Intelligent log collection optimization mechanism based on scores

Abstract

Methods, systems, and non-transitory processor-readable storage media for optimizing a system for log collection are provided herein. An example method includes monitoring, by a system state monitoring module, at least one system state associated with an information system, wherein the information system includes a plurality of system components. The system anomaly detection module determines a system score for the information system based on the dynamic weighted calculation and the average performance evaluation. The system score facilitates predicting an impending error prior to an error occurring on the information system. The target component allocation module determines a plurality of target components requiring log collection based on the system scores, wherein the plurality of system components includes the plurality of target components. A log collection module calls system log collection from the target component to initiate system log collection prior to an error occurring on the information system.

Description

[0001] The technical field relates generally to optimizing error log collection, and more particularly to optimizing error log collection in information processing systems. Background Art

[0002] Error log collection, or "log collection" is the process of collecting log entries from different sources in an information system for the purpose of analyzing and exploiting the data to gain valuable knowledge about the inner workings of the information system. Summary of the invention

[0003] The illustrative embodiments provide techniques for implementing a log collection optimization system in a storage system. For example, the illustrative embodiments monitor at least one system state associated with an information system by a system state monitoring module, wherein the information system includes multiple system components. The system anomaly detection module determines a system score for the information system based on dynamic weighted calculations and average performance evaluation. The system score facilitates prediction of impending errors before an error occurs on the information system. The target component allocation module determines multiple target components that need log collection based on the system score, wherein the multiple system components include multiple target components. The log collection optimization system includes a system state monitoring module, a system anomaly detection module, and a target component allocation module. The log collection module calls system log collection from the target component to initiate system log collection before an error occurs on the information system. Other types of processing devices may be used in other embodiments. These and other illustrative embodiments include, but are not limited to, devices, systems, methods, and processor-readable storage media. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] Figure 1 An information processing system including a log collection optimization system in an illustrative embodiment is shown.

[0005] Figure 2 A log collection optimization system in an illustrative embodiment is shown.

[0006] Figure 3 A flow chart is shown of a process for optimizing a system for log collection in an illustrative embodiment.

[0007] Figure 4 and Figure 5 An example of a processing platform that may be used to implement at least a portion of an embodiment of a log collection optimization system is shown. DETAILED DESCRIPTION

[0008] Illustrative embodiments will be described herein with reference to an exemplary computer network and associated computers, servers, network devices, or other types of processing devices. However, it should be understood that these and other embodiments are not limited to use with the specific illustrative network and device configurations shown. Therefore, the term "computer network" as used herein is intended to be interpreted broadly so as to cover, for example, any system including multiple networked processing devices.

[0009] Described below is a technique for implementing a log collection optimization system, which can be used to provide log collection optimization, etc. by monitoring at least one system state associated with an information system by a system state monitoring module, wherein the information system includes multiple system components. The system anomaly detection module determines a system score for the information system based on a dynamic weighted calculation and an average performance evaluation. The system score facilitates prediction of impending errors before an error occurs on the information system. The target component allocation module determines multiple target components that require log collection based on the system score, wherein the multiple system components include multiple target components. The log collection optimization system includes a system state monitoring module, a system anomaly detection module, and a target component allocation module. The log collection module calls system log collection from the target component to initiate system log collection before an error occurs on the information system.

[0010] Typically, users archive log collections. Set up a periodic log collection schedule to ensure that necessary log collections for critical components of the information system are always available. Log collection can also be triggered when an error occurs on the information system.

[0011] Conventional techniques for log collection are triggered when disasters such as DUDL (data unavailable / data lost) occur, but cannot trigger log collection when system anomalies can be detected before an error state occurs. Conventional techniques cannot call log collection before an error state. Conventional techniques cannot identify target components from which error logs are collected to facilitate debugging and resolution processes. Conventional techniques cannot capture key system information that can facilitate analysis of the root cause of the error state. Conventional techniques cannot efficiently provide effective log collection to facilitate rapid debugging and resolution, thereby quickly recovering from information system disasters. Conventional techniques cannot provide dynamic weighted evaluations for multiple criteria. Conventional techniques cannot provide average standard calculations. Conventional techniques cannot integrate both dynamic weighted evaluations and average standard calculations into a comprehensive system score. Conventional techniques cannot provide a library that maps system standard states to target components to provide useful log collection data.

[0012] In contrast, in at least some implementations of the current technology as described herein, log collection is optimized by monitoring at least one system state associated with an information system by a system state monitoring module, wherein the information system includes a plurality of system components. A system anomaly detection module determines a system score of the information system based on a dynamic weighted calculation and an average performance evaluation. The system score facilitates prediction of impending errors before an error occurs on the information system. A target component allocation module determines a plurality of target components that require log collection based on the system score, wherein the plurality of system components include a plurality of target components. A log collection optimization system includes a system state monitoring module, a system anomaly detection module, and a target component allocation module. The log collection module calls system log collection from a target component to initiate system log collection before an error occurs on the information system.

