Workstation data monitoring method based on Windows system

Abstract

A workstation data monitoring method based on a Windows system belongs to the field of digital cluster wireless communication equipment and comprises the following steps: a data acquisition module acquires basic performance data and detailed process information of workstation equipment periodically; the data processing module is used for integrating the collected data and distributing the data to the alarm module for processing; the alarm module is used for judging the integrated data based on a preset threshold value and a rule algorithm, and giving out multi-level alarms in time when an abnormal condition is found; according to the record storage module, the monitoring system carries out local and network storage and backup on all collected data, alarms, generated reports and system logs; the interface display module is used for providing detailed reports such as data analysis, trend prediction and correlation analysis for a user according to comparison between real-time data and historical data when the user visually sees the current condition and all alarms of the equipment through an interface; through the above steps, comprehensive monitoring and management of the workstation performance are realized.

Description

Technical Field

[0001] The present invention relates to the field of digital cluster wireless communication equipment, and in particular to a workstation data monitoring method based on Windows system, which is used for performance index monitoring of workstation computer servers, and an external expansion interface can provide data reporting for network management type software. Background Art

[0002] In a network management system (NMS), it is essential to fully monitor the performance data of all devices in the network. Traditional remote query methods usually rely on WMI, however, this method faces significant challenges when deployed on a large scale. Although WMI queries can obtain detailed system information, they often occupy a large amount of network resources, resulting in increased pressure on network bandwidth. In addition, the speed of WMI queries is relatively slow and cannot meet the needs of real-time performance monitoring. Summary of the invention

[0003] In view of the existing technology that uses WMI for remote query when monitoring the performance of devices in a network, there are problems such as large network resource usage and slow query speed, the present invention provides a workstation data monitoring method based on the Windows system, which can achieve more efficient equipment performance data management.

[0004] The technical solution adopted by the present invention to achieve the above purpose is a workstation data monitoring method based on Windows system, with a server as a carrier, and the specific steps are as follows: The first step is the data collection module: collect basic performance data and detailed process information of workstation equipment on a periodic basis; The second step is the data processing module: the collected data is integrated and distributed to the alarm module for processing; The third step is the alarm module: the integrated data is judged based on preset thresholds and rules, and multi-level alarms are issued in time when abnormal situations are found; Step 4: Recording and storage module: The monitoring system software stores and backs up all collected data, alarms, generated reports, and system logs locally and over the network; Step 5: Interface display module: Users can intuitively see the current status of the equipment and all alarms through the interface. Based on the comparison of real-time data and historical data, the interface provides users with detailed reports on data analysis, trend prediction, and correlation analysis. Step 6, External interface module: This software supports API external interface and supports forwarding the collected data to the target IP in the form of JSON string; Through the above steps, comprehensive monitoring and management of workstation performance is achieved.

[0005] The method of the data acquisition module described in the first step is: the monitoring system software obtains the CPU usage, hard disk usage, memory usage, power status, fan status, network bandwidth usage, and system temperature information of the workstation in real time by using the Performance Counters interface and system API call of the Windows operating system; obtains detailed information of all processes in the workstation through Task Scheduler and Process Monitor tools, including process PID, process port, process path, memory usage, CPU usage, and running time, and supports real-time tracking of newly started and ended processes.

[0006] The method of the data processing module in the second step is: the monitoring system software uses the device IP and thread name as the main classification features, classifies and integrates the acquired data, updates the cache and packages the new data and distributes it to the alarm module for further processing.

[0007] The method of the alarm module in the third step is: the monitoring system software generates general, important and severe alarms for data with actual values ​​by setting multiple performance thresholds, and uses rules to judge trend alarms: search the process list to see if the memory occupied by the software continues to increase over a period of time. If so, it is judged as a memory leak otherwise it is normal; whether the system's read and write wait ratio in the past period of time is greater than the threshold. If it is greater than the threshold, it is judged as a hard disk I / O bottleneck otherwise it is normal; based on real-time analysis of the collected data, abnormal patterns are automatically identified, and graded alarms are issued to users by email, text message, and system notification.

