Application system monitoring method and device based on operation and maintenance large model

Abstract

The invention provides an application system monitoring method and device based on an operation and maintenance large model, and the method comprises the steps: obtaining application data generated by a plurality of application systems, carrying out the preprocessing of the application data, so as to obtain the preprocessed application data, extracting the data features of the preprocessed application data, obtaining a monitoring target, and carrying out the monitoring of the application system based on the monitoring target. Determining key indexes, classifying the key indexes to obtain classified key indexes, and constructing an index system based on the classified key indexes and the monitoring target; wherein each key index in the index system corresponds to a monitoring rule, and the data features are monitored according to the monitoring rules so as to determine the running state of each application system. The data features are monitored through the index system, and if the data features are abnormal, the application systems corresponding to the data features are abnormal, so that the data of the application systems do not need to be manually monitored one by one, and the abnormal application systems are ensured to be quickly determined.

Description

Technical Field

[0001] The present invention relates to the technical field of operation and maintenance management, and in particular to an application system monitoring method and device based on an operation and maintenance big model. Background Art

[0002] With the rapid development of information technology, the field of operation and maintenance has gradually become more complex and diversified. Operation and maintenance personnel need to manage a large number of applications, which may run on different operating systems, databases, and middleware. In the prior art, operation and maintenance personnel need to collect application data from different operating systems, databases, and middleware, and monitor the application data manually, which will result in the inability to quickly identify application anomalies, and thus the inability to quickly and effectively repair applications and ensure the normal operation of applications. Summary of the invention

[0003] The present invention provides an application system monitoring method and device based on an operation and maintenance big model, which solves the problem in the prior art that the data of the application program is monitored manually, resulting in the inability to quickly identify the abnormality of the application program.

[0004] According to one aspect of the present invention, there is provided an application system monitoring method based on an operation and maintenance big model, comprising:

[0005] Obtain application data generated by multiple application systems;

[0006] Preprocessing the application data to obtain preprocessed application data;

[0007] Extracting data features of the preprocessed application data;

[0008] Get monitoring targets;

[0009] Based on the monitoring objectives, key indicators are determined and the key indicators are classified to obtain classified key indicators;

[0010] Based on the classified key indicators and the monitoring objectives, an indicator system is constructed; wherein each key indicator in the indicator system corresponds to a monitoring rule;

[0011] According to the monitoring rules, the data features are monitored to determine the operating status of each application system.

[0012] In one embodiment, constructing an indicator system based on the classified key indicators and the monitoring objectives includes:

[0013] Taking the monitoring target as the tree root;

[0014] Determine the categories corresponding to the classified key indicators;

[0015] Dividing the tree root into multiple branches, wherein each branch corresponds to a category;

[0016] Divide the branch corresponding to each category into multiple sub-branches; each sub-branch corresponds to a key indicator after classification;

[0017] Obtain monitoring rules corresponding to the classified key indicators;

[0018] An indicator system is constructed according to the tree root, the multiple branches, the classified key indicators, the multiple sub-branches and the multiple monitoring rules.

[0019] In one embodiment, the obtaining of monitoring rules corresponding to the classified key indicators includes:

[0020] Set monitoring thresholds and benchmark values ​​for each classified key indicator;

[0021] Constructing a monitoring interval according to the monitoring threshold and the reference value;

[0022] Wherein, monitoring the data features according to the monitoring rules to determine the operating status of each application system includes:

[0023] If the characteristic value of the data characteristic does not satisfy the monitoring interval, it is determined that the operating state of the application system corresponding to the data characteristic is an abnormal state.

[0024] In one embodiment, monitoring the data features according to the monitoring rules to determine the operating status of each application system includes:

[0025] Based on the monitoring rules, construct an anomaly model;

[0026] Inputting the data features into the anomaly model to obtain a status result;

[0027] Based on the status results, the operating status of each application system is determined.

