Method and device for monitoring system operation, electronic equipment and storage medium

Abstract

The invention provides a method and a device for monitoring system operation, electronic equipment and a storage medium, and belongs to the technical field of software development, the method comprises the following steps: learning a normal operation mode and an abnormal feature of a system through log files of a plurality of equipment based on a plurality of abnormal detection algorithms; obtaining a data processing model for determining abnormal information of the log file; when the operation state of the to-be-tested system needs to be determined, obtaining a log file generated in the operation process of the to-be-tested system; and performing anomaly detection on the log file of the to-be-detected system through the data processing model to obtain an anomaly detection result of the to-be-detected system. Through the scheme, the data processing model is constructed, so that the process of monitoring the running state of the to-be-tested system can be intelligent and automatic, the accuracy and timeliness of monitoring the running state of the system are improved, manual intervention is not needed, the workload of operation and maintenance personnel is reduced, and the operation and maintenance efficiency and response speed are improved.

Description

Technical Field

[0001] The present application belongs to the field of software development technology, and in particular, relates to a method, device, electronic device and storage medium for monitoring system operation. Background Art

[0002] In the current system development and operation and maintenance process, log files are important records of system operation status, and log files generally include information such as system operations, user behaviors, and security events. Therefore, analyzing log files plays an important role in the software development and operation and maintenance process.

[0003] In the related art, log files are generally analyzed by manual inspection or simple keyword matching. However, with the development of cloud computing and big data technology, the scale and complexity of log files are increasing. Traditional log analysis methods are difficult to cope with large-scale data volumes and complex log files, resulting in problems such as untimely system monitoring response and high false alarm rate. Summary of the invention

[0004] The purpose of the present application is to provide a method, device, electronic device and storage medium for monitoring system operation, aiming to solve the problems of untimely response and high false alarm rate of traditional system monitoring.

[0005] A first aspect of an embodiment of the present application provides a method for controlling system operation, the method comprising:

[0006] Based on multiple anomaly detection algorithms, the normal operation mode and abnormal characteristics of the system are learned through the log files of multiple devices, and a data processing model for determining the abnormal information of the log files is obtained;

[0007] When it is necessary to determine the operating status of the system under test, obtain the log files generated during the operation of the system under test;

[0008] By using the data processing model, anomaly detection is performed on the log file of the system to be tested to obtain an anomaly detection result of the system to be tested.

[0009] In some embodiments, performing anomaly detection on the log file of the system under test by using the data processing model to obtain anomaly detection results of the system under test includes:

[0010] Based on the data processing model, anomaly detection is performed on the log files of the system to be tested to obtain log files with abnormal detection results;

[0011] Determining an anomaly detection threshold based on historical data and the current state of the system to be tested;

[0012] When the number of log files with abnormal detection results is greater than the abnormal detection threshold within a preset time period, it is determined that the system to be tested is operating abnormally.

[0013] In some embodiments, the method further comprises:

[0014] When the abnormality detection result indicates that the operation of the system to be tested is abnormal, classifying the log files with abnormal detection results to obtain the abnormal event category of the system to be tested;

[0015] Determining a preset strategy based on the abnormal event category;

[0016] Based on the preset strategy, the system to be tested is adjusted.

[0017] In some embodiments, the method further comprises:

[0018] When the abnormality detection result indicates that the operation of the system to be tested is abnormal, determining the severity and category of the abnormal event corresponding to the abnormality detection result;

[0019] Generate alarm information based on the severity and category of the abnormal event;

[0020] The alarm information is sent to the user.

[0021] In some embodiments, generating alarm information based on the severity and category of the abnormal event includes:

[0022] Determine an alarm level based on the severity of the abnormal event;

[0023] Based on the category of the abnormal event, determine a target group of users to be alerted;

[0024] Based on the alarm level and the grouping, generating the alarm information;

[0025] Accordingly, the sending of the alarm information to the user includes:

[0026] Sending alarm information corresponding to the alarm level to users in the target group.

[0027] In some embodiments, the method of learning the normal operation mode and abnormal characteristics of the system through the log files of multiple devices based on multiple anomaly detection algorithms to obtain a data processing model for determining abnormal information of the log files includes:

[0028] Pre-process the collected log files of multiple systems;

[0029] Use a variety of anomaly detection algorithms to extract information from preprocessed log files to obtain key information of log files;

[0030] Based on the normal operation mode and abnormal information of the key information learning system, the data processing model for determining the abnormal information of the log file is obtained.

[0031] In some embodiments, the preprocessing of the collected log files of the multiple systems includes:

[0032] Deleting redundant and invalid log files from the log files of the multiple systems to obtain valid log files;

[0033] Extract key fields from the valid log file;

[0034] The target data structure is adopted to convert the key fields into structured data.