[0013] Therefore, the goal of the current technology is to provide a method and system for log collection optimization system, which identifies system anomalies and triggers log collection on target components before an error state occurs. Another goal is to provide an effective error log collection system that accelerates error troubleshooting. Another goal is to provide a system that triggers log collection when system anomalies can be detected before an error state occurs. Another goal is to capture log collection before the error state. Another goal is to identify the target component from which error logs are collected to facilitate debugging and resolution processes. Another goal is to capture key system information that can facilitate the analysis of the root cause of the error state and avoid losing key system information. Another goal is to provide effective log collection to facilitate rapid debugging and resolution, thereby quickly recovering from information system disasters, ultimately providing a system of excellent quality and improving customer satisfaction. Another goal is to provide dynamic weighted evaluation for multiple standards. Another goal is to provide average standard calculation. Another goal is to integrate both dynamic weighted evaluation and average standard calculation into a comprehensive system score. Yet another goal is to provide a library that maps system standard states to target components to provide useful log collection data.

[0014] In at least some implementations according to the current technology described herein, using a log collection optimization system can provide one or more of the following advantages: providing an effective error log collection system that accelerates error troubleshooting, providing a system that triggers log collection when a system anomaly can be detected before an error state occurs, invoking log collection before an error state, identifying a target component from which to collect error logs to facilitate debugging and resolution processes, capturing key system information that can facilitate analysis of the root cause of the error state, providing effective log collection to facilitate prompt debugging and resolution, thereby quickly recovering from information system disasters, providing dynamic weighted evaluation for multiple criteria, providing average criteria calculation, integrating both dynamic weighted evaluation and average criteria calculation into a comprehensive system score. And providing a library that maps system standard states to target components to provide useful log collection data.

[0015] Compared to conventional techniques, in at least some implementations of the current techniques described herein, log collection is optimized by monitoring at least one system state associated with an information system by a system state monitoring module, wherein the information system includes multiple system components. A system anomaly detection module determines a system score of the information system based on a dynamic weighted calculation and an average performance evaluation. The system score facilitates prediction of impending errors before an error occurs on the information system. A target component allocation module determines multiple target components that require log collection based on the system score, wherein the multiple system components include multiple target components. A log collection optimization system includes a system state monitoring module, a system anomaly detection module, and a target component allocation module. The log collection module calls system log collection from a target component to initiate system log collection before an error occurs on the information system.

[0016] In an example embodiment of the present technology, the system status includes at least one of: a central processing unit (CPU) usage status, a memory usage status, an input / output (IO) load status, and a capacity usage status.

[0017] In an exemplary embodiment of the present technology, the system anomaly detection module system determines that the dynamic weighted calculation includes weighting at least one system state.

[0018] In an example embodiment of the current technology, the log collection optimization system defines a risk level for at least one system state and determines a percentage range for at least one system state. The log collection optimization system uses the risk level and percentage range to determine a weight of at least one system state.

[0019] In an example embodiment of the present technology, a log collection optimization system fine-tunes a weight of at least one system state to balance usage of an information system represented by the at least one system state.

[0020] In an example embodiment of the present technology, a log collection optimization system determines an average performance evaluation for at least one system state.

[0021] In an example embodiment of the present technology, a log collection optimization system determines a usage weight for at least one system state.

[0022] In an example embodiment of the present technology, a log collection optimization system determines at least one periodic weight for at least one system state, wherein the at least one periodic weight represents a usage percentage of at least one system state within a time period.

[0023] In an exemplary embodiment of the present technology, the log collection optimization system fine-tunes at least one periodic weight to optimize the average performance evaluation.

[0024] In an exemplary embodiment of the current technology, the log collection optimization system sets a default weight for at least one periodic weight.

[0025] In an example embodiment of the present technology, a log collection optimization system determines that a system score exceeds a threshold, which indicates an impending error on an information system.

[0026] In an exemplary embodiment of the present technology, a log collection optimization system maintains a history library that associates historical errors with corresponding useful error logs.

[0027] In an example embodiment of the current technology, the log collection optimization system maintains a history library that associates historical errors with corresponding historical system states.

[0028] In an example embodiment of the current technology, a log collection optimization system maps a risk level for at least one system state to a corresponding target component.

[0029] In an example embodiment of the current technology, the log collection optimization system matches the risk level for at least one system state with the corresponding target component to identify a plurality of target components.

[0030] In an example embodiment of the current technology, the log collection optimization system detects that the system score exceeds a threshold and triggers the log collection module to collect logs from the target component.

[0031] In an example embodiment of the present technology, the log collection optimization system continues to monitor at least one system status until the system score exceeds a threshold.

[0032] Figure 1A computer network (also referred to herein as an information processing system) 100 configured in accordance with an illustrative embodiment is shown. Computer network 100 includes log collection system 101, log collection optimization system 105, and information system 102-N. Log collection system 101, log collection optimization system 105, and information system 102-N are coupled to network 104, where network 104 in this embodiment is assumed to represent a subnetwork or other related portion of a larger computer network 100. Therefore, elements 100 and 104 are both referred to herein as examples of a "network," but in Figure 1 In the context of the embodiments, the latter is assumed to be a component of the former. A log collection optimization system 105, which may reside on a storage system, is also coupled to the network 104. Such a storage system may include any of a variety of different types of storage devices, including network attached storage devices (NAS), storage area networks (SAN), direct attached storage devices (DAS), and distributed DAS, as well as combinations of these and other storage types, including software defined storage devices.