[0028] In one embodiment, constructing an abnormal model based on the monitoring rule includes:

[0029] Obtain test data for multiple test application systems;

[0030] Based on the monitoring rules, determining abnormal data and normal data in the test data;

[0031] Selecting a preset number of data from the abnormal data and normal data as training data;

[0032] extracting training data features of the training data;

[0033] Based on the neural network algorithm, an abnormal model is constructed according to the data characteristics of the training data.

[0034] In one embodiment, the preprocessing the application data to obtain preprocessed application data includes:

[0035] Performing data cleaning on the application data to obtain cleaned application data;

[0036] Converting the cleaned application data into a preset format to obtain converted application data;

[0037] The converted application data is filled to obtain pre-processed application data.

[0038] In one embodiment, after the application data is preprocessed to obtain the preprocessed application data, the application system monitoring method based on the operation and maintenance big model further includes:

[0039] Determining data containing user information and data containing operation information in the preprocessed application data in each application system;

[0040] Mapping the data containing the user information and the data containing the operation information to obtain mapped application data;

[0041] The step of extracting data features of the preprocessed application data includes:

[0042] The data features of the mapped application data are extracted.

[0043] In one embodiment, after the application data is preprocessed to obtain the preprocessed application data, the application system monitoring method based on the operation and maintenance big model further includes:

[0044] Determining a real-time data stream in the preprocessed application data;

[0045] Based on the stream processing framework, data processing is performed on the real-time data stream to obtain real-time processed application data;

[0046] The step of extracting data features of the preprocessed application data includes:

[0047] Extracting data features of the real-time processed application data.

[0048] In one embodiment, after the application data is preprocessed to obtain the preprocessed application data, the application system monitoring method based on the operation and maintenance big model further includes:

[0049] Based on the K-means algorithm, cluster the preprocessed application data to obtain clustered application data;

[0050] The clustered application data is plotted into a scatter plot.

[0051] According to another aspect of the present invention, there is provided an application system monitoring device based on an operation and maintenance big model, comprising:

[0052] A first acquisition module is used to acquire application data generated by multiple application systems;

[0053] A preprocessing module, used for preprocessing the application data to obtain preprocessed application data;

[0054] An extraction module, used for extracting data features of the preprocessed application data;

[0055] The second acquisition module is used to acquire the monitoring target;

[0056] A determination module, used to determine key indicators based on the monitoring target and classify the key indicators to obtain classified key indicators;

[0057] A construction module, used to construct an indicator system based on the classified key indicators and the monitoring objectives; wherein each key indicator in the indicator system corresponds to a monitoring rule;

[0058] The monitoring module is used to monitor the data features according to the monitoring rules to determine the operating status of each application system.

[0059] The embodiment of the present invention provides an application system monitoring method and device based on an operation and maintenance big model, including: obtaining application data generated by multiple application systems, preprocessing the application data to obtain preprocessed application data, extracting data features of the preprocessed application data, obtaining monitoring targets, determining key indicators based on the monitoring targets and classifying the key indicators to obtain classified key indicators, and constructing an indicator system based on the classified key indicators and the monitoring targets; wherein each key indicator in the indicator system corresponds to a monitoring rule, and the data features are monitored according to the monitoring rules to determine the operating status of each application system. By extracting the data features of the preprocessed application data and monitoring the data features based on the data features and the indicator system, if the data features are abnormal, then the application system corresponding to the data features is abnormal, so there is no need to manually monitor the data of the application systems one by one, ensuring that the abnormal application system is quickly determined, and the abnormal application system is maintained and adjusted. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 It is a flowchart of an application system monitoring method based on an operation and maintenance big model provided by an exemplary embodiment of the present invention.

[0061] Figure 2 It is a flowchart of a method for determining an operating state provided by an exemplary embodiment of the present invention.

[0062] Figure 3 It is a structural diagram of an application system monitoring device based on an operation and maintenance big model provided by an exemplary embodiment of the present invention.