[0035] A second aspect of an embodiment of the present application provides a device for monitoring system operation, the device comprising:

[0036] A modeling unit, configured to learn the normal operation mode and abnormal characteristics of the system through log files of multiple devices based on multiple abnormality detection algorithms, and obtain a data processing model for determining abnormal information of the log files;

[0037] An acquisition unit, used to acquire a log file generated during the operation of the system under test when the operation status of the system under test needs to be determined;

[0038] The anomaly detection unit is used to perform anomaly detection on the log file of the system under test through the data processing model to obtain anomaly detection results of the system under test.

[0039] In some embodiments, the anomaly detection unit is used to perform anomaly detection on the log files of the system under test based on the data processing model to obtain log files with abnormal detection results; determine an anomaly detection threshold based on historical data and the current state of the system under test; when the number of log files with abnormal detection results is greater than the anomaly detection threshold within a preset time period, it is determined that the system under test is operating abnormally.

[0040] In some embodiments, the apparatus further comprises:

[0041] A classification unit, configured to classify the log files with abnormal detection results to obtain the abnormal event category of the system under test when the abnormal detection result indicates that the system under test is running abnormally;

[0042] A first determining unit, configured to determine a preset strategy based on the abnormal event category;

[0043] An adjustment unit is used to adjust the system to be tested based on the preset strategy.

[0044] In some embodiments, the apparatus further comprises:

[0045] A second determination unit is used to determine the severity and category of the abnormal event corresponding to the abnormal detection result when the abnormal detection result indicates that the operation of the system under test is abnormal;

[0046] An alarm unit, configured to generate an alarm message based on the severity and category of the abnormal event;

[0047] The sending unit is used to send the alarm information to the user.

[0048] In some embodiments, the alarm unit is used to determine an alarm level based on the severity of the abnormal event; determine a target group of users to be alarmed based on the category of the abnormal event; and generate the alarm information based on the alarm level and the group;

[0049] The sending unit is used to send the alarm information corresponding to the alarm level to the users in the target group.

[0050] In some embodiments, the modeling unit is used to preprocess the collected log files of multiple systems; extract information from the preprocessed log files through multiple anomaly detection algorithms to obtain key information of the log files; and learn the normal operation mode and abnormal information of the system based on the key information to obtain the data processing model for determining the abnormal information of the log files.

[0051] In some embodiments, the modeling unit is used to delete redundant and invalid log files from the log files of the multiple systems to obtain valid log files; extract key fields from the valid log files; and use a target data structure to convert the key fields into structured data.

[0052] A third aspect of an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method for monitoring system operation as described above when executing the computer program.

[0053] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for monitoring system operation as described above is implemented.

[0054] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0055] In an embodiment of the present application, by introducing machine learning and deep learning, normal operating modes and abnormal features are learned from a large amount of data, so that the data processing model has the ability to identify abnormal problems, and thus by modeling multiple detection algorithms, a data processing model for identifying abnormal information in log files is obtained. When it is necessary to detect the operating status of the system to be tested, it is only necessary to input the log files generated during the operation of the system to be tested into the data processing model, and through the data processing model, the log files are detected for abnormalities to obtain the abnormal detection results of the system to be tested. In this way, by constructing a data processing model, the process of monitoring the operating status of the system to be tested can be intelligent and automated, thereby improving the accuracy and timeliness of the monitoring system's operating status, and without the need for manual intervention, reducing the workload of operation and maintenance personnel, and improving operation and maintenance efficiency and response speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 A schematic diagram of a system involved in a method for monitoring system operation provided by an exemplary embodiment is shown;

[0057] Figure 2 A schematic diagram showing functional modules of an electronic device provided by an exemplary embodiment is shown;

[0058] Figure 3 A schematic flow chart of a method for monitoring system operation provided by an exemplary embodiment is shown;

[0059] Figure 4 A schematic flow chart of a method for monitoring system operation provided by an exemplary embodiment is shown;

[0060] Figure 5 A schematic diagram showing the structure of a method and device for monitoring system operation provided by an exemplary embodiment is shown;

[0061] Figure 6 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0062] In order to make the technical problems, technical solutions and beneficial effects to be solved by the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0063] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0064] In the current system development and operation and maintenance process, log files are important records of system operation status, and log files generally include information such as system operations, user behaviors, and security events. Therefore, analyzing log files plays an important role in the software development and operation and maintenance process.

[0065] In the related art, log files are generally analyzed by manual inspection or simple keyword matching. However, with the development of cloud computing and big data technology, the scale and complexity of log files are increasing. Traditional log analysis methods are difficult to cope with large-scale data volumes and complex log files, resulting in problems such as untimely system monitoring response and high false alarm rate.

