Abnormal event detection method and device, equipment, medium and product

Abstract

The invention discloses an abnormal event detection method and device, equipment, a medium and a product. The method comprises the steps of obtaining a target abnormal event input by a user and a time window corresponding to the target abnormal event; periodically acquiring performance index data of the database cluster in the time window by taking the time window as a period to obtain a performance index data stream; calculating the service index data based on the performance index data in the performance index data flow according to a calculation rule corresponding to the service index data to obtain a service index data flow; and based on the business index data flow, performing target abnormal event detection on the database cluster to obtain a detection result. Therefore, the abnormal event defined by the user can be detected, the abnormal event which has occurred can not be detected only, and therefore abnormal event detection can be carried out on the database cluster more comprehensively.

Description

Technical Field

[0001] The present application belongs to the field of operation and maintenance technology, and in particular, relates to an abnormal event detection method, device, equipment, medium and product. Background Art

[0002] During the operation and maintenance of a database cluster, it is necessary to detect whether abnormal events occur in the database cluster.

[0003] At present, abnormal event detection is usually performed through deep learning models. However, this can only detect abnormal events existing in training samples, and the detection of abnormal events is not comprehensive enough. Summary of the invention

[0004] The embodiments of the present application provide an abnormal event detection method, apparatus, device, medium and product, which can realize the detection of user-defined abnormal events rather than only the abnormal events that have occurred, so abnormal event detection can be performed on the database cluster more comprehensively.

[0005] In a first aspect, an embodiment of the present application provides a method for detecting an abnormal event, the method comprising:

[0006] Obtain the target abnormal event input by the user and the time window corresponding to the target abnormal event;

[0007] Taking the time window as a period, periodically obtain the performance indicator data of the database cluster within the time window to obtain a performance indicator data stream;

[0008] According to the calculation rules corresponding to the business indicator data, the business indicator data is calculated based on the performance indicator data in the performance indicator data stream to obtain the business indicator data stream;

[0009] Based on the business indicator data stream, target abnormal event detection is performed on the database cluster to obtain the detection results.

[0010] In a second aspect, an embodiment of the present application provides an abnormal event detection device, the device comprising:

[0011] An acquisition module, used to acquire a target abnormal event input by a user and a time window corresponding to the target abnormal event;

[0012] The acquisition module is also used to periodically acquire the performance indicator data of the database cluster within the time window with the time window as a period, and obtain the performance indicator data stream;

[0013] A calculation module, used to calculate the business indicator data based on the performance indicator data in the performance indicator data stream according to the calculation rules corresponding to the business indicator data, so as to obtain the business indicator data stream;

[0014] The detection module is used to detect target abnormal events on the database cluster based on the business indicator data stream and obtain the detection results.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, the device comprising: a processor and a memory storing computer program instructions;

[0016] When the processor executes the computer program instructions, the abnormal event detection method as shown in any one of the embodiments of the first aspect is implemented.

[0017] In a sixth aspect, an embodiment of the present application provides a computer storage medium having computer program instructions stored thereon, and when the computer program instructions are executed by a processor, the abnormal event detection method shown in any one of the embodiments of the first aspect is implemented.

[0018] In a seventh aspect, an embodiment of the present application provides a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the abnormal event detection method shown in any one of the embodiments of the first aspect.

[0019] The abnormal event detection method, device, equipment, medium and product provided in the embodiments of the present application can periodically obtain the performance indicator data of the database cluster within the time window with the time window as the period, obtain the performance indicator data stream, and then calculate the business indicator data based on the performance indicator data in the performance indicator data stream according to the calculation rules corresponding to the business indicator data, obtain the business indicator data stream, and then perform target abnormal event detection on the database cluster based on the business indicator data stream to obtain the detection result. In this way, the detection of user-defined abnormal events can be realized, rather than only the detection of abnormal events that have occurred, so the abnormal event detection of the database cluster can be performed more comprehensively. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0021] Figure 1 is a flow chart of an abnormal event detection method provided by an embodiment of the present application;

