Management method and device for stable operation of system and server

Abstract

The invention discloses a management method and device for stable operation of a system and a server, and the method comprises the steps: carrying out the data cleaning and processing of a collected CPU utilization rate, a memory occupancy rate and a network flow value, obtaining structured original collection data, carrying out the data analysis and prediction, obtaining the abnormal operation state information, and carrying out the management of the abnormal operation state information. According to the operation state information of each time point in the original acquisition data, obtaining an operation state prediction value of a subsequent time period; and finally, according to the abnormal operation state information and the corresponding time point, identifying an abnormal behavior attribute, and according to the abnormal behavior attribute and the system operation state predicted value, selecting a corresponding coping strategy from the coping strategy library and executing the coping strategy. Therefore, the system can select and prepare coping strategies in advance according to the predicted operation state, so that the dynamically changing network problem can be dealt with more timely, and the conditions of lagging reaction and false report and missing report are avoided.

Description

Technical Field

[0001] The present invention relates to the technical field of computer system operation, and in particular to a management method, device and server for stable system operation. Background Art

[0002] The application scenarios of computer systems are becoming increasingly complex and diverse, and the changes in network environment and system load are becoming more frequent, making system stability increasingly important. However, existing monitoring methods mostly rely on static rules and manual intervention, which are slow to respond to abnormal behaviors and difficult to deal with dynamically changing network problems. They are prone to delayed responses and false alarms, which increase the risk of system operation. At the same time, excessive reliance on manual analysis and intervention also increases operation and maintenance costs and reduces the degree of automation of the system. Summary of the invention

[0003] In view of the deficiencies in the prior art, the present invention provides a management method for stable operation of a system, comprising the following steps: Acquire the operating status information of each time point from the device operating system according to the set time interval, wherein the operating status information includes the CPU usage rate, memory occupancy rate and network traffic value at the current collection time point; The collected CPU usage, memory occupancy, and network traffic values ​​are cleaned, and the operation status information at each time point after the cleaning process is converted to form a row-column data structure containing multiple data fields, wherein each type of operation status information is assigned to a corresponding data field and the data is bucketed and aggregated according to the time series to obtain structured original collected data, wherein the data fields include CPU usage, memory occupancy, timestamp, and network traffic value; Performing data analysis and prediction on the original collected data to obtain abnormal operation status information and corresponding collection time points, and obtaining operation status prediction values ​​for subsequent time periods based on the operation status information at each time point in the original collected data, wherein the operation status prediction values ​​include predicted CPU usage, memory occupancy, or network traffic values ​​at multiple subsequent time points after the current time point; Abnormal behavior attributes are identified according to abnormal operation status information and corresponding time points, and corresponding response strategies are selected and executed from a response strategy library according to the abnormal behavior attributes and system operation status prediction values.

[0004] Preferably, the management method for stable operation of the system also includes the following steps: collecting operation feedback information of the device operating system after executing the response strategy, comparing the operation feedback information with the operation status information before the response strategy is executed, judging the optimization status of each status indicator and calculating the current execution strategy effect value, and sorting the effectiveness of each response strategy in the response strategy library according to the execution strategy effect value.

[0005] Preferably, the method of obtaining the operating status information of each time point from the device operating system according to the set time interval also includes: obtaining the CPU usage rate, the total system physical memory size and the current free physical memory size at each time point from the device operating system according to the set time interval, and calculating the current memory occupancy rate according to the total system physical memory and the current free physical memory; calling the network interface monitoring tool to capture real-time network data packets, and calculating the current network traffic value based on the obtained network data packets.

[0006] Preferably, the data cleaning of the collected CPU usage, memory occupancy and network traffic values ​​is performed, and the operation status information at each time point after the cleaning process is converted to form a row and column data structure containing multiple data fields, wherein each type of operation status information is assigned to a corresponding data field and the data is bucketed and aggregated according to the time series to obtain structured original collected data, specifically including: According to the type of running status information collected, the corresponding preset reasonable value range of information is searched, and the running status information collected at each time point is compared with the preset reasonable value range of information of the corresponding type, and the information exceeding the reasonable value range is removed as an information error point; According to the preset filling rules and the running status information of the adjacent time points, one or more types of missing values ​​of the running status information at some time points are supplemented, and the collected running status information is deduplicated through the unique identity information or timestamp; The processed running status information at each time point is converted to form a row-column data structure containing multiple data fields, wherein each type of running status information is assigned to a corresponding data field, and the preset aggregation rules for each type of running status information are queried. The corresponding preset aggregation rules are used to bucket and aggregate each type of running status information according to the time series to obtain structured original collected data.