[0066] The present application provides a method, device, electronic device and storage medium for monitoring the operation of a system. By introducing machine learning and deep learning, normal operation modes and abnormal features are learned from a large amount of data, so that the data processing model has the ability to identify abnormal problems, thereby modeling a variety of detection algorithms to obtain a data processing model for identifying abnormal information in log files. When it is necessary to detect the operating status of the system to be tested, it is only necessary to input the log files generated during the operation of the system to be tested into the data processing model, and through the data processing model, the log files are detected for abnormalities, so as to obtain the abnormal detection results of the system to be tested. In this way, by constructing a data processing model, the process of monitoring the operating status of the system to be tested can be intelligent and automated, which improves the accuracy and timeliness of the operating status of the monitoring system, and no manual intervention is required, which reduces the workload of operation and maintenance personnel and improves the operation and maintenance efficiency and response speed.

[0067] See also Figure 1 , which shows a system involved in a method for monitoring system operation provided by an exemplary embodiment, see Figure 1 The system includes: an electronic device 10 and a system to be tested 20. The electronic device 10 is connected to the system to be tested 20 for communication. The system to be tested 20 may be a system in a terminal device, or a system in an application server, which is not specifically limited in the embodiment of the present application.

[0068] In actual applications, the electronic device 10 stores relevant model parameters of the data processing model. When the system under test 20 needs to be monitored, the relevant model parameters are called, and the log files generated during the operation of the system under test 20 are detected by the data processing model corresponding to the model parameters to obtain the abnormality detection result of the system under test 20. Based on the abnormality detection result, the operating status of the system under test 20 is displayed to the user.

[0069] The system under test 20 may be a system running in a terminal device, or may be a device running in an application server, or the device under test may be a device running in a terminal device and an application server respectively, which is not specifically limited in the embodiments of the present application.

[0070] The following describes the functional modules of the electronic device 10 involved in the embodiment of the present application in combination with different functions. Figure 2 The electronic device 10 includes a log collection module, a data preprocessing module, a feature extraction module, a data modeling module, a real-time analysis module and an anomaly detection module.

[0071] The log collection module is used to collect log files. The log collection module can collect log files from multiple sources, for example, collect log files in real time from multiple sources such as servers, applications (APP), terminal devices or robot devices. In addition, the log collection module can collect log files in any log format, for example, the log collection module can collect text format, JSON format or XML format, etc.

[0072] In some embodiments, the log collection module adopts a distributed architecture to support efficient collection of large-scale log files and ensure high availability and reliability of log collection. In addition, the log collection module adopts real-time data stream processing, for example, using a stream processing framework such as Kafka, so as to try to transmit and process log data to reduce delays.

[0073] The data preprocessing module is used to preprocess the collected log files to obtain valid log files. The preprocessing process includes cleaning the collected log files. For example, deleting duplicate or redundant log files in the collected log files, and deleting invalid log files in the collected log files. Among them, the invalid log file refers to a log file used to record debug and other log files that do not require anomaly detection.

[0074] The preprocessing process also includes standardizing the log files, that is, using a unified log format to standardize the time, log level, log type, exception information, etc. in the log files to ensure the integrity and consistency of the log files.

[0075] In addition, the data preprocessing module is also used to structure the data of the log file. For example, extract the key fields and information in the log file, and convert the unstructured data into structured data for subsequent analysis and processing. Among them, the key fields and information include relevant information in the log file, such as timestamp, log level, event type, IP address and user ID. In some embodiments, the data preprocessing module is also used to compress and store the processed log file, thereby reducing storage space and improving storage efficiency.

[0076] The feature extraction module is used to extract key information from the log file. Among them, the feature extraction module can integrate multiple feature extraction algorithms to extract individual key information. For example, the feature extraction module uses natural language processing (NLP) technology to perform word segmentation, part-of-speech tagging, named entity recognition and other processing on the content of the log file to extract natural language key information from the log file; the feature extraction module can also perform pattern matching on the content of the log file through regular expressions to extract specific fields and information, such as IP addresses, error codes, user IDs and other key information; the feature extraction module can also analyze the time series characteristics of the log data to extract time-related characteristics, such as time frequency, time interval, etc.

[0077] The data modeling module is used to combine multiple algorithms to learn the normal operation mode and abnormal characteristics of the system in the log file. For example, through machine learning algorithms and deep learning algorithms, a behavioral model of the system is constructed to learn the normal operation mode and abnormal characteristics. Among them, the machine learning algorithm and deep learning algorithm can be selected as needed. For example, the machine learning algorithm includes a decision tree, a support vector machine, etc.; the deep learning algorithm includes a convolutional neural network, a long short-term memory network (Long Short-Term Memory, LSTM), etc.

[0078] The data modeling module is also used to build a baseline model to determine the range and threshold of normal operation. The data modeling module can build a baseline model through statistical methods, for example, through methods such as mean, variance, correlation coefficient, etc.