[0022] Figure 2 It is a schematic diagram of a state transition provided by an embodiment of the present application;

[0023] Figure 3 It is a structural diagram of an abnormal event detection system provided by an embodiment of the present application;

[0024] Figure 4 It is a structural schematic diagram of an abnormal event detection device provided by an embodiment of the present application;

[0025] Figure 5 It is a structural schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0026] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0027] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0028] The abnormal event detection method, device, equipment, medium and product provided in the embodiments of the present application are introduced one by one below.

[0029] Figure 1 A flow chart of an abnormal event detection method provided by an embodiment of the present application is shown. It should be noted that the execution subject of the abnormal event detection method may be an abnormal event detection device, such as Figure 1 As shown, the abnormal event detection method may include the following steps:

[0030] S110, obtaining a target abnormal event input by a user and a time window corresponding to the target abnormal event;

[0031] S120, periodically acquiring performance indicator data of the database cluster within the time window with the time window as a period, to obtain a performance indicator data stream;

[0032] S130, calculating the business indicator data based on the performance indicator data in the performance indicator data stream according to the calculation rule corresponding to the business indicator data, to obtain a business indicator data stream;

[0033] S140, based on the business indicator data stream, performing target abnormal event detection on the database cluster to obtain a detection result.

[0034] Therefore, the performance indicator data of the database cluster in the time window can be periodically obtained with the time window as the cycle to obtain the performance indicator data stream, and then the business indicator data can be calculated based on the performance indicator data in the performance indicator data stream according to the calculation rules corresponding to the business indicator data to obtain the business indicator data stream, and then the target abnormal event detection is performed on the database cluster based on the business indicator data stream to obtain the detection result. In this way, the detection of user-defined abnormal events can be realized, rather than only the detection of abnormal events that have occurred, so the abnormal event detection of the database cluster can be performed more comprehensively.

[0035] Regarding S110 , the target abnormal event and the time window may be user-defined, and may be input by the user or determined based on the user input.

[0036] The target abnormal event may include multiple simple abnormal events, and the target abnormal event may be a combination of multiple simple abnormal events.

[0037] The time window can be a time interval for collecting performance indicator data, such as 24 hours, and can also be used as a cycle for obtaining performance indicator data.

[0038] In some implementations, in order to facilitate obtaining the target abnormal event, the above-mentioned obtaining the target abnormal event input by the user may include:

[0039] Obtain multiple abnormal events input by the user and the creation time corresponding to the multiple abnormal events;

[0040] Generate an exception event queue based on multiple exception events and creation time;

[0041] The abnormal events are obtained from the abnormal event queue in sequence to obtain the target abnormal event.

[0042] Here, the abnormal event may be an event that indicates that an abnormality has occurred in the database cluster.

[0043] The abnormal event queue may include multiple abnormal events sorted from earliest to latest according to the creation time.

[0044] The creation time may be the moment when the abnormal event is created based on user input.

[0045] Specifically, multiple exception events defined by the user can be put into a queue in order from earliest to latest creation time to obtain an exception event queue, and then the exception events can be obtained from the exception event queue in sequence. In this way, it is possible to obtain exception events in order from earliest to latest creation time, and each exception event obtained can be used as a target exception event.

[0046] For example, a simple abnormal event set {E i}, i = 1, ..., N. Common simple abnormal events can be shown in Table 1. Determine multiple simple abnormal events that occur according to the business indicator data flow in the user-specified time window, sort the simple abnormal events that occur by occurrence time, and generate an abnormal event queue where j k ∈{1,...,N},k∈{1,...,K}, N is the number of elements in the simple exception event set, that is, the number of types of simple exception events, and K is the length of the exception event queue.

