A management method, device and server for system stable operation

Abstract

The application discloses a kind of management method, device and server for system stable operation, by the CPU usage, memory occupancy and network traffic value of acquisition are carried out data cleaning and processing after obtaining structured original collection data, then data analysis and prediction are carried out, obtain abnormal operating state information, according to the operating state information in each time point in original collection data obtains the operating state prediction value of subsequent time period;Finally, according to the abnormal behavior attribute of abnormal operating state information and corresponding time point, the corresponding coping strategy is selected and executed in response strategy library according to the abnormal behavior attribute and system operating state prediction value.Make system can according to predicted operating state to carry out coping strategy selection and preparation in advance, so as to more timely cope with dynamic network problems, avoid lag reaction and false alarm and miss report situation.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer system operation, and particularly relates to a management method and device for stable system operation and a server. BACKGROUND

[0002] The application scenarios of computer systems are increasingly complex and diversified, and the changes in network environment and system load are also increasingly frequent, so the stability of the system is increasingly important. However, the existing monitoring means mostly rely on static rules and manual intervention, and are slow to respond when facing abnormal behaviors, and are difficult to cope with dynamically changing network problems, so that lagging response and false positives and false negatives are prone to occur, thereby increasing the risk of system operation. Meanwhile, excessive reliance on manual analysis and intervention also increases the operation and maintenance cost and reduces the automation degree of the system. SUMMARY

[0003] The present application provides a management method for stable system operation, which comprises the following steps:

[0004] Obtaining running state information at each time point from the device operating system according to a set time interval, wherein the running state information comprises CPU usage, memory occupancy and network traffic value at the current collection time point;

[0005] Performing data cleaning on the collected CPU usage, memory occupancy and network traffic value, converting the running state information at each time point after the cleaning processing to form a row-column data structure comprising multiple data fields, wherein each type of running state information is allocated to the corresponding data field and the data is aggregated by time sequence, obtaining structured raw collection data, and the data fields comprise CPU usage, memory occupancy, time stamp and network traffic value;

[0006] Performing data analysis and prediction on the raw collection data, obtaining abnormal running state information and corresponding collection time points, and obtaining running state prediction values of subsequent time periods according to the running state information at each time point in the raw collection data, wherein the running state prediction values comprise predicted CPU usage, memory occupancy or network traffic value at multiple subsequent time points after the current time point;

[0007] Identifying abnormal behavior attributes according to the abnormal running state information and corresponding time points, and selecting corresponding coping strategies in the coping strategy library according to the abnormal behavior attributes and system running state prediction values and executing the same.

[0008] Preferably, the management method for stable operation of the system further comprises the following steps: collecting running feedback information of the device operating system after executing the coping strategy, comparing the running feedback information with the running state information before the execution of the coping strategy, judging the optimization state of each state index and calculating the current execution strategy effect value, and according to the execution strategy effect value, the effectiveness of each coping strategy in the coping strategy library is sorted.

[0009] Preferably, the running state information of each time point obtained from the device operating system according to the set time interval further comprises: obtaining CPU usage, system total physical memory size and current free physical memory size of each time point from the device operating system according to the set time interval, calculating the current memory occupation rate according to the system total physical memory and the current free physical memory, and calling a network interface monitoring tool to capture real-time network data packets and calculating the current network traffic value according to the obtained network data packets.

[0010] Preferably, the CPU usage, memory occupation rate and network traffic value collected are data cleaned, and the running state information of each time point after cleaning is converted to form a row-column data structure containing multiple data fields, wherein each type of running state information is allocated to the corresponding data field and the data is aggregated in a time sequence to obtain structured raw collected data, specifically including:

[0011] According to the type of collected running state information, the corresponding preset information reasonable value range is found, the running state information of each time point collected is compared with the preset information reasonable value range of the corresponding type, and the information error points exceeding the reasonable value range are removed;

[0012] According to the preset filling rule and the running state information of the adjacent time points, the missing value of one or more types of running state information in part of the time points is supplemented, and the collected running state information is de-duplicated through unique identity information or time stamp;

[0013] The running state information of each time point after processing is converted to form a row-column data structure containing multiple data fields, wherein each type of running state information is allocated to the corresponding data field, the preset aggregation rule of each type of running state information is queried, and each type of running state information is respectively aggregated in a time sequence using the corresponding preset aggregation rule to obtain structured raw collected data.

[0014] Preferably, the data analysis and prediction on the original collected data are performed to obtain abnormal running state information and corresponding collection time points, and a running state prediction value of a subsequent time period is obtained according to the running state information of each time point in the original collected data, specifically including: using a standard score statistical method, detecting abnormal data of each type of running state information in the statistical distribution in the original collected data according to a matching threshold value of each type of running state information, to obtain corresponding abnormal running state information and corresponding collection time points; analyzing the running state information of each time point in the original collected data, and calculating a linear regression model matching each type of running state information by a least square method using historical values of each type of running state; using the linear regression model to obtain a running state prediction value of a subsequent time period according to the historical value of the corresponding type of running state information, wherein each type of running state information includes CPU usage, memory occupancy or network traffic value.