[0079] In addition, the data modeling module is also used to perform cluster analysis on the log files to identify normal patterns and behaviors. The data modeling module can use any clustering algorithm to perform cluster analysis on the log files, for example, using K-means, DBSCAN and other clustering algorithms.

[0080] The real-time analysis module is used to perform real-time analysis and processing on log files to ensure low latency and high throughput requirements. In some embodiments, the real-time analysis module uses a stream processing framework to perform real-time analysis and processing on log files, for example, using an Apache Flink framework or an Apache Storm framework. In some implementations, in order to adapt to changes in system status, the real-time analysis module updates features and model parameters in real time to ensure the accuracy and effectiveness of the model.

[0081] The anomaly detection module is used to analyze the log files in combination with the machine learning algorithm and deep learning algorithm trained in the data modeling module, for example, in combination with algorithms such as the isolation forest algorithm, the LSTM neural network, and cluster analysis, to improve the accuracy and coverage of anomaly detection. In addition, the anomaly detection module is also used to adjust the threshold of anomaly detection according to historical data and the current system status, thereby reducing false positives and false negatives. In some embodiments, the anomaly detection module is also used to classify the detected abnormal events for subsequent processing and response. Among them, the classification of the abnormal events can be classified according to the cause of the abnormality, or, according to the impact of the abnormality. For example, the abnormal event can be divided into security problem events, performance problem events, or configuration error time, etc. In the embodiments of the present application, this is not specifically limited.

[0082] In some embodiments, the electronic device further includes an alarm module. The alarm module is used to generate alarm information and send the alarm information to the user. The alarm module classifies the alarm information according to the severity and type of the abnormal event and sends the alarm information to relevant personnel. The alarm module can send the alarm information to relevant personnel in a variety of ways, such as by email, text message, instant messaging tool, etc., to ensure that relevant personnel can respond to the alarm information in a timely manner.

[0083] In other embodiments, the electronic device further includes a response module. The response module is configured with an automatic response mechanism, and based on a preset strategy, it automatically processes abnormal events, for example, restarting services, adjusting configurations, isolating faulty nodes, etc. This reduces manual intervention and improves the response speed to abnormal events. The response module is also used to record the entire process of alarms and responses, generate a response log, and when an abnormal viewing request is received later, the response log can also be displayed to the user, which is convenient for counting abnormal events and optimizing the system according to abnormal events.

[0084] In other embodiments, the electronic device further includes a visualization module. The visualization module is used to provide an intuitive interface for users to view. For example, the visualization module displays a graphical interface for users to view information such as log analysis results, anomaly detection results, and system status. For another example, the visualization module displays a real-time monitoring screen, through which the monitoring data of the system is updated in real time. Among them, the monitoring data can be displayed in any form, for example, through a dynamic large-scale display function. By displaying the monitoring data in real time, the operation and maintenance personnel can quickly read and understand the operating status of the system. The visualization module can also provide a query control. In response to a trigger operation for the query control, the electronic device obtains historical information such as the historical status of the system, historical log analysis results, and historical anomaly detection results, and displays the historical information such as the historical status of the system, historical log analysis results, and historical anomaly detection results through the visualization module, so that the operation and maintenance personnel can conduct in-depth analysis and troubleshooting.

[0085] The present application provides a method, device, electronic device and storage medium for monitoring the operation of a system. By introducing machine learning and deep learning, normal operation modes and abnormal features are learned from a large amount of data, so that the data processing model has the ability to identify abnormal problems, thereby modeling a variety of detection algorithms to obtain a data processing model for identifying abnormal information in log files. When it is necessary to detect the operating status of the system to be tested, it is only necessary to input the log files generated during the operation of the system to be tested into the data processing model, and through the data processing model, the log files are detected for abnormalities, so as to obtain the abnormal detection results of the system to be tested. In this way, by constructing a data processing model, the process of monitoring the operating status of the system to be tested can be intelligent and automated, which improves the accuracy and timeliness of the operating status of the monitoring system, and no manual intervention is required, which reduces the workload of operation and maintenance personnel and improves the operation and maintenance efficiency and response speed.

[0086] The following describes the method for operating the monitoring system provided by the present application in conjunction with a specific embodiment. Figure 3 , which shows a flow chart of a method for monitoring system operation provided by an exemplary embodiment.

[0087] S301, the electronic device learns the normal operation mode and abnormal characteristics of the system through the log files of multiple devices based on multiple abnormality detection algorithms, and obtains a data processing model for determining the abnormal information of the log files.

[0088] In this step, the electronic device designs a data processing model that integrates multiple anomaly detection algorithms as needed, wherein the number and type of the multiple anomaly detection algorithms can be set as needed, and in the embodiment of the present application, there is no specific limitation on this. For example, the anomaly detection algorithm may include a decision tree, a support vector machine, an LSTM neural network, a convolutional neural network, a cluster analysis algorithm, etc.