[0047] Table 1- Simple abnormal event table

[0048]

[0049] Among them, CPU stands for Central Processing Unit; cpu-check is CPU check, ram stands for random access memory; ram-check is RAM check; net-check is network check; disk-check is disk check; mysql is a relational database management system; redis is a memory data structure storage system.

[0050] In this way, through the above process, it is convenient to obtain abnormal events in chronological order, so as to facilitate the orderly detection of abnormal events.

[0051] In some implementations, in order to make abnormal event detection more in line with user needs, before obtaining the multiple abnormal events input by the user and the creation times corresponding to the multiple abnormal events, the method may further include:

[0052] Receive target input from the user;

[0053] In response to the target input, an exception event is generated.

[0054] Here, the target input can be used to configure an abnormal event. Each abnormal event in the abnormal event queue can be generated based on the target input.

[0055] Exemplarily, a user may combine multiple simple abnormal events to obtain an abnormal event. The target input may be an input combining multiple simple abnormal events.

[0056] Exemplarily, the data structure of the abnormal event can be designed to include at least one of abnormal event time (event_time), event object (event_object), event content (event_content), system version identifier (system_ver_id), component identifier (component_id), and event identifier (event_id). For example, the abnormal event data can be shown in Table 2.

[0057] Table 2- Abnormal event data table

[0058]

[0059] In this way, users can customize abnormal events, so that abnormal event detection can better meet user needs.

[0060] In some implementations, in order to more accurately define an abnormal event, the target input may include a user input using a regular expression-like method to describe the abnormal event.

[0061] Specifically, the target input may be a string sequence input by a user using a regular expression-like syntax, which is used to configure abnormal events so as to identify abnormal events in a business indicator data stream.

[0062] Exemplarily, the abnormal event P can be a string that conforms to the regular expression syntax. If P = A + B, it can mean that the simple abnormal event A occurs at least once, and the simple abnormal event B occurs once. If the simple abnormal event A indicates that the CPU usage rate exceeds 70%, and the simple abnormal event B indicates that the memory usage rate exceeds 90%, then P means that the event of the CPU usage rate exceeding 70% occurs at least once and the event of the memory usage rate exceeding 90% occurs once. Common declaration methods for the number of event occurrences can be shown in Table 3.

[0063] Table 3 - Event Occurrence Count Declaration Syntax

[0064] grammar meaning * 0 or more times + 1 time or more ？ 0 times or 1 time {n} Strictly n times (n>0) {n,} n times or more (n≥0) {n,m} Between n and m (inclusive) times (0≤n≤m, 0 <m) {,m} Between 0 and m (inclusion) (m>0)

[0065] Patterns that may produce empty matches are not supported, such as A*, which in the example above could mean that the event of CPU usage exceeding 70% occurred multiple times or not at all.

[0066] In this way, through regular expression-like, abnormal events can be defined more accurately.

[0067] In some examples, if the user sets the time window to 30 seconds, the user may define an abnormal event as: "CM{6,}", which means that the authentication database CPU load is high for three consecutive minutes (6 times).

[0068] Regarding S120 , the performance indicator data stream may be a data stream of performance indicator data sorted by time.

[0069] The performance indicator data may be performance data acquired by the database performance indicator monitoring module during the operation of the database cluster, such as CPU usage, memory usage, etc.

[0070] Exemplarily, if the time window is 30 seconds, the performance indicator data stream may be acquired every 30 seconds, and the acquired performance indicator data stream includes the performance indicator data within 30 seconds before the acquisition action is performed.

[0071] For example, Prometheus is used here to monitor the database cluster. Prometheus is a system monitoring and alarm system. Prometheus stores time series on the local hard disk in a custom format, and the PromQL language can be used to access and operate the data. For example, the following PromQL statement can be used to obtain the performance indicator data stream:

[0072] (sum(rate(container_cpu_usage_seconds_total{name!=",compInstId="zyrzxt_mysql_cluster"}[3m])) BY(compInstId)*100).