[0033] Each of the information systems 102-N may include, for example, a server and / or portions of one or more server systems, and devices such as mobile phones, laptop computers, tablet computers, desktop computers, or other types of computing devices. Such devices are examples of what are more generally referred to herein as "processing devices." Some of these processing devices are also generally referred to herein as "computers."

[0034] In some embodiments, information systems 102-N include respective computers associated with a particular company, organization, or other enterprise. In addition, at least a portion of computer network 100 may also be collectively referred to herein as comprising an "enterprise network." As will be appreciated by those skilled in the art, many other operational scenarios involving various different types and arrangements of processing devices and networks are possible.

[0035] Furthermore, it should be understood that the term "user" in this context and elsewhere herein is intended to be interpreted broadly so as to encompass, for example, humans, hardware, software or firmware entities, and various combinations of these entities.

[0036] Network 104 is assumed to comprise a portion of a global computer network such as the Internet, although other types of networks, including wide area networks (WANs), local area networks (LANs), satellite networks, telephone or wired networks, cellular networks, wireless networks such as Wi-Fi or WiMAX networks, or various portions or combinations of these and other types of networks, may be part of computer network 100. Thus, in some embodiments, computer network 100 comprises a combination of multiple different types of networks, each of which includes processing devices configured to communicate using the Internet Protocol (IP) or other related communication protocols.

[0037] One or more input-output devices are also associated with the log collection optimization system 105, and the input-output devices illustratively include any combination of keyboards, displays, or other types of input-output devices. Such input-output devices can be used, for example, to support one or more user interfaces to the log collection optimization system 105, and to support the communication between the log collection optimization system 105 and other related systems and devices that are not clearly shown. For example, a dashboard can be provided for the user to view the execution progress of the log collection optimization system 105. One or more input-output devices can also be associated with any information system in the information system 102-N.

[0038] Additionally, it is assumed that at least one processing device is used to implement Figure 1 The log collection optimization system 105 in the embodiment. Each such processing device generally includes at least one processor and associated memory, and each such processing device implements one or more functional modules for controlling certain features of the log collection optimization system 105.

[0039] More specifically, the log collection optimization system 105 in this embodiment may include a processor coupled to a memory and a network interface.

[0040] The processor illustratively includes a microprocessor, a microcontroller, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other type of processing circuit, as well as portions or combinations of such circuit elements.

[0041] The memory illustratively includes random access memory (RAM), read-only memory (ROM), or any combination of other types of memory. The memory and other memories disclosed herein may be viewed as examples of what is more generally referred to as a "processor-readable storage medium" that stores executable computer program code or other types of software programs.

[0042] One or more embodiments include an article of manufacture such as a computer-readable storage medium. Examples of articles of manufacture include, but are not limited to, storage devices such as storage disks, storage arrays, or integrated circuits containing memory, and various other types of computer program products. The term "article of manufacture" as used herein should be understood to exclude transient propagating signals. These and other references to "disk" herein are intended to refer generally to storage devices including solid-state drives (SSDs), and therefore should not be considered to be limited in any way to rotating magnetic media.

[0043] The network interface allows the log collection optimization system 105 to communicate with the log collection system 101 and the information systems 102 -N over the network 104 , and illustratively includes one or more conventional transceivers.

[0044] The log collection optimization system 105 may be implemented at least partially in the form of software stored in a memory and executed by a processor, and the log collection optimization system 105 may reside in any processing device. The log collection optimization system 105 may be an independent plug-in that may be included in a processing device.

[0045] It should be understood that Figure 1 The specific set of elements of the log collection optimization system 105 for the computer network 100, involving the log collection system 101 and the information system 102-N, shown in the figure are presented only by way of illustrative examples, and additional or alternative elements may be used in other embodiments. Therefore, another embodiment includes additional or alternative systems, devices and other network entities, and different arrangements of modules and other components. For example, in at least one embodiment, one or more of the log collection optimization systems 105 can be on the same processing platform and / or part of the same processing platform.

[0046] Figure 2 A log collection optimization system 205 is shown. The log collection optimization system 205 includes a system status monitoring module 206, a system anomaly detection module 208, and a target component allocation module 210.

[0047] References such as Figure 3 The flowchart of FIG. 1 describes an exemplary process of the log collection optimization system 105 in the computer network 100 in more detail.

[0048] Figure 3 is a flow chart of a process for executing the log collection optimization system 105 in an illustrative embodiment. It should be understood that this particular process is merely an example, and that additional or alternative methods may be performed in other embodiments.

[0049] At 300, the system status monitoring module 206 monitors at least one system status associated with the information system 102-N. In an exemplary embodiment, the system status monitoring module 206 monitors at least one of the following: central processing unit (CPU) usage status, memory usage status, input / output (IO) load status, and capacity usage status. In an exemplary embodiment, the system status monitoring module 206 may also monitor other criteria associated with the information system 102-N, such as criteria associated with system components of the information system 102-N that are most relevant to the customer's situation and / or the use of the information system 102-N.