[0015] The application also discloses a management device for stable operation of a system, comprising: a data collection module for obtaining running state information of each time point from a device operating system according to a set time interval, wherein the running state information includes CPU usage, memory occupancy and network traffic value of a current collection time point; a data processing module for performing data cleaning on the collected CPU usage, memory occupancy and network traffic value, converting the running state information of each time point after the cleaning processing to form a row-column data structure containing multiple data fields, wherein each type of running state information is distributed to a corresponding data field and the data is bucket aggregated in time sequence to obtain structured original collected data, and the data fields include CPU usage, memory occupancy, time stamp and network traffic value; a data analysis module for performing data analysis and prediction on the original collected data to obtain abnormal running state information and corresponding collection time points, and obtaining a running state prediction value of a subsequent time period according to the running state information of each time point in the original collected data, wherein the running state prediction value includes predicted CPU usage, memory occupancy or network traffic value of multiple subsequent time points after the current time point; a coping processing module for identifying abnormal behavior attributes according to the abnormal running state information and corresponding time points, and selecting a corresponding coping strategy in a coping strategy library according to the abnormal behavior attributes and the system running state prediction value and performing the same.

[0016] Preferably, the management device for stable operation of a system further comprises a strategy evaluation module for collecting running feedback information of the device operating system after the execution of the coping strategy, comparing the running feedback information with the running state information before the execution of the coping strategy, judging the optimization state of each state index and calculating a current execution strategy effect value, and sorting the effectiveness of each coping strategy in the coping strategy library according to the execution strategy effect value.

[0017] Preferably, the data collection module is further configured to obtain the CPU usage rate, the total system physical memory size and the current idle physical memory size at each time point from the device operating system according to a set time interval, calculate the current memory occupancy rate according to the total system physical memory and the current idle physical memory, and call a network interface monitoring tool to capture real-time network data packets and calculate the current network traffic value according to the obtained network data packets.

[0018] Preferably, the data processing module is further configured to find a corresponding preset information reasonable value range according to the collected running state information type, compare the collected running state information at each time point with the preset information reasonable value range of the corresponding type, remove the information error points that exceed the reasonable value range, supplement the missing value of one or more types of running state information at some time points according to a preset filling rule and the running state information of the adjacent time points, and perform deduplication processing on the collected running state information through the unique identity information or the time stamp, convert the processed running state information at each time point to form a row-column data structure containing multiple data fields, wherein each type of running state information is allocated to the corresponding data field, query the preset aggregation rule of each type of running state information, and use the corresponding preset aggregation rule to respectively perform bucket aggregation on each type of running state information according to the time sequence to obtain the structured original collection data.

[0019] The application further discloses a server, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of any of the preceding management methods for stable operation of the system when executing the computer program.

[0020] The management method, device and server for stable operation of a system disclosed by the application obtain structured original collection data by performing data cleaning on collected CPU usage, memory occupancy and network traffic values, converting running state information at each time point after the cleaning processing, forming a row-column data structure containing multiple data fields, distributing each type of running state information to the corresponding data field and performing bucket aggregation on the data in time sequence, then performing data analysis and prediction on the original collection data to obtain abnormal running state information and the corresponding collection time point, and obtaining running state prediction values of subsequent time periods according to the running state information of each time point in the original collection data, wherein the running state prediction values include predicted CPU usage, memory occupancy or network traffic values at multiple subsequent time points after the current time point, and finally identifying abnormal behavior attributes according to the abnormal running state information and the corresponding time point, selecting the corresponding coping strategy in the coping strategy library according to the abnormal behavior attributes and the system running state prediction values and executing the selected coping strategy.

[0021] Additional aspects and advantages of the application will be made apparent by the following description. BRIEF DESCRIPTION OF DRAWINGS

[0022] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the application and together with the description serve to explain the application. In the drawings:

[0023] Figure 1 A step schematic diagram of the management method for stable operation of a system disclosed by an embodiment of the application.

[0024] Figure 2 A specific step schematic diagram of step S2 disclosed by an embodiment of the application.

[0025] Figure 3 A specific step schematic diagram of step S3 disclosed by an embodiment of the application.

[0026] Figure 4 A structure schematic diagram of the management device for stable operation of a system disclosed by an embodiment of the application. DETAILED DESCRIPTION

[0027] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions of the embodiments of the present application will be described clearly and completely below with reference to the drawings of the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the described embodiments of the present application, all other embodiments obtained by a person of ordinary skill in the art without creative effort belong to the scope of protection of the present application.

[0028] In the present application, unless otherwise explicitly specified and limited, the technical terms or scientific terms used herein should be understood as the usual meanings understood by persons having ordinary skills in the art to which the present application belongs. The terms "first", "second" and similar terms used in the patent application description and claims of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. Similarly, "one" or "a" and similar terms do not represent a quantity limitation, but represent the existence of at least one.