[0073] For example, if the performance indicator data is CPU usage, the acquired performance indicator data stream may be:

[0074] 15:14:59 50%mysql-cpu-usage

[0075] 15:14:59 26% redis-cpu-usage

[0076] …

[0077] 15:15:59 70%mysql-cpu-usage

[0078] 15:15:59 10% redis-cpu-usage.

[0079] Among them, mysql-cpu-usage is the CPU usage of the relational database management system; redis-cpu-usage is the CPU usage of the memory data structure storage system.

[0080] Regarding S130 , the business indicator data stream may be a data stream of business indicator data sorted by time.

[0081] The business indicator data can be the indicator data calculated based on the performance indicator data, and the calculation rule can be set according to actual needs. For example, if the performance indicator data is the CPU usage within 15 seconds, the business indicator data can be the average of the CPU usage within 15 seconds, and the calculation rule is the rule for calculating the average.

[0082] Exemplarily, the business indicator data may be discrete data at fixed time intervals (15s / 30s), which are large enough that it can be assumed that the event stream is sequential when received by the algorithm.

[0083] The business indicator data may include at least one of the system version identifier (system_ver_id), component identifier (component_id), abnormal event definition identifier (system_event_id), event object (event_object), indicator name (metric_name), indicator value (metric_value), and indicator occurrence time (event_happened_at). The indicator value of the business indicator data can be calculated using a language similar to the above-mentioned PromQL statement, and other items can be directly obtained using the PromQL language.

[0084] Exemplarily, the business indicator data may be as shown in Table 4.

[0085] Table 4-Business indicator data table

[0086]

[0087] In S140, a non-deterministic finite automatic (NFA) can be used to match the target abnormal event to obtain a detection result. The detection result can indicate whether the target abnormal event occurs in the database cluster.

[0088] In some implementations, in order to more accurately detect abnormal events, the target abnormal event may include multiple sub-events, and S140 may include:

[0089] Determining, based on a conversion function between first business indicator data in the business indicator data stream and states in the state set, that the database cluster is converted from an initial state to a first state;

[0090] Determining, based on the second business indicator data in the business indicator data stream and the conversion function, that the database cluster is converted from the first state to the second state;

[0091] If the second state is not an acceptable state, the first state is updated to the second state, the second business indicator data is updated to the third business indicator data in the business indicator data stream, and the step of returning to execute the step of determining the database cluster is converted from the first state to the second state based on the second business indicator data in the business indicator data stream and the conversion function;

[0092] When the second state is an acceptable state, it is determined that the detection result is that a target abnormal event occurs in the database cluster.

[0093] Here, the state set may include multiple states of the database cluster. The multiple states may include an initial state and states corresponding to multiple sub-events one by one. The multiple states may include acceptable states. The first state may be one of the multiple states included in the state set. The second state may be one of the multiple states included in the state set.

[0094] The sub-event may be the simple abnormal event mentioned above, and details thereof may be found above, which will not be described in detail here.

[0095] The transition of a database cluster to a certain state can indicate that a sub-event corresponding to the state has been triggered.

[0096] The acceptable state can be set according to actual needs. Specifically, at least one state in the state set can be set as an acceptable state according to actual needs. The conversion of the database cluster to an acceptable state can indicate that a target abnormal event occurs in the database cluster. The conversion of the database cluster to an unacceptable state can indicate that a sub-event corresponding to the unacceptable state occurs in the database cluster. The unacceptable state can be a state other than the acceptable state in the database cluster.

[0097] The conversion function can be understood as a calculation method for calculating the business indicator data and a state in the state set to obtain the next state.

[0098] The first business indicator data may be data in the business indicator data stream that can determine a sub-event corresponding to the first state of the database cluster. The second business indicator data may be data in the business indicator data stream that can determine a sub-event corresponding to the second state of the database cluster.