[0050] At 302, the system anomaly detection module 208 determines a system score for the information system 102-N based on a dynamic weighted calculation and an average performance evaluation. The system score facilitates predicting impending errors before they occur on the information system 102-N. If the individual score for any of the system components is too high, the system component may cause the information system 102-N to experience poor performance and errors may occur in the future. In another example scenario, although each individual score may be within an acceptable threshold, the total score of the information system 102-N (i.e., the system score) may be higher than a predetermined threshold. In this example scenario, the log collection optimization system 105 determines that an anomaly has occurred in the information system 102-N and triggers log collection of the target component. In an example embodiment, the log collection optimization system 105 continues to monitor at least one system state until the system score exceeds the threshold.

[0051] In the example embodiment, the system score S is expressed as:

[0052] S=ω CPU ·C CPU +ω Mem ·C Mem +ω IO ·C IO +ω cap ·C cap

[0053] CPU usage percentage is calculated by C CPU Indicates that the memory usage percentage is represented by C Mem Indicates that the IO (input / output) load percentage is represented by C IO The capacity percentage is represented by C cap These values ​​can be obtained through the system API (application programming interface). Based on customer needs, additional system component usage percentages can be defined as C other .

[0054] In an example embodiment, the system anomaly detection module 208 determines a dynamic weighted calculation. The dynamic weighted calculation includes weighting at least one system state. In another example embodiment, the dynamic weighted calculation includes weighting each of the system states. The weight used by the CPU can be determined by ω CPU The weight of memory usage can be expressed as ω Mem Indicates that the weight of the IO load percentage can be expressed by ω IO , and the capacity usage weight can be expressed by ω cap In addition, ω CPU ++ω Mem +ω IO +ω cap = 1. In an example embodiment, the weights of one or more system states are fine-tuned to balance the usage of the information system, the usage of the information system being represented by the one or more system states.

[0055] In an example embodiment, the weights of one or more system states are evenly distributed. In another example embodiment, each of the one or more system states has a different risk level, where the risk level or degree increases as the usage of the system components (represented by the system state) increases. For example, when CPU usage is below 60% or lower, there may be few or no problems, but when CPU usage is between 60% and 85%, there may be some problems. When CPU usage is above 85%, each 1% increase also increases the risk level, and therefore, in this example scenario, the weight of CPU usage also increases. Similarly, each of the other system states also has a different risk level, and the weight assigned to each system state changes as the risk level increases or decreases.

[0056] In an example embodiment, the system anomaly detection module 208 defines a risk level for at least one system state. In an example embodiment, the system anomaly detection module 208 determines a percentage range for at least one system state. For example, the risk level and percentage range may be defined as:

[0057] Risk Level System status percentage range 1 [0％，60％] 2 [61％，85％] 3 [86％，100％]

[0058] In an example embodiment, the system anomaly detection module 208 determines a weight of at least one system state using the risk level and the percentage range. In an example embodiment, the system anomaly detection module 208 determines a usage weight for at least one system state.

[0059] For example, D criterion i Represents the risk level for each system state i. The weight value ω of each system state i criterion i(where the system state is represented by the “criterion” in the equation) is calculated as follows:

[0060]

[0061] For example, if C CPU =50%, C Mem =80%, C IO =90% and C cap =70%, and D CPU =1,D Mem =2,D IO =3 and D cap =2, then ω CPU =12.5%,ω Mem =25%,ω IO =37.5% and ω cap = 25%. Therefore, the system status is defined by a more detailed risk level distribution, and when a change occurs in the information system 102-N, a more accurate weight can be determined.

[0062] In an example embodiment, the system anomaly detection module 208 determines an average performance evaluation for at least one system state. A given system component has different states and trends at different points in time. For example, the current state of the CPU state may be represented as C CPU，now , the most recent state of the CPU can be represented as C CPU，5min (i.e., 5 minutes ago), and the persistent state of the CPU can be represented as C CPU，15min (i.e., 15 minutes ago). In an exemplary embodiment, if C CPU，now , C CPU，5min and C CPU，15min If C shows an increasing or decreasing trend, this indicates that CPU performance is getting worse or better (respectively) over time. CPU，now , C CPU，5min and C CPU，15min If the CPU usage is approximately equal, this indicates that the CPU performance is relatively stable (regardless of whether the CPU is busy or idle). If the CPU usage is not tracked at intervals of, for example, 1 minute, 5 minutes, or 15 minutes, but at a different time series (e.g., randomly, periodically, etc.), the interval of tracking CPU usage will provide a different meaning for the overall overall performance of the CPU.

[0063] In an example embodiment, the system anomaly detection module 208 determines at least one periodic weight for at least one system state, wherein the periodic weight represents a percentage of use of at least one system state within a time period. In order to achieve more accurate system anomaly state detection for the average performance evaluation of each system state, the system anomaly detection module 208 determines the average performance within the time period. In an example embodiment, the system anomaly detection module 208 determines the average performance of the current time, the time 5 minutes before the current time, and the time 15 minutes before the current time. The average performance can be determined by:

[0064] C criterion i =C criterion i，avg{now，5mins，15mins}

[0065] =λ criterion i，1 ·C criterion i，now +λ criterioni，2 ·C criterion i，5min +λ criterion i，3 ·C criterion i，15min

[0066] In the above equation, the system state is represented by standard i, and the above equation is determined for one or more of the system states. In the above equation, λ1λ2 and λ3 represent the periodic weights of the percentage of use of standard i (i.e., system state) at a time equal to the present, a time equal to 5 minutes ago, and a time equal to 15 minutes ago, and λ1+λ2+λ3=1. In an example embodiment, the system anomaly detection module 208 fine-tunes at least one periodic weight to optimize the average performance evaluation. In an example embodiment, the weight is fine-tuned to obtain better overall average system state (i.e., standard) usage performance. In an example embodiment, the system anomaly detection module 208 sets a default weight for at least one periodic weight, for example, λ1λ2 and λ3 are assigned values ​​of 0.44, 0.33, and 0.23, respectively.