[0007] Preferably, the data analysis and prediction of the original collected data are performed to obtain abnormal operating status information and corresponding collection time points, and the operating status prediction value of the subsequent time period is obtained according to the operating status information of each time point in the original collected data, specifically including: using a standard score statistical method, according to a matching threshold of each type of operating status information, detecting abnormal data of each type of operating status information in the statistical distribution of the original collected data, and obtaining the corresponding abnormal operating status information and the corresponding collection time point; analyzing the operating status information of each time point in the original collected data, and using the historical values ​​of each type of operating status to calculate a linear regression model matching the respective type of operating status information through the least squares method; using the linear regression model to predict the operating status prediction value of the subsequent time period according to the historical values ​​of the corresponding type of operating status information, wherein each type of operating status information includes CPU usage, memory occupancy or network traffic value.

[0008] The present invention also discloses a management device for stable operation of the system, comprising: a data acquisition module, for acquiring operation status information at each time point from the device operating system according to a set time interval, wherein the operation status information includes the CPU usage rate, memory occupancy rate and network flow value at the current acquisition time point; a data processing module, for performing data cleaning on the acquired CPU usage rate, memory occupancy rate and network flow value, converting the operation status information at each time point after cleaning to form a row and column data structure containing multiple data fields, wherein each type of operation status information is allocated to a corresponding data field and the data is bucketed and aggregated according to the time series to obtain structured original acquisition data, wherein the data field The segments include CPU usage, memory occupancy, timestamp, and network traffic value; a data analysis module is used to perform data analysis and prediction on the original collected data, obtain abnormal operation status information and corresponding collection time points, and obtain the operation status prediction value of the subsequent time period according to the operation status information of each time point in the original collected data, and the operation status prediction value includes the predicted CPU usage, memory occupancy or network traffic value at multiple subsequent time points after the current time point; a response processing module is used to identify abnormal behavior attributes according to the abnormal operation status information and the corresponding time points, and select and execute the corresponding response strategy in the response strategy library according to the abnormal behavior attributes and the system operation status prediction value.

[0009] Preferably, the management device for stable operation of the system also includes a strategy evaluation module, which is used to collect operation feedback information of the device operating system after executing the response strategy, compare the operation feedback information with the operation status information before the response strategy is executed, determine the optimization status of each status indicator and calculate the current execution strategy effect value, and rank the effectiveness of each response strategy in the response strategy library according to the execution strategy effect value.

[0010] Preferably, the data acquisition module is also configured to obtain the CPU usage rate, the total system physical memory size and the current free physical memory size at each time point from the device operating system according to a set time interval, and calculate the current memory occupancy rate based on the total system physical memory and the current free physical memory; call the network interface monitoring tool to capture real-time network data packets, and calculate the current network traffic value based on the obtained network data packets.

[0011] Preferably, the data processing module is also configured to search for the corresponding preset information reasonable value range according to the type of collected operating status information, compare the collected operating status information at each time point with the preset information reasonable value range of the corresponding type, and remove the information that exceeds the reasonable value range as information error points; supplement the missing values ​​of one or more types of operating status information in some time points according to the preset filling rules and the operating status information of the previous and next adjacent time points, and deduplicate the collected operating status information through unique identity information or timestamps; convert the processed operating status information at each time point to form a row and column data structure containing multiple data fields, wherein each type of operating status information is assigned to a corresponding data field, query the preset aggregation rules for each type of operating status information, and use the corresponding preset aggregation rules to bucket and aggregate each type of operating status information according to the time series to obtain structured original collected data.

[0012] The present invention also discloses a server, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, steps of any of the aforementioned management methods for stable system operation are implemented.

[0013] The management method, device and server for stable operation of the system disclosed in the present invention clean the collected CPU usage, memory occupancy and network traffic values, convert the operation status information of each time point after the cleaning process to form a row and column data structure containing multiple data fields, and allocate each type of operation status information to the corresponding data field and obtain structured original collected data after bucketing and aggregation according to the time series; then analyze and predict the original collected data to obtain abnormal operation status information and the corresponding collection time point, and obtain the operation status prediction value of the subsequent time period according to the operation status information of each time point in the original collected data, wherein the operation status prediction value includes the predicted CPU usage, memory occupancy or network traffic value at multiple subsequent time points after the current time point; finally, identify abnormal behavior attributes according to the abnormal operation status information and the corresponding time point, select and execute the corresponding response strategy in the response strategy library according to the abnormal behavior attributes and the system operation status prediction value. This allows the system to select and execute response strategies in advance based on the predicted next operating status, so that it can respond to dynamically changing network problems more promptly, avoid delayed responses and false alarms, and reduce reliance on manual analysis and intervention.

[0014] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings described herein are used to provide further understanding of the present invention and constitute a part of this application. The illustrative embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0016] Figure 1 A schematic diagram of the steps of a management method for stable operation of a system disclosed in an embodiment of the present invention.