[0099] The second state is not an acceptable state, which may indicate that when the database cluster is converted to the second state, the target abnormal event has not occurred in the database cluster; the second state is an acceptable state, which may indicate that when the database cluster is converted to the second state, it can be determined that the target abnormal event has occurred in the database cluster.

[0100] Thus, through the above process, abnormal event detection can be performed more accurately.

[0101] In some implementations, to facilitate abnormal event detection, before determining that the database cluster is transitioned from the initial state to the first state based on the conversion function between the first business indicator data in the business indicator data stream and the states in the state set, the method may further include:

[0102] Build a state set based on multiple sub-events;

[0103] Based on the plurality of sub-events, transition functions between states in the set of states and acceptable states in the set of states are determined.

[0104] Here, in order to facilitate abnormal event detection, a state set can be pre-constructed, and a transition function and acceptable states can be pre-determined.

[0105] For example, a state set {S i}, i = 0, ..., M. The state set can be determined by the abnormal event input by the user, where S 0 It can be the initial state. For example, the user can enter the target abnormal event: E 1 +E 2 , the target abnormal event can be represented by E 1 Occurs at least once, E 2 Occurs once. Then the state set can be constructed as: S 1 Indicates E 1 The state when it occurs once; S 2 Indicates E 1 After the occurrence, E 2 The state when it occurs once. Then, the conversion function f can be determined. f can be understood as a calculation method for calculating the business indicator data and a state in the state set to obtain the next state. Figure 2 As shown, from the initial state S 0 Convert to S 1 Need to enter E 1 , from S 1 Go to S 1 Need to enter E 1 , from S 1 Go to S 2 , you need to enter E 2 .

[0106] The acceptable state set can be predetermined, and the acceptable state in the acceptable state set can be determined based on the multiple sub-events included in the target abnormal event. The acceptable state can be the state corresponding to the last sub-event in the multiple sub-events included in the target abnormal event. When switching to the acceptable state, it can be determined to be acceptable, that is, the target abnormal event occurs. In the above example, the acceptable state set can only include the acceptable state S 2 , when switching to S 2 When the target abnormal event occurs, it can be determined.

[0107] In this way, by pre-building a state set and determining the transition function and acceptable state, subsequent abnormal event detection can be facilitated.

[0108] In some implementations, in order to accurately determine the target state of the database cluster, the above-mentioned determination of the target state of the database cluster based on the business indicator data stream and multiple sub-events may include:

[0109] For each of the multiple sub-events, perform the following steps:

[0110] When a triggering sub-event is determined based on the business indicator data flow, the sub-event is input into the conversion function, and the target state of the database cluster is obtained as output.

[0111] Here, the business indicator data stream determines that the triggering sub-event may be that the business indicator data in the business indicator data stream meets the triggering condition of the sub-event.

[0112] For example, Figure 2 As shown, enter E 1 From the initial state S 0 Convert to S 1 , enter E 1 From S 1 Go to S 1 , enter E 2 From S 1 Go to S 2 .

[0113] In this way, the target state of the database cluster can be accurately determined based on the sub-events triggered by the business indicator data stream.

[0114] In the embodiments of the present application, based on user-defined abnormal events, the abnormal events can be matched or identified in the performance indicator data of a large number of database clusters, thereby solving the technical problems in the related art that the method based on the list of association relationships between abnormal performance indicator parameters and abnormal events can only detect simple abnormal events at a single moment, but cannot handle complex abnormal events that are a combination of multiple simple abnormal events in time series, and the method based on statistical learning and deep learning can only detect known abnormal event types in the training set, but cannot detect user-defined abnormal events.

[0115] In addition, in an embodiment of the present application, users are allowed to describe simple abnormal events using regular expression-like syntax to construct complex abnormal event patterns; and, the performance indicator data stream of the database cluster is converted into a business indicator data stream and filtered, which can effectively reduce memory usage and improve the efficiency of identifying abnormal events.