[0067] In an example embodiment, the system anomaly detection module 208 determines that the system score exceeds a threshold, which indicates that an error is about to occur on the information system. In an example embodiment, the log collection optimization system 105 monitors the system status of the information system 102-N in real time and calculates the performance score of the information system 102-N. When the system score S exceeds an acceptable threshold θ, the system anomaly detection module 208 determines that there is a system anomaly and predicts an error / failure. In an example embodiment, the log collection optimization system 105 continues to monitor at least one system status until the system score exceeds the threshold.

[0068] In an example embodiment, the system anomaly detection module 208 detects that the system score S exceeds a threshold and triggers the log collection module to collect logs from the target component. In an example embodiment, S can be represented as:

[0069]

[0070] At 304 , the target component assignment module 210 determines a plurality of target components requiring log collection based on the system score, wherein the plurality of system components includes the plurality of target components.

[0071] At 306, the log collection module 101 invokes system log collection from a target component to initiate system log collection before an error occurs on the information system 102-N. When a possible system anomaly is detected, the simplest solution is to collect system logs from all components in the information system 102-N. This is time consuming, increases system load, and may also affect the performance of the information system 102-N. Ideally, collecting system logs from target components reduces time, system load, and performance impact, but if the impending error has not yet occurred, the challenge becomes selecting the target components to collect error logs from so that those error logs are most useful for debugging errors that eventually occur on the information system 102-N (as a result of the impending error).

[0072] In an example embodiment, the target component assignment module 210 maintains a history library that associates historical errors with corresponding useful error logs. In an example embodiment, the history library may include system standard states (such as CPU states, memory states, IO load states, capacity states, and other states), and components associated with the information system 102-N from which error logs may be collected.

[0073] In an example embodiment, the target component assignment module 210 maintains a history library that associates historical errors with corresponding historical system states. In an example embodiment, the target component assignment module 210 maps a risk level for at least one system state to a corresponding target component. In other words, the target component assignment module 210 maintains a library that records the relationship between system standard states and components associated with the information system 102-N from which error logs can be collected. Listed below are example embodiments of the library.

[0074]

[0075] In an example embodiment, as errors are detected, the library data becomes richer and more comprehensive. In an example embodiment, when a risk level at a level of concern for a system state is detected, the target component allocation module 210 searches the library to identify the risk level for the system state. In an example embodiment, the target component allocation module 210 matches the risk level for at least one system state with the corresponding target component to identify multiple target components. In other words, once the risk level / degree is identified, the target component allocation module 210 identifies the target component mapped to the risk level / degree associated with the system state. The system anomaly detection module 208 then triggers log collection for key components (i.e., target components), which are most likely to be helpful and critical to solving the impending errors.

[0076] For example, using the above table for a system state of {2, 2, 2, 3}, there are two matches in the table. The current target component is {B, C, D}U{A, D} = {A, B, C, D}.

[0077] In an example embodiment, if the target component assignment module 210 does not find a match in the library, the system anomaly detection module 208 triggers a complete log collection of the system components of the information system 102-N. For example, the system state of {3, 3, 3, 1} does not match any row in the table, so the system logs of all defined components are collected to ensure that no critical logs are missed.

[0078] When an error occurs in the information system 102-N and the root cause is identified, the system standard state and the corresponding component that provides useful log collection data are added to the library. As the library is added over time, the data becomes richer and there is less chance of having a system state that cannot be matched in the library. Therefore, when a new system anomaly is detected, the log collection optimization system 105 quickly identifies a list of target components that will generate valid error logs to identify the root cause of the system anomaly.

[0079] In an example embodiment, the system performance states are as follows:

[0080]

[0081] The system score S is calculated as follows:

[0082]

[0083] Calculate the average performance rating:

[0084] C criterion i，avg{now，5mins，15mins)

[0085] =λ criterion i，1 ·C criterion i，now +λ criterion i，2 ·Ccriterion i，5min +λ criterion i，3 ·C criterion i，15min

[0086] Among them, λ1=0.44, λ2=0.33, and λ3=0.23.

[0087]

[0088]

[0089] Next, the weight ω of the system state criterion i is calculated as:

[0090]

[0091] Using risk levels and percentage ranges for each system status:

[0092] Risk Level System status percentage range 1 [0％，60％] 2 [61％，85％] 3 [86％，100％]

[0093]

[0094] Next, calculate the system score S:

[0095]

[0096] In the exemplary embodiment, the threshold value θ=70%. The system score S=73.35% exceeds the threshold value, so the log collection optimization system 105 will automatically trigger the log collection system 101.