[0017] Figure 2 This is a schematic diagram of specific steps of step S2 disclosed in one embodiment of the present invention.

[0018] Figure 3 This is a schematic diagram of specific steps of step S3 disclosed in one embodiment of the present invention.

[0019] Figure 4 A schematic diagram of the structure of a management device for stable operation of a system disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiment of the present invention clearer, the technical solution of the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings of the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all of the embodiments. Based on the described embodiment of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] In the present invention, unless otherwise clearly specified and limited, the technical terms or scientific terms used herein shall have the common meanings understood by persons with ordinary skills in the field to which the present invention belongs. The words "first", "second" and similar words used in the patent application specification and claims of the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. Similarly, words such as "one" or "an" do not indicate a quantity limitation, but indicate the existence of at least one.

[0022] This embodiment discloses a management method for stable system operation, which can be used to ensure the security and stability of computer systems in complex and dynamic network and system environments, and can detect, identify and respond to potential security threats and performance anomalies in real time without relying on a large amount of manual intervention. Figure 1 As shown, the management method for stable operation of the system may include the following steps.

[0023] Step S1, obtaining the operation status information of each time point from the device operating system according to a set time interval, wherein the operation status information includes the CPU usage rate, memory occupancy rate and network flow value at the current collection time point.

[0024] In this embodiment, the CPU usage rate, the total system physical memory size and the current free physical memory size at each time point can be obtained from the device operating system according to the set time interval, and the current memory occupancy rate is calculated according to the total system physical memory and the current free physical memory; the network interface monitoring tool is called to capture real-time network data packets, and the current network traffic value is calculated according to the obtained network data packets. Batch collection can be used to reduce frequent interactions with the database or file system. Asynchronous tasks or multi-threading can also be used to collect multiple data sources at the same time. Use a buffer queue or message queue to cache real-time collected data to reduce processing pressure.

[0025] The CPU usage can be obtained by reading the relevant information of the operating system. The memory usage can be obtained through the Java OperatingSystemMXBean class, including the usage of physical memory and virtual memory. By obtaining the total physical memory size of the system and the current free physical memory size, the used memory is calculated by the difference and converted into a percentage display. The network traffic collection can be obtained by calling the network interface monitoring tool of the operating system.

[0026] In this embodiment, in order to reduce the amount of data transmitted and improve the transmission efficiency, the data needs to be compressed before transmission. The compression algorithm can be selected from the Gzip compression algorithm, etc. The compression algorithm can effectively reduce the occupancy of the transmission bandwidth while ensuring the data transmission speed.

[0027] At the same time, the compressed collected data is encrypted and transmitted, which can be transmitted asynchronously through the message queue. Symmetric encryption is used to ensure that the data will not be eavesdropped or tampered with during the transmission process. The encryption process includes the following steps.

[0028] Perform key expansion and generate a series of round keys based on the initial key.

[0029] Perform an initial round, perform an initial round operation on the plaintext, and XOR it with the first round key.

[0030] Perform multiple iterations, multiple rounds for each 128-bit block, the specific number of rounds depends on the key length, and each round includes four steps: Byte substitution, using a hybrid substitution network to replace each byte. Row shift, circularly shifting the bytes in the data block by row. Column confusion, confusing the columns and breaking up the relationship between the data. Round key addition, XOR operation with the round key.

[0031] Execute the final round, perform operations similar to multiple rounds of iterations but without column confusion, and finally generate encrypted data information.

[0032] Step S2, performing data cleaning on the collected CPU usage, memory occupancy, and network traffic values, converting the operation status information at each time point after the cleaning process to form a row and column data structure containing multiple data fields, wherein each type of operation status information is assigned to a corresponding data field and the data is bucketed and aggregated according to the time series to obtain structured original collected data, wherein the data fields include CPU usage, memory occupancy, timestamp, and network traffic value.

[0033] Specifically, Figure 2 As shown, step S2 may include the following contents.

[0034] Step S21, according to the type of the collected running status information, find the corresponding preset reasonable value range of information, compare the collected running status information at each time point with the preset reasonable value range of information of the corresponding type, and remove the information that exceeds the reasonable value range as an information error point. The reasonable value range of information with an upper limit and a lower limit can be preset for each running status information, i.e., CPU usage, memory occupancy, and network traffic value.

[0035] Step S22, according to the preset filling rules and the running status information of the adjacent time points, the missing values ​​of one or more types of running status information in some time points are supplemented, and the collected running status information is deduplicated through the unique identity information or timestamp. For missing data, the mean value can be used for filling. Different missing value supplement methods can also be set for different types of running status information, which can be the mean filling of a set number of time points before and after, or the maximum or minimum filling, etc.