[0116] During the operation and maintenance of the database cluster, it is necessary to define the abnormal event mode according to the user, and quickly and accurately identify the abnormal event in the database cluster business indicator monitoring data stream. In this way, the user-specific abnormal event mode can be customized to effectively improve the efficiency of database cluster operation and maintenance.

[0117] Based on the same inventive concept, the present application embodiment also provides an abnormal event detection system. Figure 3 The abnormal event detection system provided in the embodiment of the present application is described in detail.

[0118] Figure 3 A structural schematic diagram of an abnormal event detection system provided by an embodiment of the present application is shown.

[0119] like Figure 3 As shown, the abnormal event detection system 300 may include: an abnormal event pattern grammar analysis module 301 , an abnormal event identification module 302 , a database cluster performance indicator monitoring module 303 and a business indicator calculation module 304 .

[0120] Among them, the abnormal event pattern syntax analysis module 301 can be used to analyze the abnormal events input by the user; the database cluster performance indicator monitoring module 303 can be used to obtain various performance indicator data of the database cluster; the business indicator calculation module 304 can be used to calculate the business indicator data based on the performance indicator data; the abnormal event identification module 302 can be used to identify abnormal events in the business indicator data stream based on the abnormal events and time windows input by the user.

[0121] Therefore, based on the time window input by the user, the performance indicator data stream of the database cluster can be obtained, and then the business indicator data stream can be determined based on the performance indicator data stream, and then based on the business indicator data stream, NFA can be used to detect whether the target abnormal event input by the user occurs in the database cluster. In this way, the detection of user-defined abnormal events can be realized, rather than only the abnormal events that have occurred, so abnormal event detection can be performed on the database cluster more comprehensively.

[0122] Based on the same inventive concept, the present application embodiment also provides an abnormal event detection device. Figure 4 The abnormal event detection device provided in the embodiment of the present application is described in detail.

[0123] Figure 4 A schematic structural diagram of an abnormal event detection device provided by an embodiment of the present application is shown.

[0124] like Figure 4 As shown, the abnormal event detection device may include:

[0125] An acquisition module 401 is used to acquire a target abnormal event input by a user and a time window corresponding to the target abnormal event;

[0126] The acquisition module 401 is further used to periodically acquire the performance indicator data of the database cluster within the time window with the time window as a period, and obtain a performance indicator data stream;

[0127] A calculation module 402 is used to calculate the business indicator data based on the performance indicator data in the performance indicator data stream according to the calculation rules corresponding to the business indicator data to obtain the business indicator data stream;

[0128] The detection module 403 is used to perform target abnormal event detection on the database cluster based on the business indicator data flow to obtain a detection result.

[0129] Therefore, the performance indicator data of the database cluster in the time window can be periodically obtained with the time window as the cycle to obtain the performance indicator data stream, and then the business indicator data can be calculated based on the performance indicator data in the performance indicator data stream according to the calculation rules corresponding to the business indicator data to obtain the business indicator data stream, and then the target abnormal event detection is performed on the database cluster based on the business indicator data stream to obtain the detection result. In this way, the detection of user-defined abnormal events can be realized, rather than only the detection of abnormal events that have occurred, so the abnormal event detection of the database cluster can be performed more comprehensively.

[0130] In some implementations, in order to more accurately detect abnormal events, the target abnormal event includes multiple sub-events, and the detection module 403 may include:

[0131] a determination submodule, configured to determine that the database cluster is converted from an initial state to a first state based on a conversion function between first business indicator data in the business indicator data stream and states in a state set, wherein the state set includes multiple states of the database cluster, the multiple states include an initial state and states corresponding to multiple sub-events one by one, the multiple states include an acceptable state, and the first state is one of the multiple states included in the state set;

[0132] The determination submodule is further used to determine that the database cluster is converted from the first state to the second state based on the second business indicator data in the business indicator data stream and the conversion function, where the second state is one of the multiple states included in the state set;

[0133] An update submodule, configured to update the first state to the second state, update the second business indicator data to the third business indicator data in the business indicator data stream, and return to execute the step of determining the database cluster is converted from the first state to the second state based on the second business indicator data in the business indicator data stream and the conversion function, if the second state is not an acceptable state;

[0134] The determination submodule is further configured to determine, when the second state is an acceptable state, that the detection result is that a target abnormal event occurs in the database cluster.