[0008] The method for recording and storing the module in the fourth step is: the monitoring system software automatically generates a performance report containing basic performance indicators of the workstation, process information, system logs, and abnormal event analysis according to the time period set by the user or the alarm trigger, and supports PDF, HTML, and Excel formats for output to a folder. The folder is classified by device name / / date / / hour / / type, and the types are general alarm, important alarm, serious alarm, and performance report; and a distributed database is used for large-scale data management, with automatic data archiving, redundant storage, and recovery testing functions.

[0009] The method of the interface display module in the fifth step is: the monitoring system software presents all the collected data on the interface, and the user can intuitively see the status outline and performance trends of all current devices. Click on the device details to see all the current alarms and real-time performance parameters of the device, and set the alarm thresholds for each performance; query the historical data of the device through filters; set the database address for system storage data, set the time period for local storage, and set the external API interface.

[0010] The method of the external interface module in the sixth step is: the software provides an API interface, and by configuring the port of the northbound interface, the software acts as a server to automatically package the collected real-time data and send it to any IP connected to this port.

[0011] The beneficial effects of the present invention are as follows: the present invention solves the problems of large resource usage and slow query speed in performance monitoring of traditional network management systems. By collecting and processing data locally on a workstation, the system software achieves more efficient equipment performance data management. Traditional software relies on WMI for remote query, resulting in low monitoring efficiency, especially when the network is unstable or disconnected, it is impossible to maintain continuous data monitoring, affecting the accuracy and timeliness of equipment management.

[0012] The system software of the present invention can still be used as an independent performance monitoring plug-in even when it is not connected to the network management system, ensuring that the device status information is presented in real time. When the system software is connected to the network management system, it can automatically upload the locally collected data without complicated operations or equipment changes, greatly improving the convenience of operation and system adaptability. Through the present invention, the device management and monitoring process is simplified, and the independence and overall efficiency of the system are significantly improved.

[0013] The system software uses local data collection to directly collect and package various performance data on the workstation. The user interface intuitively displays the local performance indicators, such as CPU usage, hard disk usage, memory usage, power status, fan status, and detailed information of the process (such as process PID, host name, host IP, process port, process path, process type, etc.). In addition, the system software supports the opening of external interfaces, and when the connection with the network management system is detected, the collected data will be automatically sent. This method improves the efficiency of performance monitoring, reduces network resource consumption, and ensures the timeliness and accuracy of data collection. Through integration with the network management system, the system software realizes centralized recording and monitoring, and enhances network management capabilities and system stability.

[0014] The system software can not only comprehensively monitor and collect the basic performance indicators and operating status of the workstation, but also provide detailed process information and system work logs. The background uses JSON format to pass data to other systems through the API interface for corresponding processing and recording. Compared with manual operation, this system software is more integrated and standardized, which helps to optimize system operation and improve work efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a system software architecture diagram of the present invention; Figure 2 is a performance monitoring flow chart of the present invention; Figure 3is a data processing flow chart of the present invention; Figure 4 A flowchart of the present invention for judging the alarm threshold and sending an alarm to a user; Figure 5 It is a data storage flow chart of the present invention; Figure 6 It is an interface display diagram of the present invention; Figure 7 The data packaging and uploading flow chart of the present invention. DETAILED DESCRIPTION

[0016] like Figure 1 As shown in the figure, the system software includes the following main modules: data acquisition module, data processing module, alarm module, record storage module, interface display module and external interface module. The data acquisition module is responsible for obtaining performance data and process list from the monitored equipment; the data processing module packages and classifies the collected data; the alarm module determines whether to trigger an alarm based on the preset thresholds and rules; the record storage module is responsible for storing real-time data and alarm data in the cloud and locally; the interface display module displays data, alarms and trends to users and allows users to modify thresholds and some interface parameters; the external interface module is responsible for packaging the collected data and sending it to the IP port that the user needs to transmit.