[0036] Step S23, converting the processed running status information at each time point to form a row-column data structure containing multiple data fields, wherein each type of running status information is assigned to a corresponding data field, querying the preset aggregation rules for each type of running status information, and using the corresponding preset aggregation rules to bucket and aggregate each type of running status information according to the time series to obtain structured original collected data.

[0037] The structured data can ensure efficient subsequent query and processing. This embodiment adopts a table format with a row and column structure to allocate each data item to a corresponding field. Specifically, the following contents may be included.

[0038] Define the data model and determine the fields of each collected data, including CPU usage, memory usage, network traffic value, and timestamp. Bucket the data, that is, aggregate or group it at a set time interval to reduce the amount of data and retain key statistical information. For example, select 1 minute or 5 minute intervals to reduce the amount of data. It can retain the trend and overall structure of the data while reducing the amount of data storage and processing complexity.

[0039] Specifically, data from multiple time points are aggregated into a bucket, each bucket represents a fixed time range, such as 1 minute or 5 minutes. In each bucket, multiple data points are compressed into a value through preset statistical methods such as data average, data maximum, data minimum, or data sum, representing the data characteristics of the time period.

[0040] Assume that the original time series dataset is: ; where t n is the timestamp, x nIt is the data corresponding to the timestamp, such as CPU usage, memory usage, or network traffic value.

[0041] By defining a time window, i.e. a time interval, such as 1 minute or 5 minutes, the goal of data bucketing is to aggregate multiple data points into one value within each time window to represent the data characteristics of that time period.

[0042] Taking the pre-statistical method using the data average as an example, calculate the average value of all data points in each time bucket , indicating the overall trend of the time period: , where B k represents the data point in the kth time bucket, N k is the number of data points in the bucket. By bucketing data, only key information can be retained, while unnecessary calculation and storage space can be reduced.

[0043] Step S3, performing data analysis and prediction on the original collected data to obtain abnormal operating status information and corresponding collection time points, and obtaining operating status prediction values ​​for subsequent time periods based on the operating status information at each time point in the original collected data, wherein the operating status prediction values ​​include predicted CPU usage, memory occupancy or network traffic values ​​at multiple subsequent time points after the current time point.

[0044] like Figure 3 As shown, in this embodiment, step S3 may specifically include the following contents.

[0045] Step S31, using a standard score statistical method, according to the matching threshold of each type of operating status information, detect abnormal data in the statistical distribution of each type of operating status information in the original collected data, and obtain corresponding abnormal operating status information and corresponding collection time point.

[0046] In this embodiment, the Z-Score statistical method is used to detect abnormal points in the statistical distribution of various types of operating status information. The timestamps of the collected data are [1, 2, 3, 4, 5, 6, 7, 8, 9, 10], and the corresponding CPU usage is [10, 12, 11, 13, 14, 50, 15, 12, 11, 13] for example.

[0047] Step S311, calculating the mean and standard deviation of the CPU usage data at each collection time point.

[0048] Mean calculation: ; Standard deviation calculation: .

[0049] Step S312, calculate the Z-Score value Z of the running status information of this type at each collection time point i , , where X i is the CPU usage rate at the i-th collection time point; obtain the preset matching threshold of the running status information, judge the data corresponding to the collection time point exceeding the matching threshold as abnormal data, and obtain the corresponding abnormal running status information and the corresponding collection time point. For example, the Z-Score value Z6 of the sixth data point above is: .

[0050] The preset matching threshold of CPU usage is 2, which means that if the Z-Score value exceeds this threshold, the data point is considered abnormal. Here, Z6 is 2.89, which exceeds the threshold 2, indicating that the collection time point with a CPU usage of 50% is an abnormal point, which needs to be processed later.

[0051] Among them, if the abnormal operation status information and the abnormal collection time point that exceed the set range are screened out, the changes of the same type of abnormal operation status information at the adjacent collection time points and other types of operation status information values ​​at the abnormal collection time points are continued to be obtained.

[0052] Step S32, analyze the operating status information of each time point in the original collected data, and use the historical values ​​of each type of operating status to calculate the linear regression model that matches the respective type of operating status information through the least squares method; use the linear regression model to predict the operating status prediction value of the subsequent time period according to the historical values ​​of the corresponding type of operating status information, wherein each type of operating status information includes CPU usage, memory occupancy or network traffic value.

[0053] In this embodiment, a continuous target variable is predicted by using a linear regression model. The trend is determined by finding the linear relationship between the input variable and the output variable. In a linear regression model, the goal is to find the most suitable straight line to fit the given input data, so as to accurately predict the trend.