[0097] The target component allocation module 210 matches the system state with a library. In an example embodiment, the library may be referred to as a log collection target component allocation table.

[0098]

[0099] If the system state is {1, 2, 3, 2}, there are two rows in the table with matching items. Therefore, the current target component is {A, E}U{A, B}={A, B, E}. Therefore, the system anomaly detection module 208 triggers the log collection system 101 to collect system logs from the target component represented by {A, B, E}.

[0100] Therefore, combined with Figure 3 The specific processing operations and other functions described in the flowcharts are presented only by way of illustrative examples and should not be interpreted as limiting the scope of the present disclosure in any way. For example, the order of the processing steps can be changed in other embodiments, or certain steps can be performed simultaneously with each other rather than in series.

[0101] The above illustrative embodiments provide significant advantages over conventional methods. For example, some embodiments are configured to identify anomalies in the system and trigger log collection of target components, which provide useful information for debugging and solving. Relative to conventional methods, these and other embodiments can effectively improve log collection on information systems. For example, the embodiments disclosed herein provide an effective error log collection system that accelerates error troubleshooting. The embodiments disclosed herein provide a system that triggers log collection when a system anomaly can be detected before an error state occurs. The embodiments disclosed herein call log collection before the error state. The embodiments disclosed herein identify target components from which error logs are collected to facilitate debugging and solving processes. The embodiments disclosed herein capture key system information that can facilitate the analysis of the root cause of the error state and avoid losing key system information. The embodiments disclosed herein provide efficient log collection to facilitate rapid debugging and solving, thereby quickly recovering from information system disasters, ultimately providing a system of excellent quality and improving customer satisfaction. The embodiments disclosed herein provide dynamic weighted evaluation for multiple standards. The embodiments disclosed herein provide average standard calculation. The embodiments disclosed herein integrate both dynamic weighted evaluation and average standard calculation into a comprehensive system score. Embodiments disclosed herein provide a library that maps system standard states to target components that provide useful log collection data.

[0102] It should be understood that the specific advantages described above and elsewhere herein are associated with specific illustrative embodiments and need not be present in other embodiments. Moreover, the specific types of information processing system features and functions as illustrated in the accompanying drawings and described above are merely exemplary, and in other embodiments, many alternative arrangements may be used.

[0103] As previously mentioned, at least a portion of the information handling system 100 can be implemented using one or more processing platforms. A given such processing platform includes at least one processing device, which includes a processor coupled to a memory. In some embodiments, the processor and memory include corresponding processors and memory elements of a virtual machine or container provided using one or more underlying physical machines. The term "processing device" as used herein is intended to be interpreted broadly to cover a wide variety of different arrangements of virtual instances of physical processors, memory and other device components and such components. For example, in some embodiments, a "processing device" may include one or more virtual processors or may be executed across one or more virtual processors. Therefore, a processing device may be physical or virtual and may be executed across one or more physical processors or virtual processors. It should also be noted that a given virtual device may be mapped to a portion of a physical device.

[0104] Some illustrative embodiments of a processing platform for implementing at least a portion of an information handling system include a cloud infrastructure that includes virtual machines implemented using a hypervisor running on a physical infrastructure. The cloud infrastructure also includes a set of applications running on corresponding ones of the virtual machines under the control of the hypervisor. It is possible to use multiple hypervisors, each hypervisor using at least one underlying physical machine to provide a set of virtual machines. Different sets of virtual machines provided by one or more hypervisors can be utilized to configure multiple instances of various components of the system.

[0105] These and other types of cloud infrastructures may be used to provide what is also referred to herein as a multi-tenant environment. One or more system components, or portions thereof, are illustratively implemented for use by tenants of such a multi-tenant environment.

[0106] As mentioned previously, the cloud infrastructure as disclosed herein may include a cloud-based system. A virtual machine provided in such a system may be used to implement at least a portion of the computer system in the illustrative embodiment.

[0107] In some embodiments, the cloud infrastructure additionally or alternatively includes a plurality of containers implemented using a container host device. For example, as described in detail herein, a given container of the cloud infrastructure illustratively includes a Docker container, or other types of Linux containers (LXC). The container runs on a virtual machine in a multi-tenant environment, but other arrangements are also possible. Containers are utilized to implement various different types of functions within the information processing system 100. For example, containers can be used to implement corresponding processing devices that provide computing and / or storage services for a cloud-based system. Similarly, containers can be used in conjunction with other virtualization infrastructures (e.g., virtual machines implemented using hypervisors, etc.).

[0108] Now refer to Figure 4 and Figure 5 Illustrative embodiments of the processing platform are described in more detail. Although described in the context of information handling system 100, in other embodiments, these platforms may also be used to implement at least a portion of other information handling systems.

[0109] Figure 4An example processing platform including a cloud infrastructure 400 is shown. The cloud infrastructure 400 includes a combination of physical and virtual processing resources for implementing at least a portion of the information processing system 100. The cloud infrastructure 400 includes a plurality of virtual machines (VMs) and / or container sets 402-1, 402-2, ... 402-L implemented using a virtualization infrastructure 404. The virtualization infrastructure 404 runs on a physical infrastructure 405 and illustratively includes one or more hypervisors and / or operating system-level virtualization infrastructure. The operating system-level virtualization infrastructure illustratively includes a kernel control group of a Linux operating system, or other type of operating system.