[0089] The log files of the multiple devices can be collected by the log collection module of the distributed architecture of the electronic device. In addition, real-time data processing is achieved through the stream processing framework. Figure 4 The electronic device can collect log files from multiple sources, for example, collect log files in real time from multiple sources such as servers, applications (APP), terminal devices or robot devices. In addition, the log collection module can collect log files in any log format, for example, the log collection module can collect text format, JSON format or XML format, etc.

[0090] The electronic device constructs an initial data processing model based on the above-mentioned multiple anomaly detection algorithms, and then trains the initial data processing model through the collected log files, so that the model learns the normal operation mode and abnormal characteristics of the system, and obtains a data processing model for determining the abnormal information of the log file. This process can be implemented by the following steps S3011-S3013, including:

[0091] S3011, the electronic device pre-processes the collected log files of multiple systems.

[0092] In some embodiments, see Figure 4 , the electronic device deletes redundant and invalid log files from the log files of the multiple systems to obtain valid log files; extracts key fields from the valid log files; and uses the target data structure to convert the key fields into structured data. The electronic device performs log file cleaning on the collected log files. For example, delete duplicate or redundant log files from the collected log files, and delete invalid log files from the collected log files. Among them, the invalid log file refers to a log file used to record debug and other log files that do not require abnormality detection.

[0093] The preprocessing process also includes standardizing the log files, that is, using a unified log format to standardize the time, log level, log type, exception information, etc. in the log files to ensure the integrity and consistency of the log files.

[0094] In addition, the electronic device structures the data of the log file. For example, extract key fields and information in the log file, and convert unstructured data into structured data for subsequent analysis and processing. Among them, the key fields and information include relevant information in the log file, such as timestamp, log level, event type, IP address, and user ID. In some embodiments, the electronic device compresses and stores the processed log file, thereby reducing storage space and improving storage efficiency.

[0095] S3012, the electronic device extracts information from the preprocessed log file through a variety of anomaly detection algorithms to obtain key information of the log file.

[0096] The electronic device extracts key information from the log file. Among them, the feature extraction module can integrate multiple feature extraction algorithms to extract individual key information. For example, the electronic device uses natural language processing (NLP) technology to perform word segmentation, part-of-speech tagging, named entity recognition, etc. on the content of the log file to extract natural language key information from the log file; the electronic device can also use regular expressions to perform pattern matching on the content of the log file to extract specific fields and information, such as IP addresses, error codes, user IDs and other key information; the electronic device can also analyze the time series characteristics of the log data to extract time-related characteristics, such as time frequency, time interval, etc.

[0097] S3013, the electronic device obtains the data processing model for determining the abnormal information of the log file based on the normal operation mode and abnormal information of the key information learning system.

[0098] See also Figure 4 The electronic device combines multiple algorithms to learn the normal operation mode and abnormal characteristics of the system in the log file. For example, through machine learning algorithms and deep learning algorithms, a behavioral model of the system is constructed to learn the normal operation mode and abnormal characteristics. Among them, the machine learning algorithm and deep learning algorithm can be selected as needed. For example, the machine learning algorithm includes a decision tree, a support vector machine, etc.; the deep learning algorithm includes a convolutional neural network, a long short-term memory network (Long Short-Term Memory, LSTM), etc.

[0099] The electronic device builds a baseline model to determine the range and threshold of normal operation. The data modeling module can build the baseline model through statistical methods, for example, through the mean, variance, correlation coefficient and other methods.

[0100] The electronic device performs cluster analysis on the log files to identify normal patterns and behaviors. The data modeling module may use any clustering algorithm to perform cluster analysis on the log files, for example, using a clustering algorithm such as K-means or DBSCAN.

[0101] One point that needs to be explained is that the above-mentioned modeling process can be implemented by an electronic device or by other devices. Accordingly, when the above-mentioned modeling process is implemented by an electronic device, the electronic device trains the data processing model through the above-mentioned process, stores the model parameters of the trained data processing model locally, and calls the stored model parameters when it is necessary to determine the operating status of the system to be tested. When the above-mentioned modeling process is implemented by other devices, the other devices train the data processing model through the above-mentioned process, and when it is necessary to determine the operating status of the system to be tested, the electronic device obtains the model parameters of the trained data processing model from the other devices.

[0102] S302: When it is necessary to determine the operating status of the system under test, the electronic device obtains a log file generated during the operation of the system under test.

[0103] During the operation of the system under test, a log file is generated, and the log file is collected in real time by the electronic device. Figure 4 , the electronic device performs real-time analysis and processing on the log file to ensure low latency and high throughput requirements. In some embodiments, the electronic device uses a stream processing framework to perform real-time analysis and processing on the log file, for example, using the Apache Flink framework or the Apache Storm framework. In some implementations, in order to adapt to changes in system status, the brain device updates features and model parameters in real time to ensure the accuracy and effectiveness of the model.