[0054] In this embodiment, the target variable y is set to have a linear relationship with the input feature x, that is, , we need to find the values ​​of β0 and β1 so that the model predicts Minimize the error between the predicted value and the actual value y. The loss function used is the least squares method, which minimizes the sum of the squared errors between the predicted value and the true value: ; Where n is the number of data points, y is the true value of the ith data point; the predicted value of the ith data point is: .

[0055] By minimizing the above loss function, we can directly solve the parameters of linear regression through the following formula: ; where β0 is the slope and β1 is the intercept.

[0056] The following is a specific example. For example, the CPU usage is collected once every 1 minute. The corresponding CPU usage collected from 1 to 7 minutes is [20, 22, 21, 23, 24, 26, 27]. Based on this data, a linear model is constructed to predict the trend of CPU usage in the next few minutes.

[0057] First, calculate the mean of the independent variable x, i.e. time, and the dependent variable y, i.e. CPU usage: ; The slope β1 is calculated according to the formula: ; Calculate the intercept β0: ; Construct the linear regression equation: ; This linear regression equation represents the linear relationship between time x and CPU usage y. This model can be used to predict the CPU usage trend in the future time period.

[0058] For example, to predict the CPU usage in the 8th minute above: , which means that the predicted CPU usage in the 8th minute is about 38.85%.

[0059] Step S4, identifying abnormal behavior attributes according to the abnormal operation status information and the corresponding time point, selecting and executing corresponding response strategies in the response strategy library according to the abnormal behavior attributes and the system operation status prediction value. The response strategies may include sending warning notifications, executing corresponding preset automation scripts, distributing server loads, setting traffic restrictions, and restarting servers.

[0060] Taking the CPU usage rate as an example, the system load can be effectively reduced and the system operation can be ensured to be stable by properly configuring the server load distribution strategy. Specifically, according to the CPU usage rate collected at each historical time point, the preset trend judgment model is adjusted, and the adjusted trend judgment model is used to predict the CPU predicted usage rate at subsequent time points. If the CPU predicted usage rate is greater than the first threshold, other task servers that can accept load distribution are queried.

[0061] Determine whether the time point when the CPU predicted usage rate is greater than the first threshold is within the set working period. If it is not within the set working period, no load distribution is performed and a current limiting setting is performed on the access request made at the subsequent corresponding time point. If it is within the set working period, query other task servers that can accept load distribution. If it is not within the set working period, no load distribution is performed, and a current limiting setting is performed on the access request made between the subsequent corresponding time points and a monitoring task is added, and the monitoring task is configured to obtain the access request permission that triggers the current limiting operation.

[0062] If the access request permission is higher than the set value, the current limiting operation is closed, and when the CPU usage of the current server being accessed exceeds the second threshold, the current CPU usage and load prediction table of the remaining task servers are queried, and the task server whose current CPU usage and the CPU prediction usage in the subsequent set time period are both lower than the first threshold is used as the target server. The load distribution ratio is determined based on the average value of the current CPU usage of each target server and the CPU prediction usage in the subsequent set time period, and the traffic is distributed to different target servers according to the load distribution ratio.

[0063] In this embodiment, the load prediction table of each task server can also be queried, and the load prediction table records the CPU prediction usage rate of each server in the subsequent set time period, and the load distribution ratio is determined according to the different CPU prediction usage rates of each task server at the corresponding time, and the load distribution task reservation is sent to the corresponding task server; the task server updates its load prediction table after receiving the load distribution task reservation. Among them, this step can specifically include the following content.

[0064] Step S101, query the load prediction table of each task server, the load prediction table records the CPU prediction usage of each server in a subsequent set time period, wherein the CPU prediction usage is composed of the task prediction usage of this server and the received load distribution task prediction usage.

[0065] Step S102, obtain the duration of the load to be distributed and the CPU predicted usage of each task server at each time point in the duration, and take the maximum value of the CPU predicted usage at each time point in the duration as the CPU predicted usage of the server in this time period.

[0066] Step S103, determine the load distribution ratio according to the CPU predicted usage rate of each task server in this time period, and generate a load distribution task reservation and send it to the corresponding task server; after receiving the load distribution task reservation, each task server generates a corresponding load distribution task predicted usage rate and adds it to the load prediction table.

[0067] After reaching the corresponding time point, a corresponding number of access requests are distributed to each task server according to the load distribution ratio.

[0068] In this embodiment, abnormal behavior attributes can also be predicted based on abnormal operating status information, other types of operating status information values ​​at the same collection time point, and changes in the same type of abnormal operating status information at adjacent collection time points. According to the abnormal behavior attributes and the overload range of the abnormal operating status information, the corresponding response strategy is selected and executed in the response strategy library.

[0069] For example, if the CPU usage at a collection time point exceeds the usage threshold, and the memory usage at the collection time point or an adjacent subsequent collection time point also exceeds the usage threshold, the change in the network traffic value at the collection time point and the subsequent collection time points is queried. If the corresponding network traffic value gradually decreases, it is judged as a memory overflow, and the memory sorting component is called to find objects or resources with lower usage frequency and release them.