[0017] like Figure 2 As shown, the performance monitoring process of the present invention is described. The data acquisition module uses two different methods to periodically collect server performance health data from each device: CPU occupancy, hard disk occupancy, fan status, memory occupancy, CPU temperature and power status; obtains all process information: process PID, path of the process main module, memory occupancy, memory occupancy, process detailed name, and memory occupancy sorting.

[0018] like Figure 3 As shown, the data processing flow of the present invention is described. After the data acquisition module obtains the data, it is stored in the buffer. After the data processing module detects that there is data in the buffer, it starts to determine which device the data belongs to based on the IP. If there is no such IP in the cached device list, it means that this is a newly added device. The processing module will create a new device to analyze, record and store the data sent by this IP in the future. If this device exists in the cache, the cache is updated according to the data parameter name.

[0019] like Figure 4As shown, the alarm process of the present invention is described. After the data processing module updates the data, the alarm module starts to judge. The system software first checks whether there are performance indicators that exceed the preset alarm threshold. Secondly, the system software will make trend judgments based on historical data to detect whether there are problems such as memory overflow and hard disk I / O bottleneck. If there are such situations, the alarm module will generate an alarm message. If the data of the alarm item is restored to below the safety threshold, the alarm will be cleared, and the alarm or recovery information will be sent to the customer and presented in the interface.

[0020] like Figure 5 As shown, the data saving flow chart of the present invention is described. First, it is necessary to determine whether the device is recording for the first time. If so, it is recorded as initial data. If initial data already exists, the change value of this data is compared with the previous data. If it is just a slight fluctuation of 3% up and down, it is regarded as a stable normal fluctuation and does not need to be recorded. Only when an alarm is generated or restored, and when the recording cycle is reached, it will be recorded in the cloud and local folders. When recording locally, first check whether the directory contains a folder with the specified file name. If there is no directory and folder, the software will create it by itself before recording.

[0021] like Figure 6 As shown, the modules included in the system software interface of the present invention are described. Users can adjust monitoring parameters and view detailed information through an interactive graphical interface. Clicking on any device in the device status overview will display the performance trend of the device. Clicking on the device details will show all the current alarm details and real-time performance parameters of the device. The alarm threshold for each performance can be set; historical data records of the device can be queried through filters; the database address for system storage data, the time period for local storage, and the external API interface can be set to view current performance data and historical records.

[0022] like Figure 7 As shown, it is a data packing and uploading flow chart of the present invention, which describes the external interface sending and receiving process of the present invention. As a server, it often listens to port 4649. If an IP connected is detected, a sessionid is assigned to the IP and added to the TCPClient list as the client information. The software will continue to scan the TCPClient list and send the collected data to each client in a broadcast form. If the connection is disconnected, the relevant information in the list is cleared to release the cache. The next time the IP is connected, a new sessionid will be assigned.

[0023] Example 1, this example describes the practical application of the present invention in a network management system, taking the application in a network performance monitoring system within an enterprise as an example. The system needs to perform real-time performance monitoring on multiple key devices and issue alarm information in a timely manner when performance anomalies are detected to ensure stable operation of the network.

[0024] Step 1: Data Acquisition Module: like Figure 2 As shown, the following performance data is obtained from the core device server through the data acquisition module in a cycle of 5 seconds: CPU usage is 20%, memory usage is 46%, hard disk usage is 3%, fan status is normal, power status is normal, CPU temperature is 41°C; the information of the top 5 processes sorted by memory usage is as follows:

[0025] Step 2: Data processing module: After data collection is completed, the data is transmitted to the data processing module, which processes and classifies the collected performance data. Figure 3 As shown, the data processing module will determine which device the data belongs to, and if the device does not exist, a new device will be created. Each data is compared with the preset performance threshold to generate a corresponding performance indicator report.