[0029] The embodiment discloses a management method for stable operation of a system, which can be used to ensure the security and stability of a computer system in a complex and dynamic network and system environment, and can detect, identify and respond to potential security threats and performance abnormalities in real time without relying on a large amount of manual intervention. Specifically as shown in the figure, the management method for stable operation of the system can include the following steps. Figure 1

[0030] Step S1, obtaining running state information at each time point from the device operating system according to a set time interval, wherein the running state information includes CPU usage, memory occupancy and network traffic value at the current collection time point.

[0031] In the embodiment, the CPU usage, the total system physical memory size and the current idle physical memory size at each time point can be obtained from the device operating system according to a set time interval, and the current memory occupancy is calculated according to the total system physical memory and the current idle physical memory. Real-time network data packets are captured by calling a network interface monitoring tool, and the current network traffic value is calculated according to the obtained network data packets. The frequent interaction with the database or the file system can be reduced by batch collection. Asynchronous tasks or multithreading can also be used to collect multiple data sources simultaneously. Buffer queues or message queues are used to cache real-time collected data, reducing processing pressure.

[0032] ​The CPU usage rate can be obtained by reading the relevant information of the operating system. The memory usage can be obtained by the OperatingSystemMXBean class of Java, including the usage of physical memory and virtual memory. The used memory is calculated by the difference between the total physical memory size and the current free physical memory size, and then converted into a percentage for display. The network traffic collection can be obtained by calling the network interface monitoring tool of the operating system.

[0033] In this embodiment, in order to reduce the amount of data transmitted and improve transmission efficiency, the data needs to be compressed before transmission. The compression algorithm can be Gzip compression algorithm or the like. The compression algorithm can effectively reduce the occupation of transmission bandwidth while ensuring the speed of data transmission.

[0034] Meanwhile, the compressed collected data is transmitted in an encrypted manner, which can be transmitted asynchronously through a message queue. A symmetric encryption method is used to ensure that the data cannot be eavesdropped or tampered with during transmission. The encryption process includes the following steps.

[0035] Key expansion, generating a series of round keys from the initial key.

[0036] Initial round execution, performing an initial round operation on the plaintext and performing an XOR operation with the first round key.

[0037] Multiple round iterations, multiple rounds are performed on each 128-bit block, and the specific number of rounds depends on the key length. Each round includes four steps: byte substitution, using a mixed substitution network to replace each byte. Row shift, cyclically shifting the bytes in the data block by row. Column confusion, confusing the columns and scattering the relationship between the data. Round key addition, XOR operation with the round key.

[0038] Final round execution, performing similar operations as the multiple round iterations but without column confusion, finally generating encrypted data information.

[0039] Step S2, data cleaning is performed on the collected CPU usage rate, memory occupancy rate and network traffic value, the running state information at each time point after cleaning is converted to form a row-column data structure containing multiple data fields, wherein each type of running state information is allocated to the corresponding data field and the data is aggregated in a bucket according to the time sequence, to obtain structured raw collected data, and the data fields include CPU usage rate, memory occupancy rate, timestamp and network traffic value.

[0040] Specifically, as shown in Figure 2 , this step S2 can include the following contents.

[0041] Step S21, according to the collected running state information type, find the corresponding preset information reasonable value range, compare the collected running state information of each time point with the corresponding type of preset information reasonable value range, and remove the information error points that exceed the reasonable value range. The information reasonable value range with upper and lower limits can be preset for each running state information, i.e. CPU usage, memory occupancy, network traffic value.

[0042] Step S22, according to the preset filling rule and the running state information of the adjacent time points before and after, supplement the missing value of one or more types of running state information in part of the time points, and remove the collected running state information through unique identity information or time stamp. For the missing data, the mean value can be used for filling. Different missing value supplement methods can be set for different types of running state information, which can be mean value filling of a certain number of time points before and after, or maximum value or minimum value filling, etc.

[0043] Step S23, convert the processed running state information of each time point to form a row-column data structure containing multiple data fields, wherein each type of running state information is allocated to the corresponding data field, query the preset aggregation rule of each type of running state information, and use the corresponding preset aggregation rule to respectively perform bucket aggregation on each type of running state information according to time sequence, to obtain structured raw collection data.

[0044] Through structured data, efficient query and processing can be ensured in the subsequent process. The present embodiment adopts a table form of row-column structure, and each data item is allocated to the corresponding field. Specifically, the following contents can be included.

[0045] Define data mode, determine the field of each collected data, including CPU usage, memory occupancy, network traffic value, and time stamp. Perform bucket operation on the data, i.e. aggregation or grouping according to the set time interval, to reduce the data amount and retain the key statistical information. For example, select 1 minute or 5 minute interval to reduce the data amount. Both the trend and overall structure of the data can be retained, and the data storage amount and processing complexity can be reduced.

[0046] Specifically, the data of multiple time points is aggregated into one bucket, and each bucket represents a fixed time range, such as 1 minute or 5 minutes. In each bucket, multiple data points are compressed into one value representing the data characteristics of the time period through a preset statistical method such as data average value, data maximum value, data minimum value, or data sum, etc.