[0070] If the CPU usage and memory occupancy still exceed the corresponding thresholds and the network traffic value still gradually decreases during the subsequent multiple collection time points, a load distribution request is sent to other task servers and the server is restarted.

[0071] If the CPU usage at a collection time point exceeds the usage threshold, and the memory usage at the collection time point or an adjacent subsequent collection time point gradually increases, then query the changes in network traffic values ​​at the collection time point and subsequent collection time points.

[0072] If the corresponding network traffic value changes within the corresponding reasonable value range, the attribute information of multiple task processes that occupy the top of the current CPU usage rate is obtained, and the priority of the corresponding task process is queried according to the attribute information, and the task process whose priority is lower than the set value is terminated. If the corresponding network traffic value increases by more than the first threshold, the external network access request at the corresponding collection time point is obtained, and the addresses of multiple access requests with the top upload network traffic values ​​and the required upload data type are obtained. If the address is not in the trust list, a flow limit setting is set for it.

[0073] If the CPU usage, memory occupancy and network traffic values ​​at the same collection time point all exceed the corresponding thresholds, it is determined whether the current collection time is in the set working period. If it is in the set working period, the attribute information of multiple task processes that occupy the top of the current CPU usage is queried, and the priority of the corresponding task process is queried according to the attribute information, and the task process whose priority is lower than the set value is terminated; if it is not in the set working period, a flow limit is set for subsequent access requests.

[0074] In this embodiment, the management method for stable operation of the system may also include the following contents.

[0075] Step S5, collect the operation feedback information of the device operating system after executing the response strategy, compare the operation feedback information with the operation status information before the response strategy is executed, determine the optimization status of each status indicator and calculate the current execution strategy effect value, and rank the effectiveness of each response strategy in the response strategy library according to the execution strategy effect value.

[0076] Among them, commonly used feedback indicators include CPU usage, that is, whether the CPU usage is reduced after executing load balancing or other preset automation scripts, memory usage, that is, whether the memory usage is alleviated after the automation script is executed, and network traffic, that is, whether the network traffic restriction measures have successfully reduced the traffic load. By monitoring the status of the system in real time, the result data after the current execution of the policy is obtained, and it is compared with the previous status to determine the change in the system status. Specifically, the change trend can be calculated by comparing the key indicator values ​​of the current system, such as load and response time, with the target value or historical baseline.

[0077] In this embodiment, the effect of the current execution strategy can also be calculated based on the positive and negative impact of the feedback, and then the future strategy selection can be adjusted. Positive feedback will increase the reward, while negative feedback will reduce the reward. By setting the reward function, a reward value is calculated, which is used to measure the pros and cons of the current strategy. The size of the reward can be determined based on the degree of improvement of key indicators, the achievement of goals, and actual system requirements.

[0078] For example, weighted rewards based on goals. If the system has multiple indicators X1, X2...Xn, the reward value R can be calculated by combining the difference and the weight: ; where X i,before and X i,after Respectively represent the values ​​of the i-th indicator before and after the strategy is executed; α i The weights are used to indicate the influence of different indicators on the system.

[0079] For example, suppose the system focuses on CPU usage and memory usage, with weights α and cpu = 0.6 and α memory =0.4. If the CPU usage drops from 85% to 70%, and the memory usage drops from 75% to 60%. The reward is calculated as: R=0.6×(85-70)+0.4×(75-60)=15; then the positive reward R=15 indicates that the strategy is effective. Finally, the effectiveness of each response strategy in the response strategy library is ranked according to the execution strategy effect value.

[0080] In another embodiment, if Figure 4 As shown, a management device for stable operation of the system is also disclosed, which specifically includes a data acquisition module 1, a data processing module 2, a data analysis module 3 and a response processing module 4; wherein the data acquisition module 1 is used to obtain the operation status information of each time point from the device operating system according to the set time interval, and the operation status information includes the CPU usage rate, memory occupancy rate and network traffic value at the current acquisition time point. The data processing module 2 is used to clean the collected CPU usage rate, memory occupancy rate and network traffic value, and convert the operation status information of each time point after cleaning to form a row and column data structure containing multiple data fields, wherein each type of operation status information is allocated to the corresponding data field and the data is bucketed and aggregated according to the time series to obtain structured original collected data, and the data field includes CPU usage rate, memory occupancy rate, timestamp, and network traffic value. The data analysis module 3 is used to perform data analysis and prediction on the original collected data, obtain abnormal operation status information and corresponding collection time points, and obtain the operation status prediction value of the subsequent time period according to the operation status information of each time point in the original collected data, and the operation status prediction value includes the predicted CPU usage rate, memory occupancy rate or network traffic value at multiple subsequent time points after the current time point. The response processing module 4 is used to identify abnormal behavior attributes according to the abnormal operation status information and the corresponding time points, and select and execute the corresponding response strategy in the response strategy library according to the abnormal behavior attributes and the system operation status prediction value.