[0104] S303, the electronic device performs anomaly detection on the log file of the system under test by using the data processing model to obtain anomaly detection results of the system under test.

[0105] The electronic device calls the trained data processing model and uses the data processing model to perform anomaly detection on the log file of the system to be tested. This process can be implemented by the following steps S3031-S3033, including:

[0106] S3031, the electronic device performs an anomaly detection on the log file of the system to be tested based on the data processing model, and obtains a log file with an abnormal detection result.

[0107] The electronic device analyzes the log files by combining the machine learning algorithm and deep learning algorithm trained in the data modeling module. For example, it combines the isolation forest algorithm, LSTM neural network, cluster analysis and other algorithms to improve the accuracy and coverage of anomaly detection.

[0108] S3032, the electronic device determines an abnormality detection threshold based on historical data and the current state of the system to be tested.

[0109] The electronic device adjusts the threshold for anomaly detection based on historical data and current system status, thereby reducing false positives and false negatives.

[0110] S3033: When the number of log files with abnormal detection results of the electronic device is greater than the abnormal detection threshold within a preset time period, it is determined that the system to be tested is operating abnormally.

[0111] The electronic device classifies the detected abnormal events for subsequent processing and response. The abnormal events can be classified according to the cause of the abnormality, or according to the impact of the abnormality. For example, the abnormal events can be divided into security problem events, performance problem events, or configuration error events. In the embodiments of the present application, this is not specifically limited.

[0112] In some embodiments, see Figure 4 After detecting that the system under test is running abnormally, the electronic device can also automatically respond to the abnormal event. Accordingly, when the abnormal detection result indicates that the system under test is running abnormally, the electronic device classifies the log files with abnormal detection results to obtain the abnormal event category of the system under test; based on the abnormal event category, a preset strategy is determined; based on the preset strategy, the system under test is adjusted.

[0113] The electronic device is equipped with an automatic response mechanism, which automatically handles abnormal events based on preset strategies, such as restarting services, adjusting configurations, isolating faulty nodes, etc. This reduces manual intervention and improves the response speed to abnormal events. In some embodiments, the electronic device also records the entire process of alarm and response, generates a response log, and when an abnormal viewing request is received later, the response log can also be displayed to the user, which is convenient for counting abnormal events and optimizing the system according to abnormal events.

[0114] In some embodiments, see Figure 4 After detecting that the system under test is operating abnormally, the electronic device can also generate an alarm message and send the alarm message to the user. Accordingly, when the abnormal detection result indicates that the system under test is operating abnormally, the electronic device determines the severity and category of the abnormal event corresponding to the abnormal detection result; generates an alarm message based on the severity and category of the abnormal event; and sends the alarm message to the user.

[0115] Among them, the alarm module grades the alarm information according to the severity and type of the abnormal event, and sends the alarm information to relevant personnel. Among them, the alarm module can send the alarm information to relevant personnel in a variety of ways, for example, through email, text messages, instant messaging tools, etc., to ensure that relevant personnel can respond to the alarm information in a timely manner. The process of the electronic device generating alarm information includes: the electronic device determines the alarm level based on the severity of the abnormal event; based on the category of the abnormal event, determines the target group of users to be alarmed; based on the alarm level and the group, generates the alarm information; accordingly, the sending of the alarm information to the user includes: the electronic device sends the alarm information corresponding to the alarm level to the users in the target group.

[0116] In other embodiments, the electronic device is also used to provide an intuitive interface for users to view. For example, the visualization module displays a graphical interface for users to view information such as log analysis results, anomaly detection results, and system status. For another example, the electronic device displays a real-time monitoring screen, through which the monitoring data of the system is updated in real time. Among them, the monitoring data can be displayed in any form, for example, through a dynamic large-scale display function. By displaying the monitoring data in real time, the operation and maintenance personnel can quickly read and understand the operating status of the system. The electronic device can also provide a query control. In response to a trigger operation for the query control, the electronic device obtains historical information such as the historical status of the system, historical log analysis results, and historical anomaly detection results, and displays the historical information such as the historical status of the system, historical log analysis results, and historical anomaly detection results through the visualization module, so that the operation and maintenance personnel can conduct in-depth analysis and troubleshooting.

[0117] In an embodiment of the present application, by introducing machine learning and deep learning, normal operating modes and abnormal features are learned from a large amount of data, so that the data processing model has the ability to identify abnormal problems, and thus by modeling multiple detection algorithms, a data processing model for identifying abnormal information in log files is obtained. When it is necessary to detect the operating status of the system to be tested, it is only necessary to input the log files generated during the operation of the system to be tested into the data processing model, and through the data processing model, the log files are detected for abnormalities to obtain the abnormal detection results of the system to be tested. In this way, by constructing a data processing model, the process of monitoring the operating status of the system to be tested can be intelligent and automated, thereby improving the accuracy and timeliness of the monitoring system's operating status, and without the need for manual intervention, reducing the workload of operation and maintenance personnel, and improving operation and maintenance efficiency and response speed.