[0047] Suppose the original time series data set is:

[0048] ; wherein t n is the time stamp, x nis the data corresponding to the timestamp, such as CPU usage, memory occupancy or network traffic value.

[0049] By defining a time window, that is, a time interval, such as 1 minute or 5 minutes, the data bucketing aims to aggregate multiple data points into a value representing the data characteristics of the time period within each time window.

[0050] Taking the pre-statistical method of adopting the average value of data as an example, the average value of all data points in each time bucket is calculated , representing the overall trend of the time period:

[0051] , wherein B k represents the data points in the kth time bucket, N k is the number of data points in the bucket. Through the data bucketing operation, only the key information can be retained, and the unnecessary calculation amount and storage space can be reduced.

[0052] Step S3, data analysis and prediction are performed on the original collected data to obtain abnormal running state information and corresponding collection time points, and running state prediction values of subsequent time periods are obtained according to the running state information of each time point in the original collected data, the running state prediction values including predicted CPU usage, memory occupancy or network traffic values at multiple subsequent time points after the current time point.

[0053] As shown in Figure 3 , in this embodiment, step S3 can specifically include the following contents.

[0054] Step S31, using a standard score statistical method, according to the matching threshold of each type of running state information, detecting abnormal data of each type of running state information in the statistical distribution in the original collected data, obtaining corresponding abnormal running state information and corresponding collection time points.

[0055] In this embodiment, by using the Z-Score statistical method, the abnormal points of each type of running state information in the statistical distribution are detected. Taking the timestamps [1, 2, 3, 4, 5, 6, 7, 8, 9, 10] of the collected data and the corresponding CPU usage [10, 12, 11, 13, 14, 50, 15, 12, 11, 13] as an example.

[0056] Step S311, calculating the mean and standard deviation of the CPU usage data of each collection time point.

[0057] Mean calculation:

[0058] ;

[0059] Standard deviation calculation:

[0060] .

[0061] Step S312, calculate the Z-Score value Z of the running state information of each collection time point i , , where X i is the CPU usage rate of the i-th collection time point; a preset matching threshold of the running state information is obtained, and the data of the collection time point exceeding the matching threshold is judged as abnormal data, and the corresponding abnormal running state information and the corresponding collection time point are obtained. For example, the Z-Score value Z6 of the above 6th data point is: .

[0062] And the preset matching threshold of the CPU usage rate is 2, which means that if the Z-Score value exceeds this threshold, the data point is considered abnormal. Here Z6 is 2.89, which has exceeded the threshold 2, indicating that the collection time point with CPU usage rate of 50% is an abnormal point, which needs to be processed subsequently.

[0063] Wherein, if the abnormal running state information exceeding the set range and the abnormal collection time point are screened out, the change of the same type of abnormal running state information at the adjacent collection time points before and after is continued to be obtained, and the values of other types of running state information at the abnormal collection time point are obtained.

[0064] Step S32, analyze the running state information of each time point in the original collection data, and calculate the linear regression model matching each type of running state information by least square method using the historical values of each type of running state; using the linear regression model, the running state prediction value of the subsequent time period is obtained according to the historical value of the corresponding type of running state information, wherein each type of running state information includes CPU usage rate, memory occupancy rate or network traffic value.

[0065] In this embodiment, the continuous target variable is predicted by using the linear regression model. And the trend is judged by finding the linear relationship between the input variable and the output variable. In the linear regression model, the goal is to find the best straight line to fit the given input data, so as to accurately predict the trend.

[0066] In this embodiment, it is assumed that there is a linear relationship between the target variable y and the input feature x, that is

[0067] , the values of β0 and β1 are found, so that the error between the model prediction and the actual y is minimized. The loss function used is the least square method, that is, the sum of the squared errors between the predicted value and the true value is minimized:

[0068] ;

[0069] where n is the number of data points, y is the true value of the i-th data point; the predicted value of the i-th data point is: .

[0070] By minimizing the above loss function, we can directly solve the parameters of linear regression by the following formula:

[0071] ; where β0 is the slope and β1 is the intercept.

[0072] The following specific examples are described, for example, every 1 minute to collect CPU usage, in 1 to 7 minutes of the corresponding CPU usage is [20, 22, 21, 23, 24, 26, 27], according to these data, build a linear model to predict the trend of CPU usage in the future few minutes.

[0073] First, calculate the mean of the independent variable x, that is, the time and the dependent variable y, that is, the CPU usage:

[0074] ;

[0075] According to the formula, calculate the slope β1:

[0076] ;

[0077] Calculate the intercept β0:

[0078] ;

[0079] Build a linear regression equation:

[0080] ; the linear regression equation represents the linear relationship between time x and CPU usage y. This model can be used to predict the trend of CPU usage in the future time period.

[0081] For example, predict the CPU usage of the 8th minute above:

[0082] , that is, the predicted CPU usage at the 8th minute is about 38.85%.