[0081] In this embodiment, the management device for stable operation of the system also includes: a strategy evaluation module, which is used to collect operation feedback information of the device operating system after executing the response strategy, compare the operation feedback information with the operation status information before the response strategy is executed, determine the optimization status of each status indicator and calculate the current execution strategy effect value, and rank the effectiveness of each response strategy in the response strategy library according to the execution strategy effect value.

[0082] In this embodiment, the data acquisition module is also configured to obtain the CPU usage rate, the total system physical memory size and the current free physical memory size at each time point from the device operating system according to a set time interval, and calculate the current memory occupancy rate based on the total system physical memory and the current free physical memory; call the network interface monitoring tool to capture real-time network data packets, and calculate the current network traffic value based on the obtained network data packets.

[0083] In this embodiment, the data processing module is also configured to search for the corresponding preset information reasonable value range according to the type of collected operating status information, compare the collected operating status information at each time point with the preset information reasonable value range of the corresponding type, and remove the information that exceeds the reasonable value range as information error points; according to the preset filling rules and the operating status information of the adjacent time points, the missing values ​​of one or more types of operating status information in some time points are supplemented, and the collected operating status information is deduplicated through unique identity information or timestamps; the processed operating status information at each time point is converted to form a row and column data structure containing multiple data fields, wherein each type of operating status information is assigned to the corresponding data field, and the preset aggregation rules of each type of operating status information are queried, and each type of operating status information is bucketed and aggregated according to the time series using the corresponding preset aggregation rules to obtain structured original collected data.

[0084] The specific functions of the above-mentioned management device for stable operation of the system correspond to the management method for stable operation of the system disclosed in the previous embodiment, so it will not be described in detail here. For details, please refer to the various embodiments of the management method for stable operation of the system disclosed in the previous embodiment. It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other.

[0085] In other embodiments, a server is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the various steps of the management method for stable operation of the system as described in the above embodiments when executing the computer program. The management server for stable operation of the system may include, but is not limited to, a processor and a memory. It can be understood by those skilled in the art that the schematic diagram is merely an example of a management server for stable operation of the system, and does not constitute a limitation on the management server for stable operation of the system, and may include more or fewer components than shown in the figure, or a combination of certain components, or different components.

[0086] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

[0087] In conclusion, the above is only a preferred embodiment of the present invention, and all equivalent changes and modifications made according to the scope of the patent application of the present invention should fall within the scope of the patent of the present invention.

Claims

1. A management method for stable operation of a system, characterized in that: The steps include: Acquire the operating status information of each time point from the device operating system according to the set time interval, wherein the operating status information includes the CPU usage rate, memory occupancy rate and network traffic value at the current collection time point; The collected CPU usage, memory occupancy, and network traffic values ​​are cleaned, and the operation status information at each time point after the cleaning process is converted to form a row-column data structure containing multiple data fields, wherein each type of operation status information is assigned to a corresponding data field and the data is bucketed and aggregated according to the time series to obtain structured original collected data, wherein the data fields include CPU usage, memory occupancy, timestamp, and network traffic value; Performing data analysis and prediction on the original collected data to obtain abnormal operation status information and corresponding collection time points, and obtaining operation status prediction values ​​for subsequent time periods based on the operation status information at each time point in the original collected data, wherein the operation status prediction values ​​include predicted CPU usage, memory occupancy, or network traffic values ​​at multiple subsequent time points after the current time point; Abnormal behavior attributes are identified according to abnormal operation status information and corresponding time points, and corresponding response strategies are selected and executed from a response strategy library according to the abnormal behavior attributes and system operation status prediction values.

2. The management method for stable operation of a system according to claim 1, characterized in that: The following steps are also included: Collect the operation feedback information of the device operating system after executing the response strategy, compare the operation feedback information with the operation status information before the response strategy is executed, determine the optimization status of each status indicator and calculate the current execution strategy effect value, and rank the effectiveness of each response strategy in the response strategy library according to the execution strategy effect value.

3. The management method for stable operation of a system according to claim 2, characterized in that: The step of obtaining the operation status information at each time point from the device operating system according to the set time interval also includes: According to the set time interval, the CPU usage rate, the total system physical memory size and the current free physical memory size at each time point are obtained from the device operating system, and the current memory occupancy rate is calculated based on the total system physical memory and the current free physical memory; the network interface monitoring tool is called to capture real-time network data packets, and the current network traffic value is calculated based on the obtained network data packets.