[0026] For example, the device IP list in the cache includes: 192.168.7.18, 10.168.2.231, 10.51.66.14. The server IP: 10.168.2.231, the device exists in the system software, and the performance data is updated according to the data name.

[0027] Step 3: Alarm module: like Figure 4 As shown in the figure, when the alarm module detects that any performance indicator exceeds the preset alarm threshold, the alarm module generates an alarm message according to different alarm levels. When the alarm module detects that the new value of the existing alarm item is restored to below the threshold, the alarm module will generate an alarm message. The information will then be sent to the relevant person in charge. The alarm information can be sent in the form of email, SMS or system notification, and the content includes device name, abnormal indicator, detection time, etc.

[0028] For example, at 13:45 on a certain day, the software detected that the CPU temperature of this network management server exceeded the set temperature threshold. The alarm module generated an important alarm message, which read: "The current CPU temperature of network management server A exceeds the threshold, please check". If the current temperature exceeds the safe operation threshold, a serious alarm message will be generated, which read: "The current CPU temperature of network management server A exceeds the safe threshold, please check immediately". Subsequently, the software detected that the memory usage of Clash forWindows.exe software on the server has been increasing in the past 30 minutes, and a serious alarm message will be generated, which read: "The software Clash for Windows.exe currently running on network management server A may have a memory leak problem, please check immediately". The above message is then sent to the network administrator via email.

[0029] Step 5: Record the storage module: like Figure 5 As shown in the figure, the data storage module saves all the collected performance data and alarm records to the database and local files. In order to prevent too much invalid data, a segmented recording and event triggering mechanism is adopted. Recording is performed when the data fluctuates more than 3% above or below the previous data or when the recording cycle specified by the user is reached.

[0030] For example, if the user sets the recording cycle to record once every minute, and the software's collection cycle is to collect all parameters once every 10 seconds, the CPU usage collected at the 1st second is 5%, and the CPU usage collected at the 11th second is 6%, which does not fluctuate more than 3% compared with the previous data, so no record is made for this collection. The CPU usage collected at the 21st second is 15%, which fluctuates more than 3% compared with the previous data, so a record is made for this collection. The CPU usage collected at the 31st second is 5%, which fluctuates more than 3% compared with the previous data, so a record is made for this collection. The CPU usage collected at the 41st second is 6%, which fluctuates no more than 3% compared with the previous data, so a record is made for this collection. The CPU usage collected at the 51st second is 6%, which fluctuates no more than 3% compared with the previous data, so a record is made for this collection. The CPU usage collected at the 61st second is 6%, and the recording cycle is reached, so a record is made for this collection.

[0031] Step 6: Interface Display Module: like Figure 6 As shown, users can directly access the system software interface to view real-time performance data and historical records. The content displayed on the interface includes the status of each device, alarm records, and the overall situation of system operation. Users can view the performance history curve of specific devices through the interactive graphical interface and adjust monitoring parameters as needed.

[0032] For example, a user sees an alarm about high memory usage on server A on the system software interface. The user can view the memory usage history curve chart of server A and the top five processes in terms of memory usage to determine whether it is necessary to shut down unnecessary processes or maintain the device.

[0033] Step 7: External Interface Module: like Figure 7 As shown, the system software includes an external interface, and the system software often monitors the port, allowing the external system to receive real-time data information through the interface. The external system can receive the data sent by the system software by establishing a TCP connection.

[0034] For example, the enterprise's IT management platform needs to collect data from all devices in the entire computer room. After enabling the external interface of this system software, the IT management platform can be used as a client to connect to the port monitored by this system software. After the connection is established, this system software automatically sends all device information to the IT management platform in the form of a JSON string. The IT management platform then presents or collects data based on demand, realizing cross-platform linkage.