[0083] Step S4, according to the abnormal running state information and the corresponding time point to identify the abnormal behavior attribute, according to the abnormal behavior attribute and the system running state prediction value in the coping strategy library Select the corresponding coping strategy and execute. Wherein the coping strategy can include sending warning notification, executing the corresponding preset automation script, performing server load distribution, setting traffic limit and server restart.

[0084] With the CPU usage rate as an example of the running state information, the server load distribution strategy can be reasonably configured to effectively reduce the system load and ensure stable system operation. Specifically, according to the CPU usage rate collected at each historical time point, the preset trend judgment model is adjusted, and the adjusted trend judgment model is used to predict the CPU predicted usage rate at a subsequent time point. If the CPU predicted usage rate is greater than a first threshold, other task servers that can accept load distribution are queried.

[0085] If the time point at which the CPU predicted usage rate is greater than the first threshold is located within the set working period, load distribution is not performed, and the access request at the corresponding subsequent time point is subjected to a flow limiting setting. If it is located within the set working period, other task servers that can accept load distribution are queried. If it is not located within the set working period, load distribution is not performed, and the access request between the corresponding subsequent time points is subjected to a flow limiting setting and a monitoring task is added. The monitoring task is configured to obtain the access request authority triggering the flow limiting operation.

[0086] If the access request authority is higher than the set value, the flow limiting operation is closed. When the CPU usage rate of the current server exceeds a second threshold, the current CPU usage rate of each task server and the load prediction table are queried. The task server whose current CPU usage rate and CPU predicted usage rate within a subsequent set time period are both lower than the first threshold is taken as a target server. The load distribution ratio is determined according to the average value of the current CPU usage rate and the CPU predicted usage rate within the subsequent set time period of each target server. The flow is distributed to different target servers according to the load distribution ratio.

[0087] In the embodiment, the load prediction table of each task server can also be queried. The load prediction table records the CPU predicted usage rate of the server within a subsequent set time period. The load distribution ratio is determined according to the different CPU predicted usage rates of each task server at the corresponding time, and a load distribution task reservation is sent to the corresponding task server. The task server updates its load prediction table after receiving the load distribution task reservation. Specifically, the step can include the following contents.

[0088] Step S101, the load prediction table of each task server is queried. The load prediction table records the CPU predicted usage rate of the server within a subsequent set time period. The CPU predicted usage rate is composed of the task predicted usage rate of the server and the received load distribution task predicted usage rate.

[0089] Step S102, obtaining the duration period of the to-be-distributed load and the CPU predicted usage of each task server at each time point in the duration period, and taking the maximum of the CPU predicted usage at each time point in the duration period as the current period CPU predicted usage of the server.

[0090] Step S103, determining the load distribution proportion according to the current period CPU predicted usage of each task server, and generating a load distribution task and sending it to the corresponding task server; after receiving the load distribution task, each task server generates a corresponding load distribution task predicted usage and adds it to the load prediction table.

[0091] After reaching the corresponding time point, the corresponding number of access requests are distributed to each task server according to the load distribution proportion.

[0092] In the embodiment, the abnormal behavior attribute can also be predicted according to the abnormal running state information, other types of running state information values at the collection time point, and the change of the same type of abnormal running state information at the adjacent collection time point, and the corresponding coping strategy is selected and executed in the coping strategy library according to the abnormal behavior attribute and the overload range of the abnormal running state information.

[0093] For example, if the CPU usage at a collection time point exceeds the usage threshold, and the memory occupancy rate at the collection time point or the adjacent subsequent collection time point also exceeds the occupancy threshold, the network traffic value change at the collection time point and the subsequent collection time point is queried, and if the corresponding network traffic value gradually decreases, it is judged as memory overflow, and the memory arrangement component is called to find objects or resources with low usage frequency and release them.

[0094] If the CPU usage and the memory occupancy rate still exceed the corresponding threshold at the subsequent multiple collection time points and the network traffic value still gradually decreases, a load distribution request is sent to other task servers, and the server is restarted.

[0095] If the CPU usage at a collection time point exceeds the usage threshold, and the memory occupancy rate at the collection time point or the adjacent subsequent collection time point gradually increases, the network traffic value change at the collection time point and the subsequent collection time point is queried.

[0096] If the corresponding network traffic value change is within the corresponding reasonable value range, the attribute information of the task processes occupying the top of the current CPU usage rate is obtained, the priority of the corresponding task process is queried according to the attribute information, and the task processes with a priority lower than a set value are terminated. If the corresponding network traffic value increases by more than a first threshold value, the external network access request at the corresponding collection time point is obtained, the address and required upload data type of the access request ranked at the top of the upload network traffic value are obtained, and if the address is not in the trusted list, the address is subjected to a flow limiting setting.

