when the current parameter value of the cumulative parameter corresponding to the target component is greater than the alarm threshold corresponding to the target component, fault information is generated and output. In this way, by receiving the alarm information of the server to be detected, the embodiment of the present invention can timely detect whether the components of the server to be detected have faults. At the same time, the embodiment of the present invention can avoid the sudden increase of alarms caused by component instability due to other factors by counting the number of alarm information corresponding to the target component within a preset time period, and filtering the counted number to be filtered twice by setting a preset filter value and an alarm threshold, thereby improving the accuracy of fault detection to a certain extent.

[0118] The present application also provides an electronic device, see Figure 4 , including: a processor 3001, a memory 3002, and a computer program 30021 stored in the memory and executable on the processor, wherein the processor implements the method of the aforementioned embodiment when executing the program.

[0119] The present application also provides a readable storage medium. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the method of the aforementioned embodiment.

[0120] The present application also provides a computer program product, including a computer program / instruction, which implements the method of the aforementioned embodiment when executed by a processor.

[0121] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0122] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the application is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the application described herein, and the description of the specific language above is for the purpose of disclosing the best mode of implementation of the application.

[0123] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0124] Similarly, it should be understood that in order to streamline the present application and help understand one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present application, the various features of the present application are sometimes grouped together into a single embodiment, figure, or description thereof. However, the disclosed method should not be interpreted as reflecting the following intention: the claimed application requires more features than the features clearly stated in each claim. More specifically, as reflected in the claims below, the inventive aspects are less than all the features of the single embodiment disclosed above. Therefore, the claims following the specific embodiment are hereby expressly incorporated into the specific embodiment, wherein each claim itself serves as a separate embodiment of the present application.

[0125] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0126] The various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components in the sorting device according to the present application. The present application can also be implemented as a device or apparatus program for executing part or all of the methods described herein. Such a program implementing the present application can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0127] It should be noted that all actions of acquiring signals, information or data in this application are carried out in compliance with the relevant data protection laws and policies of the country where they are located and with the authorization given by the owner of the corresponding device.

[0128] It should be noted that the above embodiments illustrate the present application rather than limit the present application, and that those skilled in the art may design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets should not be constructed as a limitation to the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of multiple such elements. The present application may be implemented by means of hardware including several different elements and by means of a suitably programmed computer. In a unit claim that lists several devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names.

[0129] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0130] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application.

[0131] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A fault detection method, characterized in that: The method is applied to a management end of a fault detection system, wherein the fault detection system further includes at least one server to be detected, and the method includes: Acquire the alarm information of the server to be detected, and determine the component corresponding to each alarm information as the target component; After each preset time period, for any of the target components, the number of alarm information corresponding to the target component obtained within the preset time period is determined as the number to be filtered; In the case where the number to be filtered is greater than the preset filtering value corresponding to the target component, the difference between the number to be filtered and the preset filtering value is determined as the current alarm number, and the current alarm number is increased for the parameter value of the cumulative parameter corresponding to the target component; When the current parameter value of the accumulated parameter corresponding to the target component is greater than the alarm threshold corresponding to the target component, fault information is generated and output.

2. The method according to claim 1, characterized in that The obtaining of the alarm information of the server to be detected includes: Receiving an initial alarm file sent by the server to be detected; Parsing the initial alarm file into a recognizable file according to the parsing rules preset by the server to be detected and the management end; Acquire the alarm information of the server to be detected based on the identifiable file.

3. The method according to claim 2, characterized in that The step of determining the components corresponding to the respective alarm information as target components includes: Obtaining the component type field and the component location field contained in each of the alarm information through the identifiable file; Determining the component type corresponding to each of the alarm messages according to the field value of the component type field contained in each of the alarm messages; Determining the component position corresponding to each piece of the alarm information according to the field value of the component position field contained in each piece of the alarm information; Based on the component type and component position corresponding to each of the warning information, the component corresponding to each of the warning information is determined as the target component.

4. The method according to claim 1, characterized in that: The method further comprises: Obtaining the alarm type of each of the alarm information; For each alarm information whose alarm type is a repairable type, the operation of determining the component corresponding to each alarm information as the target component is performed.

5. The method according to claim 4, characterized in that After obtaining the alarm type of each alarm information, the method further includes: Each alarm information whose alarm type is an irreparable type is used as information to be output, and prompt information is generated and output based on the information to be output.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: In response to a parameter update command, obtaining preset filter values ​​and alarm thresholds corresponding to various components included in the server to be detected based on the parameter update command, and storing them in a preset memory; Before determining, for any of the target components, the number of alarm information corresponding to the target component acquired within the preset time period as the number to be filtered, the method further includes: The preset filter value and the alarm threshold corresponding to each of the target components are obtained from the preset memory.

7. The method according to claim 6, characterized in that The obtaining, from the preset memory, the preset filter value and the alarm threshold corresponding to each of the target components includes: A detection switching command is received, and when the detection switching command indicates starting detection, a preset filter value and an alarm threshold corresponding to each of the target components are acquired from the preset memory.

8. A fault detection device, characterized in that: The device is applied to the management end of a fault detection system, the fault detection system also includes at least one server to be detected, and the device includes: An information acquisition module, used to acquire the alarm information of the server to be detected, and determine the component corresponding to each alarm information as the target component; A quantity determination module, for determining, for any target component, the quantity of alarm information corresponding to the target component acquired within the preset time period as the quantity to be filtered, every time a preset time period passes; An accumulation module, configured to determine the difference between the number to be filtered and the preset filtering value as the current alarm number when the number to be filtered is greater than the preset filtering value corresponding to the target component, and increase the current alarm number for the parameter value of the accumulation parameter corresponding to the target component; The information generation module is used to generate and output fault information when the current parameter value of the accumulated parameter corresponding to the target component is greater than the alarm threshold corresponding to the target component.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

10. A readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any one of the methods described in claims 1-7.

Images