[0135] In some embodiments, in order to facilitate abnormal event detection, the device may further include:

[0136] A construction module, configured to construct a state set based on a plurality of sub-events before determining that the database cluster is converted from an initial state to a first state based on a conversion function between first business indicator data in the business indicator data stream and states in the state set;

[0137] The determination module is further used to determine the transition functions between states in the state set and the acceptable states in the state set based on the multiple sub-events.

[0138] In some implementations, in order to facilitate acquisition of target abnormal events, the acquisition module 401 may include:

[0139] The acquisition submodule is used to acquire multiple abnormal events input by the user and the creation time corresponding to the multiple abnormal events;

[0140] A generation submodule, used to generate an abnormal event queue based on multiple abnormal events and creation time, wherein the abnormal event queue includes multiple abnormal events sorted from early to late according to creation time;

[0141] The acquisition submodule is also used to sequentially acquire abnormal events from the abnormal event queue to obtain target abnormal events.

[0142] In some embodiments, in order to make abnormal event detection more in line with user needs, the device may further include:

[0143] A receiving module, used for receiving a target input from a user before obtaining a plurality of abnormal events and creation times respectively corresponding to the plurality of abnormal events input by the user, wherein the target input is used for configuring the abnormal event;

[0144] The generating module is used to generate an abnormal event in response to a target input.

[0145] In some implementations, in order to more accurately define an abnormal event, the target input includes a user input using a regular expression-like method to describe the abnormal event.

[0146] Figure 5 A schematic structural diagram of an electronic device provided by an embodiment of the present application is shown.

[0147] like Figure 5 As shown, the electronic device 5 is a structural diagram of an exemplary hardware architecture of an electronic device that can implement the abnormal event detection method and device in the embodiment of the present application. The electronic device can refer to the electronic device in the embodiment of the present application.

[0148] The electronic device 5 may include a processor 501 and a memory 502 storing computer program instructions.

[0149] Specifically, the processor 501 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0150] The memory 502 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 502 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 502 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 502 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 502 is a non-volatile solid-state memory. In a specific embodiment, the memory 502 may include a read-only memory (ROM), a random access memory (RAM), a disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical, or other physical / tangible memory storage device. Therefore, typically, the memory 502 includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of the present application.

[0151] The processor 501 implements any one of the abnormal event detection methods in the above embodiments by reading and executing computer program instructions stored in the memory 502 .

[0152] In one example, the electronic device may further include a communication interface 503 and a bus 504. Figure 5 As shown, the processor 501, the memory 502, and the communication interface 503 are connected via a bus 504 and communicate with each other.

[0153] The communication interface 503 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0154] Bus 504 includes hardware, software or both, and the parts of electronic equipment are coupled to each other.For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 504 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0155] The electronic device can execute the abnormal event detection method in the embodiment of the present application, thereby realizing the combination Figures 1 to 4 The invention describes a method and device for detecting abnormal events.

[0156] In addition, in combination with the abnormal event detection method in the above embodiment, the embodiment of the present application can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by the processor, any abnormal event detection method in the above embodiment is implemented.

[0157] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0158] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0159] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0160] The above reference is according to the method of the embodiment of the present application, the flow chart of the device (system) and the computer program product and / or the block diagram described various aspects of the present application.It should be understood that each square box in the flow chart and / or the block diagram and the combination of each square box in the flow chart and / or the block diagram can be realized by computer program instructions.These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the realization of the function / action specified in one or more square boxes of the flow chart and / or the block diagram.Such a processor can be but is not limited to a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit.It can also be understood that each square box in the block diagram and / or the flow chart and the combination of the square boxes in the block diagram and / or the flow chart can also be realized by the dedicated hardware that performs the specified function or action, or can be realized by the combination of dedicated hardware and computer instructions.