[0097] If the CPU usage rate, memory occupation rate and network traffic value at the collection time point all exceed the corresponding threshold value, it is judged whether the current collection time is in a set working period, if yes, the attribute information of the task processes occupying the top of the current CPU usage rate is queried, the priority of the corresponding task process is queried according to the attribute information, and the task processes with a priority lower than a set value are terminated; if not, the subsequent access request is subjected to a flow limiting setting.

[0098] In the embodiment, the management method for stable operation of the system can further include the following content.

[0099] In step S5, the running feedback information of the device operating system after the coping strategy is executed is collected, the running feedback information is compared with the running state information before the coping strategy is executed, the optimization state of each state index is judged and the current execution strategy effect value is calculated, and each coping strategy in the coping strategy library is sorted according to the execution strategy effect value.

[0100] Among them, the commonly used feedback indicators include CPU usage rate, i.e. whether the CPU usage rate is reduced after the load balancing or other preset automated scripts are executed, memory occupation rate, i.e. whether the memory occupation is relieved after the automated scripts are executed, and network traffic, i.e. whether the network traffic is successfully reduced after the network traffic limiting measures are executed. By monitoring the state of the system in real time, the result data after the current execution strategy is obtained, and it is compared with the previous state to judge the change of the system state. Specifically, the change trend can be calculated by comparing the key indicator values of the current system, such as load and response time, with the target value or historical baseline.

[0101] In the embodiment, the effect of the current execution strategy can also be calculated according to the positive and negative effects of the feedback, and then the future strategy selection is adjusted. The positive feedback increases the reward, and the negative feedback reduces the reward. A reward value is calculated by setting a reward function, which is used to measure the pros and cons of the current strategy. The size of the reward can be determined according to the improvement degree of the key indicators, the target achievement situation, and the actual system demand.

[0102] For example, the target-based weighted reward. If the system has multiple indicators X1, X2...Xn, the reward value R can be calculated by the difference and weight combination:

[0103] ; wherein X i,before and X i,after respectively represent the value of the i-th indicator before and after the execution of the strategy; α i is the weight used to represent the degree of influence of different indicators on the system.

[0104] For example, assume that the system focuses on CPU usage and memory occupation, and the weights are α cpu =0.6 and α memory =0.4. If the CPU usage decreases from 85% to 70% and the memory occupation decreases from 75% to 60%. The reward calculation is: R=0.6×(85-70)+0.4×(75-60)=15; then the positive reward R=15 indicates that the strategy is effective. Finally, according to the execution strategy effect value, each response strategy in the response strategy library is sorted according to effectiveness.

[0105] In another embodiment, as shown in Figure 4 , a management device for stable operation of the system is also disclosed, which specifically includes a data acquisition module 1, a data processing module 2, a data analysis module 3 and a response processing module 4; wherein the data acquisition module 1 is used to obtain the running state information at each time point from the device operating system according to the set time interval, and the running state information includes the CPU usage, memory occupation and network traffic value at the current collection time point. The data processing module 2 is used to clean the collected CPU usage, memory occupation and network traffic value, convert the running state information at each time point after cleaning processing, form a row-column data structure containing multiple data fields, wherein each type of running state information is allocated to the corresponding data field and the data is aggregated by bucket according to time sequence, to obtain structured raw collection data, and the data field includes CPU usage, memory occupation, timestamp and network traffic value. The data analysis module 3 is used to analyze and predict the raw collection data, obtain abnormal running state information and corresponding collection time point, and obtain running state prediction values of subsequent time periods according to the running state information of each time point in the raw collection data, wherein the running state prediction values include predicted CPU usage, memory occupation or network traffic value at multiple subsequent time points after the current time point. The response processing module 4 is used to identify abnormal behavior attributes according to the abnormal running state information and the corresponding time point, select the corresponding response strategy in the response strategy library according to the abnormal behavior attributes and system running state prediction values, and execute it.

[0106] In the embodiment, the management device for stable operation of the system further comprises a policy evaluation module configured to collect running feedback information of the device operating system after executing the coping strategy, compare the running feedback information with the running state information before executing the coping strategy, judge the optimization state of each state index and calculate the current execution strategy effect value, and sort the effectiveness of each coping strategy in the coping strategy library according to the execution strategy effect value.

[0107] In the embodiment, the data collection module is further configured to obtain the CPU usage rate, the total system physical memory size and the current idle physical memory size at each time point from the device operating system according to a set time interval, calculate the current memory occupation rate according to the total system physical memory and the current idle physical memory, call a network interface monitoring tool to capture real-time network data packets, and calculate the current network traffic value according to the obtained network data packets.

[0108] In the embodiment, the data processing module is further configured to find a corresponding preset information reasonable value range according to the collected running state information type, compare the collected running state information at each time point with the preset information reasonable value range of the corresponding type, remove the information error points that exceed the reasonable value range, supplement the missing value of one or more types of running state information at some time points according to a preset filling rule and the running state information of the adjacent time points, and perform deduplication processing on the collected running state information through unique identity information or a timestamp, convert the processed running state information at each time point to form a row-column data structure comprising multiple data fields, wherein each type of running state information is allocated to a corresponding data field, query a preset aggregation rule of each type of running state information, and use the corresponding preset aggregation rule to respectively perform bucket aggregation on each type of running state information in time sequence to obtain structured raw collection data.