[0035] Through the above steps, the present invention realizes comprehensive monitoring and alarm notification of enterprise internal network equipment, ensuring the stability and efficient operation of the system. This embodiment demonstrates the specific application of the present invention in an actual network environment, and describes in detail the workflow and functions of each module.

Claims

1. A workstation data monitoring method based on Windows system, characterized in that: Using the server as the carrier, the specific steps are as follows: The first step is the data collection module: collect basic performance data and detailed process information of workstation equipment on a periodic basis; The second step is the data processing module: the collected data is integrated and distributed to the alarm module for processing; The third step is the alarm module: the integrated data is judged based on preset thresholds and rules, and multi-level alarms are issued in time when abnormal situations are found; Step 4: Recording and storage module: The monitoring system software stores and backs up all collected data, alarms, generated reports, and system logs locally and over the network; Step 5: Interface display module: Users can intuitively see the current status of the equipment and all alarms through the interface. Based on the comparison of real-time data and historical data, the interface provides users with detailed reports on data analysis, trend prediction, and correlation analysis. Step 6, External interface module: This software supports API external interface and supports forwarding the collected data to the target IP in the form of JSON string; Through the above steps, comprehensive monitoring and management of workstation performance is achieved.

2. The Windows-based workstation data monitoring method according to claim 1, characterized in that: The method of the data acquisition module described in the first step is: the monitoring system software obtains the CPU usage, hard disk usage, memory usage, power status, fan status, network bandwidth occupancy, and system temperature information of the workstation in real time by using the PerformanceCounters interface and system API call of the Windows operating system; obtains detailed information of all processes in the workstation through Task Scheduler and ProcessMonitor tools, including process PID, process port, process path, memory occupancy, CPU occupancy and running time, and supports real-time tracking of newly started and ended processes.

3. The Windows-based workstation data monitoring method according to claim 1, characterized in that: The method of the data processing module in the second step is: the monitoring system software uses the device IP and thread name as the main classification features, classifies and integrates the acquired data, updates the cache and packages the new data and distributes it to the alarm module for further processing.

4. The Windows-based workstation data monitoring method according to claim 1, characterized in that: The method of the alarm module in the third step is: the monitoring system software generates general, important and severe alarms for data with actual values ​​by setting multiple performance thresholds, and uses rules to judge trend alarms: search the process list to see if the memory occupied by the software continues to increase over a period of time. If so, it is judged as a memory leak otherwise it is normal; whether the system's read and write wait ratio in the past period of time is greater than the threshold. If it is greater than the threshold, it is judged as a hard disk I / O bottleneck otherwise it is normal; based on real-time analysis of the collected data, abnormal patterns are automatically identified, and graded alarms are issued to users by email, text message, and system notification.

5. The Windows-based workstation data monitoring method according to claim 1, characterized in that: The method for recording and storing the module in the fourth step is: the monitoring system software automatically generates a performance report containing basic performance indicators of the workstation, process information, system logs, and abnormal event analysis according to the time period set by the user or the alarm trigger, and supports PDF, HTML, and Excel formats for output to a folder. The folder is classified by device name / / date / / hour / / type, and the types are general alarm, important alarm, serious alarm, and performance report; and a distributed database is used for large-scale data management, with automatic data archiving, redundant storage, and recovery testing functions.

6. The Windows-based workstation data monitoring method according to claim 1, characterized in that: The method of the interface display module in the fifth step is: the monitoring system software presents all the collected data on the interface, and the user can intuitively see the status outline and performance trend of all current devices, click on the device details to see all the current alarms and real-time performance parameters of the device, and set the alarm threshold of each performance; Use filters to query the historical data of the device; set the database address for system data storage, set the time period for local storage, and set the external API interface.

7. The Windows-based workstation data monitoring method according to claim 1, characterized in that: The method of the external interface module in the sixth step is: the software provides an API interface, and by configuring the port of the northbound interface, the software acts as a server to automatically package the collected real-time data and send it to any IP connected to this port.

Images