[0110] Cloud infrastructure 400 also includes a group 410-1, 410-2, ... 410-L of applications running on a corresponding VM / container set 402-1, 402-2, ... 402-L under the control of virtualization infrastructure 404. VM / container set 402 includes a corresponding VM, a corresponding set of one or more containers, or a corresponding set of one or more containers running in a VM. Figure 4 In some implementations of the embodiments, the VM / container set 402 includes corresponding VMs implemented using a virtualization infrastructure 404 including at least one hypervisor.

[0111] A hypervisor platform may be used to implement a hypervisor within the virtualized infrastructure 404, wherein the hypervisor platform has an associated virtual infrastructure management system. The underlying physical machines include one or more distributed processing platforms, which include one or more storage systems.

[0112] exist Figure 4 In other implementations of the embodiment, VM / container set 402 includes corresponding containers implemented using virtualization infrastructure 404, which provides operating system-level virtualization functions, such as support for Docker containers running on bare metal hosts, or Docker containers running on VMs. Containers are illustratively implemented using various kernel control groups of the operating system.

[0113] As can be seen from the above, one or more of the processing modules or other components of information processing system 100 can each run on a computer, server, storage device, or other processing platform element. A given such element is considered an example of what is more generally referred to as a "processing device" herein. Figure 4 The cloud infrastructure 400 shown may represent at least a portion of a processing platform. Another example of such a processing platform is Figure 5 A processing platform 500 is shown.

[0114] The processing platform 500 in this embodiment comprises a portion of the information processing system 100 and includes a plurality of processing devices, represented as 502 - 1 , 502 - 2 , 502 - 3 . . . 502 -K, which communicate with each other via a network 504 .

[0115] Network 504 includes any type of network including, by way of example, a global computer network such as the Internet, a WAN, a LAN, a satellite network, a telephone or wired network, a cellular network, a wireless network such as a Wi-Fi or WiMAX network, or various portions or combinations of these and other types of networks.

[0116] The processing device 502 - 1 in the processing platform 500 includes a processor 510 coupled to a memory 512 .

[0117] Processor 510 includes a microprocessor, a microcontroller, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other types of processing circuits, as well as portions or combinations of such circuit elements.

[0118] The memory 512 includes random access memory (RAM), read-only memory (ROM), or any combination of other types of memory. The memory 512 and other memories disclosed herein should be considered as illustrative examples of what is more generally referred to as a "processor-readable storage medium" that stores executable program code of one or more software programs.

[0119] An article of manufacture comprising such a processor-readable storage medium is considered to be an illustrative embodiment. A given such article of manufacture includes, for example, a storage array, a storage disk, or an integrated circuit comprising a RAM, ROM, or other electronic memory, as well as any computer program product of a wide variety of other types of computer program products. The term "article of manufacture" as used herein should be understood to not include transient propagation signals. Many other types of computer program products comprising a processor-readable storage medium may be used.

[0120] Also included in the processing device 502-1 is a network interface circuit 514 for interfacing the processing device with the network 504 and other system components, and may include a conventional transceiver.

[0121] It is assumed that the other processing devices 502 of the processing platform 500 are configured in a similar manner to the processing device 502 - 1 shown in the figure.

[0122] Furthermore, the specific processing platform 500 shown in the figure is presented by way of example only, and the information processing system 100 may include any combination of additional or alternative processing platforms, as well as multiple different processing platforms, each such platform including one or more computers, servers, storage devices, or other processing devices.

[0123] For example, instead of or in addition to a virtualization infrastructure including virtual machines, other processing platforms for implementing the illustrative embodiments may include a different type of virtualization infrastructure. Such a virtualization infrastructure illustratively includes a container-based virtualization infrastructure configured to provide a Docker container or other type of LXC.

[0124] As another example, in some embodiments, portions of a given processing platform may include a converged infrastructure.

[0125] It should therefore be understood that in other embodiments, different arrangements of additional or alternative elements may be used.At least a subset of these elements may be implemented together on a common processing platform, or each such element may be implemented on a separate processing platform.

[0126] Furthermore, many other arrangements of computers, servers, storage products or devices, or other components are possible in information handling system 100. Such components may communicate with other elements of information handling system 100 via any type of network, or other communication medium.

[0127] For example, specific types of storage products that may be used to implement a given storage system of a distributed processing system in the illustrative embodiments include all-flash and hybrid flash storage arrays, scaled-down all-flash storage arrays, scaled-down NAS clusters, or other types of storage arrays. Combinations of multiples of these and other storage products may also be used to implement a given storage system in the illustrative embodiments.

[0128] It should be emphasized again that the above-described embodiments are presented for illustrative purposes only. Many variations and other alternative embodiments may be used. Moreover, in other embodiments, the specific configurations of the systems and device elements illustrated illustratively in the accompanying drawings and the associated processing operations may be changed. Thus, for example, the specific types of processing devices, modules, systems and resources deployed in a given embodiment, and their corresponding configurations may be changed. In addition, the various assumptions made above in describing the illustrative embodiments should also be considered as exemplary rather than necessary conditions or limitations. Many other alternative embodiments within the scope of the appended claims will be apparent to those skilled in the art.