[0161] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A method for detecting abnormal events, characterized in that: include: Obtain a target abnormal event input by a user and a time window corresponding to the target abnormal event; Taking the time window as a period, periodically acquiring performance indicator data of the database cluster within the time window to obtain a performance indicator data stream; Calculating the business indicator data based on the performance indicator data in the performance indicator data stream according to the calculation rules corresponding to the business indicator data to obtain a business indicator data stream; Based on the business indicator data stream, target abnormal event detection is performed on the database cluster to obtain a detection result.

2. The method according to claim 1, characterized in that The target abnormal event includes multiple sub-events. The target abnormal event detection is performed on the database cluster based on the business indicator data stream to obtain a detection result, including: Determining that the database cluster is converted from an initial state to a first state based on a conversion function between first business indicator data in the business indicator data stream and states in a state set, wherein the state set includes multiple states of the database cluster, the multiple states include the initial state and states corresponding to the multiple sub-events one by one, the multiple states include an acceptable state, and the first state is one of the multiple states included in the state set; Based on the second business indicator data in the business indicator data stream and the conversion function, determining that the database cluster is converted from the first state to a second state, where the second state is one of multiple states included in the state set; If the second state is not the acceptable state, updating the first state to the second state, updating the second business indicator data to the third business indicator data in the business indicator data stream, and returning to execute the step of determining that the database cluster is converted from the first state to the second state based on the second business indicator data in the business indicator data stream and the conversion function; When the second state is the acceptable state, it is determined that the detection result is that the target abnormal event occurs in the database cluster.

3. The method according to claim 2, characterized in that Before determining that the database cluster is converted from the initial state to the first state based on the conversion function between the first business indicator data in the business indicator data stream and the states in the state set, the method further includes: Building a state set based on the multiple sub-events; Based on the plurality of sub-events, transition functions between states in the set of states and acceptable states in the set of states are determined.

4. The method according to claim 1, characterized in that: The step of obtaining a target abnormal event input by a user includes: Acquire multiple abnormal events input by the user and the creation times corresponding to the multiple abnormal events respectively; generating an abnormal event queue based on the multiple abnormal events and the creation time, wherein the abnormal event queue includes the multiple abnormal events sorted from early to late according to the creation time; Abnormal events are acquired in sequence from the abnormal event queue to obtain the target abnormal event.

5. The method according to claim 4, characterized in that Before obtaining the multiple abnormal events input by the user and the creation times respectively corresponding to the multiple abnormal events, the method further includes: Receive a target input from a user, where the target input is used to configure an abnormal event; In response to the target input, the abnormal event is generated.

6. The method according to claim 5, characterized in that The target input includes input by a user using a regular expression-like method to describe an abnormal event.

7. An abnormal event detection device, characterized in that: include: An acquisition module, used to acquire a target abnormal event input by a user and a time window corresponding to the target abnormal event; The acquisition module is further used to periodically acquire the performance indicator data of the database cluster within the time window with the time window as a period to obtain a performance indicator data stream; A calculation module, configured to calculate the business indicator data based on the performance indicator data in the performance indicator data stream according to a calculation rule corresponding to the business indicator data, so as to obtain a business indicator data stream; The detection module is used to perform target abnormal event detection on the database cluster based on the business indicator data stream to obtain a detection result.

8. An electronic device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the abnormal event detection method according to any one of claims 1 to 6 is implemented.

9. A computer storage medium, characterized in that The computer storage medium stores computer program instructions, and when the computer program instructions are executed by the processor, the abnormal event detection method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the abnormal event detection method as described in any one of claims 1 to 6.

Images