[0109] The specific functions of the above management device for stable operation of the system correspond one by one to the management method for stable operation of the system disclosed in the foregoing embodiments, and therefore will not be described in detail here. For details, reference can be made to the foregoing disclosed management method for stable operation of the system. It should be noted that each embodiment in the specification is described in a progressive manner, and each embodiment mainly describes the differences from other embodiments. The same or similar parts between each embodiment can be referred to mutually.

[0110] In some embodiments, a server is also provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements each step of the management method for stable operation of a system as described in the above embodiments when executing the computer program. The management server for stable operation of a system can comprise but is not limited to a processor and a memory. Those skilled in the art can understand that the schematic diagram is only an example of the management server for stable operation of a system, and does not constitute a limitation on the management server for stable operation of a system, and can comprise more or fewer components than the diagram, or combine certain components, or different components.

[0111] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can still be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

[0112] In summary, the above only describes the preferred embodiments of the present application, and any equivalent changes and modifications made within the scope of the patent application of the present application shall be included in the scope of the patent of the present application.

Claims

1. A management method for stable operation of a system, characterized by, Comprising the following steps: According to the set time interval, the running state information of each time point is obtained from the device operating system, and the running state information includes the CPU usage, memory occupancy and network traffic value of the current collection time point; The collected CPU usage, memory occupancy and network traffic value are data cleaned, the running state information of each time point after cleaning is converted to form a row-column data structure containing multiple data fields, wherein each type of running state information is allocated to the corresponding data field and the data is aggregated by time sequence, obtaining structured raw collection data, and the data field includes CPU usage, memory occupancy, timestamp and network traffic value; Data analysis and prediction are performed on the raw collection data to obtain abnormal running state information and corresponding collection time points, and running state prediction values of subsequent time periods are obtained according to the running state information of each time point in the raw collection data, including predicted CPU usage, memory occupancy or network traffic value of multiple subsequent time points after the current time point; According to the abnormal running state information and the corresponding time point, the abnormal behavior attribute is identified, and the corresponding coping strategy is selected from the coping strategy library according to the abnormal behavior attribute and the system running state prediction value and executed; The running state information includes CPU usage, by querying the load prediction table of each task server, the load prediction table records the CPU predicted usage of the server in the subsequent set time period, the load allocation ratio is determined according to the different CPU predicted usage of each task server at the corresponding time, and the load allocation task reservation is sent to the corresponding task server; The task server updates its load prediction table after receiving the load allocation task reservation, specifically including: Step S101, querying the load prediction table of each task server, the load prediction table records the CPU predicted usage of the server in the subsequent set time period, wherein the CPU predicted usage is composed of the task predicted usage of the server and the received load allocation task predicted usage; Step S102, obtaining the duration of the load to be distributed, and the CPU predicted usage of each task server at each time point in the duration, taking the maximum value of the CPU predicted usage at each time point in the duration as the CPU predicted usage of the server in the current time period; Step S103, according to the CPU predicted usage of each task server in the current time period, the load allocation ratio is determined, and the load allocation task reservation is generated and sent to the corresponding task server; After receiving the load allocation task reservation, each task server generates the corresponding load allocation task predicted usage and adds it to the load prediction table.

2. The management method for stable operation of a system according to claim 1, characterized by, Further comprising the following steps: Collecting the running feedback information of the device operating system after executing the coping strategy, comparing the running feedback information with the running state information before executing the coping strategy, judging the optimization state of each state index and calculating the current execution strategy effect value, and according to the execution strategy effect value, the effectiveness of each coping strategy in the coping strategy library is sorted.

3. The management method for stable operation of a system according to claim 2, characterized by, The running state information of each time point is obtained from the device operating system according to a set time interval, and the method further comprises: According to the set time interval, the CPU usage, the total system physical memory size and the current idle physical memory size of each time point are obtained from the device operating system, and the current memory occupancy rate is calculated according to the total system physical memory and the current idle physical memory; a network interface monitoring tool is called to capture real-time network data packets, and the current network traffic value is calculated according to the obtained network data packets.

4. The management method for stable operation of a system according to claim 3, characterized by, The collected CPU usage, memory occupancy rate and network traffic value are data cleaned, and the running state information of each time point after cleaning is converted to form a row-column data structure containing multiple data fields, wherein each type of running state information is distributed to the corresponding data field and the data is aggregated in a time sequence, to obtain structured raw collection data, specifically including: According to the type of collected running state information, the corresponding preset information reasonable value range is found, the running state information of each time point collected is compared with the preset information reasonable value range of the corresponding type, and the values exceeding the reasonable value range are removed as information error points; According to the preset filling rule and the running state information of the adjacent time points, the missing values of one or more types of running state information in part of the time points are supplemented, and the collected running state information is de-duplicated by unique identity information or time stamp; The processed running state information of each time point is converted to form a row-column data structure containing multiple data fields, wherein each type of running state information is distributed to the corresponding data field, the preset aggregation rule of each type of running state information is queried, and each type of running state information is aggregated in a time sequence using the corresponding preset aggregation rule to obtain structured raw collection data.