4. The management method for stable operation of a system according to claim 3, characterized in that: The data of the collected CPU usage, memory occupancy and network traffic values ​​are cleaned, and the operation status information at each time point after the cleaning process is converted to form a row and column data structure containing multiple data fields, wherein each type of operation status information is assigned to a corresponding data field and the data is bucketed and aggregated according to the time series to obtain structured original collected data, specifically including: According to the type of running status information collected, the corresponding preset reasonable value range of information is searched, and the running status information collected at each time point is compared with the preset reasonable value range of information of the corresponding type, and the information exceeding the reasonable value range is removed as an information error point; According to the preset filling rules and the running status information of the adjacent time points, one or more types of missing values ​​of the running status information at some time points are supplemented, and the collected running status information is deduplicated through the unique identity information or timestamp; The processed running status information at each time point is converted to form a row-column data structure containing multiple data fields, wherein each type of running status information is assigned to a corresponding data field, and the preset aggregation rules for each type of running status information are queried. The corresponding preset aggregation rules are used to bucket and aggregate each type of running status information according to the time series to obtain structured original collected data.

5. The management method for stable operation of a system according to claim 4, characterized in that: The data analysis and prediction of the original collected data are performed to obtain abnormal operation status information and corresponding collection time points, and the operation status prediction value of the subsequent time period is obtained according to the operation status information of each time point in the original collected data, specifically including: Using a standard score statistical method, according to the matching threshold of each type of running status information, detect the abnormal data of each type of running status information in the original collected data in the statistical distribution, and obtain the corresponding abnormal running status information and the corresponding collection time point; Analyze the operating status information of each time point in the original collected data, and use the historical values ​​of each type of operating status to calculate the linear regression model that matches the respective type of operating status information through the least squares method; use the linear regression model to predict the operating status prediction value of the subsequent time period according to the historical values ​​of the corresponding type of operating status information, wherein each type of operating status information includes CPU usage, memory occupancy or network traffic value.

6. A management device for stable operation of a system, characterized in that: include: The data collection module is used to obtain the operation status information of each time point from the device operating system according to the set time interval, and the operation status information includes the CPU usage rate, memory occupancy rate and network traffic value at the current collection time point; The data processing module is used to clean the collected CPU usage, memory occupancy and network traffic values, convert the cleaned running status information at each time point to form a row-column data structure containing multiple data fields, wherein each type of running status information is assigned to a corresponding data field and the data is bucketed and aggregated according to the time series to obtain structured original collected data, wherein the data fields include CPU usage, memory occupancy, timestamp, and network traffic value; A data analysis module is used to perform data analysis and prediction on the original collected data, obtain abnormal operation status information and corresponding collection time points, and obtain operation status prediction values ​​for subsequent time periods based on the operation status information at each time point in the original collected data, wherein the operation status prediction values ​​include predicted CPU usage, memory occupancy or network traffic values ​​at multiple subsequent time points after the current time point; The response processing module is used to identify abnormal behavior attributes according to abnormal operation status information and corresponding time points, and select and execute corresponding response strategies in the response strategy library according to the abnormal behavior attributes and system operation status prediction values.

7. The management device for stable operation of a system according to claim 6, characterized in that: Also includes: The strategy evaluation module is used to collect the operation feedback information of the device operating system after executing the response strategy, compare the operation feedback information with the operation status information before the response strategy is executed, determine the optimization status of each status indicator and calculate the current execution strategy effect value, and rank the effectiveness of each response strategy in the response strategy library according to the execution strategy effect value.

8. The management device for stable operation of a system according to claim 7, characterized in that: The data acquisition module is further configured to obtain the CPU usage rate, the total system physical memory size and the current free physical memory size at each time point from the device operating system according to a set time interval, and calculate the current memory occupancy rate according to the total system physical memory and the current free physical memory; Call the network interface monitoring tool to capture real-time network data packets, and calculate the current network traffic value based on the obtained network data packets.

9. The management device for stable operation of a system according to claim 8, characterized in that: The data processing module is further configured to search for a corresponding preset reasonable information value range according to the type of collected running status information, compare the collected running status information at each time point with the preset reasonable information value range of the corresponding type, and remove the information that exceeds the reasonable value range as an information error point; supplement the missing values ​​of one or more types of running status information at some time points according to the preset filling rules and the running status information of the adjacent time points, and deduplicate the collected running status information through the unique identity information or timestamp; The processed running status information at each time point is converted to form a row-column data structure containing multiple data fields, wherein each type of running status information is assigned to a corresponding data field, and the preset aggregation rules for each type of running status information are queried. The corresponding preset aggregation rules are used to bucket and aggregate each type of running status information according to the time series to obtain structured original collected data.

10. A server comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

Images