Claims

1. A method comprising: monitoring, by a system status monitoring module, at least one system status associated with an information system, wherein the information system includes a plurality of system components; determining, by a system anomaly detection module, a system score for the information system based on a dynamic weighted calculation and an average performance evaluation, wherein the system score facilitates predicting an impending error before the error occurs on the information system; A target component allocation module determines a plurality of target components that require log collection based on the system score, wherein the plurality of system components include the plurality of target components, wherein the log collection optimization system includes the system status monitoring module, the system anomaly detection module, and the target component allocation module; as well as System log collection is called by a log collection module from the target component to initiate the system log collection before the error occurs on the information system, wherein the method is performed by at least one processing device, the at least one processing device comprising a processor coupled to a memory. 2 . The method according to claim 1 , wherein the at least one system status comprises at least one of the following: a central processing unit (CPU) usage status, a memory usage status, an input / output (IO) load status, and a capacity usage status.

3. The method according to claim 1, wherein determining, by the system anomaly detection module, the system score for the information system comprises: Determining the dynamic weighted calculation includes weighting the at least one system state.

4. The method of claim 3, wherein determining the dynamic weighted calculation comprises: defining a risk level for the at least one system state; determining a percentage range for the at least one system state; as well as A weight of the at least one system state is determined using the risk level and the percentage range.

5. The method according to claim 2, further comprising: The weight of the at least one system state is fine-tuned to balance usage of the information system, the usage of the information system being represented by the at least one system state.

6. The method of claim 1, wherein determining, by the system anomaly detection module, the system score for the information system comprises: The average performance assessment for the at least one system state is determined.

7. The method of claim 6, wherein determining the average performance assessment for the at least one system state comprises: A usage weight is determined for the at least one system state.

8. The method according to claim 7 further comprises: At least one periodic weight is determined for the at least one system state, wherein the at least one periodic weight represents a percentage of usage of the at least one system state over a time period.

9. The method according to claim 8, further comprising: The at least one periodic weight is fine-tuned to optimize the average performance estimate.

10. The method according to claim 9, further comprising: A default weight is set for the at least one periodic weight.

11. The method of claim 1 , wherein determining, by the system anomaly detection module, the system score for the information system comprises: A determination is made by the system anomaly detection module that the system score exceeds a threshold, the system score exceeding the threshold indicating an impending occurrence of the error on the information system.

12. The method according to claim 1, wherein determining, by the target component assignment module, the plurality of target components requiring log collection based on the system scores comprises: A history repository is maintained that associates historical errors with corresponding useful error logs.

13. The method according to claim 1, wherein determining, by the target component assignment module, the plurality of target components requiring log collection based on the system scores comprises: A history repository is maintained that associates historical errors with corresponding historical system states.

14. The method according to claim 1, wherein determining, by the target component assignment module, the plurality of target components requiring log collection based on the system scores comprises: The risk level for the at least one system state is mapped to a corresponding target component.

15. The method according to claim 1, wherein determining, by the target component assignment module, the plurality of target components requiring log collection based on the system scores comprises: The risk level for the at least one system state is matched with the corresponding target components to identify the plurality of target components.

16. The method according to claim 1, wherein calling system log collection from the target component by the log collection module comprises: The system anomaly detection module detects that the system score exceeds a threshold; as well as The log collection module is triggered by the system anomaly detection module to collect logs from the target component.

17. The method according to claim 1, further comprising: The at least one system status continues to be monitored until the system score exceeds a threshold.

18. A system comprising: at least one processing device comprising a processor coupled to a memory; The at least one processing device is configured to: monitoring, by a system status monitoring module, at least one system status associated with an information system, wherein the information system includes a plurality of system components; determining, by a system anomaly detection module, a system score for the information system based on a dynamic weighted calculation and an average performance evaluation, wherein the system score facilitates predicting an impending error before the error occurs on the information system; A target component allocation module determines a plurality of target components that require log collection based on the system score, wherein the plurality of system components include the plurality of target components, wherein the log collection optimization system includes the system status monitoring module, the system anomaly detection module, and the target component allocation module; as well as The system log collection is called by the log collection module from the target component to initiate the system log collection before the error occurs on the information system.

19. The system according to claim 18, further configured to: The at least one system status continues to be monitored until the system score exceeds a threshold.

20. A computer program product comprising a non-transitory processor-readable storage medium having program code of one or more software programs stored therein, wherein the program code, when executed by at least one processing device, causes the at least one processing device to: monitoring, by a system status monitoring module, at least one system status associated with an information system, wherein the information system includes a plurality of system components; determining, by a system anomaly detection module, a system score for the information system based on a dynamic weighted calculation and an average performance evaluation, wherein the system score facilitates predicting an impending error before the error occurs on the information system; A target component allocation module determines a plurality of target components that require log collection based on the system score, wherein the plurality of system components include the plurality of target components, wherein the log collection optimization system includes the system status monitoring module, the system anomaly detection module, and the target component allocation module; as well as The system log collection is called by the log collection module from the target component to initiate the system log collection before the error occurs on the information system.

Images