5. The management method for stable operation of a system according to claim 4, wherein, The raw collection data is analyzed and predicted to obtain abnormal running state information and corresponding collection time points, and the running state prediction value of the subsequent time period is obtained according to the running state information of each time point in the raw collection data, specifically including: Using the standard score statistical method, according to the matching threshold of each type of running state information, the abnormal data of each type of running state information in the statistical distribution in the raw collection data is detected, the corresponding abnormal running state information and the corresponding collection time points are obtained; The running state information of each time point in the raw collection data is analyzed, and the linear regression model matching each type of running state information is calculated by the least square method using the historical values of each type of running state; the linear regression model is used to predict the running state prediction value of the subsequent time period according to the historical values of the corresponding type of running state information, wherein each type of running state information includes CPU usage, memory occupancy rate or network traffic value.

6. A management apparatus for system stable operation, characterized by, The data collection module is used to obtain the running state information of each time point from the device operating system according to a set time interval, and the running state information includes the CPU usage, the memory occupancy rate and the network traffic value of the current collection time point; ​ The data processing module is configured to clean the collected CPU usage, memory occupancy and network traffic values, convert the running state information at each time point after the cleaning process, and form a row-column data structure including multiple data fields, wherein each type of running state information is allocated to a corresponding data field and the data is aggregated in a time sequence, to obtain structured raw collection data, and the data fields include CPU usage, memory occupancy, timestamp, and network traffic value. The data analysis module is configured to analyze and predict the raw collection data, obtain abnormal running state information and corresponding collection time points, and obtain running state prediction values for subsequent time periods according to the running state information at each time point in the raw collection data, wherein the running state prediction values include predicted CPU usage, memory occupancy or network traffic values at multiple subsequent time points after the current time point. The coping module is configured to identify abnormal behavior attributes according to the abnormal running state information and corresponding time points, select a corresponding coping strategy in the coping strategy library according to the abnormal behavior attributes and system running state prediction values, and execute the selected coping strategy; the running state information includes CPU usage, and the load prediction table of each task server is queried, wherein the load prediction table records the CPU prediction usage of the server in the subsequent set time period, the load distribution ratio is determined according to the different CPU prediction usage of each task server at the corresponding time, and the load distribution task reservation is sent to the corresponding task server. The task server updates its load prediction table after receiving the load distribution task reservation, and is specifically configured to query the load prediction table of each task server, wherein the load prediction table records the CPU prediction usage of the server in the subsequent set time period, and the CPU prediction usage is composed of the task prediction usage of the server and the received load distribution task prediction usage; obtain the duration of the load to be distributed, and the CPU prediction usage of each task server at each time point in the duration, and the maximum value of the CPU prediction usage at each time point in the duration is taken as the current time period CPU prediction usage of the server; the load distribution ratio is determined according to the current time period CPU prediction usage of each task server, and the load distribution task reservation is generated and sent to the corresponding task server; each task server generates a corresponding load distribution task prediction usage after receiving the load distribution task reservation, and adds it to the load prediction table.

7. The management apparatus for stable operation of a system according to claim 6, wherein Further comprising: The strategy evaluation module is configured to collect the running feedback information of the device operating system after executing the coping strategy, compare the running feedback information with the running state information before executing the coping strategy, judge the optimization state of each state index and calculate the current execution strategy effect value, and sort the effectiveness of each coping strategy in the coping strategy library according to the execution strategy effect value.

8. The management device for stable operation of a system according to claim 7, characterized by: The data collection module is further configured to obtain the CPU usage, the total system physical memory size and the current idle physical memory size at each time point from the device operating system according to a set time interval, and calculate the current memory occupancy rate according to the total system physical memory and the current idle physical memory. The network interface monitoring tool is called to capture real-time network data packets, and the current network traffic value is calculated according to the obtained network data packets.

9. The management apparatus for stable operation of a system according to claim 8, characterized by: The data processing module is further configured to find the corresponding preset information reasonable value range according to the collected running state information type, compare the collected running state information at each time point with the preset information reasonable value range of the corresponding type, remove the information error points that exceed the reasonable value range, supplement the missing value of one or more types of running state information at some time points according to the preset filling rule and the running state information of the adjacent time points, and perform the deduplication processing on the collected running state information through the unique identity information or the time stamp. The processed running state information at each time point is converted to form a row-column data structure containing multiple data fields, wherein each type of running state information is distributed to the corresponding data field, the preset aggregation rule of each type of running state information is queried, each type of running state information is respectively subjected to the bucket aggregation according to the time sequence using the corresponding preset aggregation rule, and the structured original collection data is obtained.

10. A server comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: The processor executes the computer program to realize the steps of the method of any one of claims 1-5.

Images