[0118] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0119] See also Figure 5 , which shows a schematic diagram of the structure of a device for monitoring the operation of a system provided by the present application, and includes various units for executing various steps in the above embodiments, see Figure 5 , the monitoring system operation device includes:

[0120] A modeling unit 501 is used to learn the normal operation mode and abnormal characteristics of the system through the log files of multiple devices based on multiple abnormality detection algorithms, and obtain a data processing model for determining abnormal information of the log files;

[0121] The acquisition unit 502 is used to acquire the log file generated during the operation of the system under test when the operation status of the system under test needs to be determined;

[0122] The anomaly detection unit 503 is used to perform anomaly detection on the log file of the system under test through the data processing model to obtain anomaly detection results of the system under test.

[0123] In some embodiments, the anomaly detection unit 503 is used to perform anomaly detection on the log files of the system under test based on the data processing model to obtain log files with abnormal detection results; determine an anomaly detection threshold based on historical data and the current state of the system under test; when the number of log files with abnormal detection results is greater than the anomaly detection threshold within a preset time period, it is determined that the system under test is operating abnormally.

[0124] In some embodiments, the apparatus further comprises:

[0125] A classification unit, for classifying the log files with abnormal detection results to obtain the abnormal event category of the system under test when the abnormal detection result indicates that the system under test is running abnormally;

[0126] A first determining unit, configured to determine a preset strategy based on the abnormal event category;

[0127] The adjustment unit is used to adjust the system to be tested based on the preset strategy.

[0128] In some embodiments, the apparatus further comprises:

[0129] A second determination unit is used to determine the severity and category of the abnormal event corresponding to the abnormal detection result when the abnormal detection result indicates that the operation of the system under test is abnormal;

[0130] An alarm unit, used for generating alarm information based on the severity and category of the abnormal event;

[0131] The sending unit is used to send the alarm information to the user.

[0132] In some embodiments, the alarm unit is used to determine an alarm level based on the severity of the abnormal event; determine a target group of users to be alarmed based on the category of the abnormal event; and generate the alarm information based on the alarm level and the group;

[0133] The sending unit is used to send the alarm information corresponding to the alarm level to the users in the target group.

[0134] In some embodiments, the modeling unit 501 is used to preprocess the collected log files of multiple systems; extract information from the preprocessed log files through multiple anomaly detection algorithms to obtain key information of the log files; learn the normal operation mode and abnormal information of the system based on the key information to obtain the data processing model for determining the abnormal information of the log files.

[0135] In some embodiments, the modeling unit 501 is used to delete redundant and invalid log files in the log files of the multiple systems to obtain valid log files; extract key fields in the valid log files; and use the target data structure to convert the key fields into structured data.

[0136] In an embodiment of the present application, by introducing machine learning and deep learning, normal operating modes and abnormal features are learned from a large amount of data, so that the data processing model has the ability to identify abnormal problems, and thus by modeling multiple detection algorithms, a data processing model for identifying abnormal information in log files is obtained. When it is necessary to detect the operating status of the system to be tested, it is only necessary to input the log files generated during the operation of the system to be tested into the data processing model, and through the data processing model, the log files are detected for abnormalities to obtain the abnormal detection results of the system to be tested. In this way, by constructing a data processing model, the process of monitoring the operating status of the system to be tested can be intelligent and automated, thereby improving the accuracy and timeliness of the monitoring system's operating status, and without the need for manual intervention, reducing the workload of operation and maintenance personnel, and improving operation and maintenance efficiency and response speed.

[0137] Figure 6 is a schematic diagram of an electronic device provided by an exemplary embodiment of the present application. Figure 6 As shown, the electronic device 6 of this embodiment includes: a processor 60, a memory 61, and a computer program 62 stored in the memory 61 and executable on the processor 60, such as a program for monitoring system operation. When the processor 60 executes the computer program 62, the steps in the above-mentioned method embodiments for monitoring system operation are implemented, such as Figure 3Alternatively, when the processor 60 executes the computer program 62, the functions of each unit in the above-mentioned device embodiments are realized, for example Figure 5 The functions of units 501 to 503 are shown.

[0138] Exemplarily, the computer program 62 may be divided into one or more units, which are stored in the memory 61 and executed by the processor 60 to complete the present application. The one or more units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program 62 in the electronic device 6. For example, the computer program 62 may be divided into a modeling unit, an acquisition unit, and an anomaly detection unit, and the specific functions of each module are as follows:

[0139] A modeling unit 501 is used to learn the normal operation mode and abnormal characteristics of the system through the log files of multiple devices based on multiple abnormality detection algorithms, and obtain a data processing model for determining abnormal information of the log files;

[0140] The acquisition unit 502 is used to acquire the log file generated during the operation of the system under test when the operation status of the system under test needs to be determined;

[0141] The anomaly detection unit 503 is used to perform anomaly detection on the log file of the system under test through the data processing model to obtain anomaly detection results of the system under test.

[0142] The electronic device 6 may be any electronic device with a control function. The electronic device 6 may include, but is not limited to, a processor 60 and a memory 61. Those skilled in the art will appreciate that Figure 6 It is only an example of the electronic device 6 and does not constitute a limitation of the electronic device 6. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device 6 may also include input and output devices, network access devices, buses, etc.

[0143] The processor 60 may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0144] The memory 61 may be an internal storage unit of the electronic device 6, such as a hard disk or memory of the electronic device 6. The memory 61 may also be an external storage device of the electronic device 6, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 6. Further, the memory 61 may also include both an internal storage unit of the electronic device 6 and an external storage device. The memory 61 is used to store the computer program and other programs and data required by the terminal device. The memory 61 may also be used to temporarily store data that has been output or is to be output.

[0145] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0146] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0147] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0148] In the embodiments provided in the present application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0149] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0150] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0151] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0152] The embodiments of the present application further provide a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0153] The embodiment of the present application also provides a computer program product. When the computer program product runs on a mobile terminal, the mobile terminal can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0154] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A method for monitoring system operation, characterized in that: The method comprises: Based on multiple anomaly detection algorithms, the normal operation mode and abnormal characteristics of the system are learned through the log files of multiple devices, and a data processing model for determining the abnormal information of the log files is obtained; When it is necessary to determine the operating status of the system under test, obtain the log files generated during the operation of the system under test; By using the data processing model, anomaly detection is performed on the log file of the system to be tested to obtain an anomaly detection result of the system to be tested.

2. The method according to claim 1, characterized in that The method of performing anomaly detection on the log file of the system to be tested by using the data processing model to obtain an anomaly detection result of the system to be tested includes: Based on the data processing model, anomaly detection is performed on the log files of the system to be tested to obtain log files with abnormal detection results; Determining an anomaly detection threshold based on historical data and the current state of the system to be tested; When the number of log files with abnormal detection results is greater than the abnormal detection threshold within a preset time period, it is determined that the system to be tested is operating abnormally.

3. The method according to claim 2, characterized in that The method further comprises: When the abnormality detection result indicates that the operation of the system to be tested is abnormal, classifying the log files with abnormal detection results to obtain the abnormal event category of the system to be tested; Determining a preset strategy based on the abnormal event category; Based on the preset strategy, the system to be tested is adjusted.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: When the abnormality detection result indicates that the operation of the system to be tested is abnormal, determining the severity and category of the abnormal event corresponding to the abnormality detection result; Generate alarm information based on the severity and category of the abnormal event; The alarm information is sent to the user.

5. The method according to claim 4, characterized in that The generating of alarm information based on the severity and category of the abnormal event includes: Determine an alarm level based on the severity of the abnormal event; Based on the category of the abnormal event, determine a target group of users to be alerted; Based on the alarm level and the grouping, generating the alarm information; Accordingly, the sending of the alarm information to the user includes: Sending alarm information corresponding to the alarm level to users in the target group.

6. The method according to any one of claims 1 to 3, characterized in that: The method is based on multiple anomaly detection algorithms, and learns the normal operation mode and abnormal characteristics of the system through the log files of multiple devices to obtain a data processing model for determining abnormal information of the log files, including: Pre-process the collected log files of multiple systems; Use a variety of anomaly detection algorithms to extract information from preprocessed log files to obtain key information of log files; Based on the normal operation mode and abnormal information of the key information learning system, the data processing model for determining the abnormal information of the log file is obtained.

7. The method according to claim 6, characterized in that The preprocessing of the collected log files of multiple systems includes: Deleting redundant and invalid log files from the log files of the multiple systems to obtain valid log files; Extract key fields from the valid log file; The target data structure is adopted to convert the key fields into structured data.

8. A device for monitoring system operation, characterized in that: The device comprises: A modeling unit, configured to learn the normal operation mode and abnormal characteristics of the system through log files of multiple devices based on multiple abnormality detection algorithms, and obtain a data processing model for determining abnormal information of the log files; An acquisition unit, used to acquire a log file generated during the operation of the system under test when the operation status of the system under test needs to be determined; The anomaly detection unit is used to perform anomaly detection on the log file of the system under test through the data processing model to obtain anomaly detection results of the system under test.

9. An electronic device, characterized in that: The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor executes the computer program to implement the method for operating the monitoring system according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for operating the monitoring system according to any one of claims 1 to 7 is implemented.

Images