[0063] Figure 4 It is a structural diagram of an application system monitoring device based on an operation and maintenance big model provided by another exemplary embodiment of the present invention.

[0064] Figure 5 is a structural diagram of an electronic device provided by an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0065] Figure 1 FIG. 1 is a flow chart of an application system monitoring method based on an operation and maintenance big model provided by an exemplary embodiment of the present invention. Figure 1 As shown in the figure, the application system monitoring method based on the operation and maintenance big model includes:

[0066] Step 110: Acquire application data generated by multiple application systems.

[0067] In an embodiment of the present invention, the application data of the present invention may include operating system logs, database logs, middleware logs, application performance data, network traffic data, and the like.

[0068] In addition, in order to ensure the comprehensiveness and accuracy of the data, different data collection technologies and methods need to be adopted, such as log collection, API interface calls, network packet capture, etc., and these data sources are connected to the data collection system, so that the application data generated by multiple application systems can be obtained.

[0069] Specifically, log collection refers to the collection of operation records and event information from systems, applications, and devices. These logs can provide real-time monitoring data, which is helpful for analyzing system performance, user behavior, and security events. The application data corresponding to log collection can be obtained by first identifying the target log system, obtaining the log record parameters from the target log system, and then aggregating the log record parameters from different sources into the data collection system through a centralized log management tool, so as to facilitate subsequent analysis and query.

[0070] Among them, the target log system may include servers, databases, network devices, etc. Centralized log management tools include ELK Stack, Splunk, etc. ELK Stack is an open source log management solution consisting of the following three parts: Elasticsearch, Logstash, and Kibana. Elasticsearch is a Lucene-based search and analysis engine that can quickly store, search, and analyze large amounts of data. Logstash is a powerful data processing pipeline tool that can receive, process, and forward log data. Kibana is a data visualization tool that allows users to search and visualize data in Elasticsearch through a graphical interface. Splunk is a commercial log management and data analysis platform that is mainly used to collect, index, and analyze machine-generated data.

[0071] Among them, API (application programming interface) calls are an effective way to collect data, allowing different systems to interact and exchange data. Network packet capture is to monitor network traffic and capture data packets in transit to analyze network protocols, traffic characteristics and data content.

[0072] Step 120: pre-process the application data to obtain pre-processed application data.

[0073] In the embodiment of the present invention, since the collected raw data often has problems such as noise, missing data, and anomalies, it is necessary to pre-process the application data to facilitate subsequent monitoring of the application system.

[0074] Step 130: Extract data features of the preprocessed application data.

[0075] Step 140: Acquire the monitoring target.

[0076] In the embodiment of the present invention, in order to quickly locate and solve problems, reduce fault recovery time, and improve system availability and reliability, it is necessary to determine monitoring targets, and through monitoring targets, clearly determine the performance of the application system that needs to be monitored. Among them, the monitoring targets may include aspects such as system stability, performance, and security.

[0077] Step 150: Based on the monitoring objectives, key indicators are determined and classified to obtain classified key indicators.

[0078] In the embodiment of the present invention, in order to monitor the operating status of the application system more comprehensively, it is also necessary to select key indicators and monitor the application data based on the key indicators, so as to determine whether the application data is abnormal based on the key indicators.

[0079] Among them, key indicators can include system-level indicators (such as CPU utilization, memory usage, disk I / O, etc.) and application-level indicators (such as response time, transaction volume, error rate, etc.). For example, if the monitoring target is system stability, the required key indicators may include memory usage and response time. The selected key indicators are classified and the application data is monitored according to the key indicators in each category.

[0080] Step 160: Based on the classified key indicators and monitoring targets, an indicator system is constructed, wherein each key indicator in the indicator system corresponds to a monitoring rule.

[0081] In the embodiment of the present invention, since the classified key indicators can reflect different aspects of the system, in order to directly apply the monitoring rules of the key indicators, the present invention can construct an indicator system to achieve effective monitoring through the indicator system.

[0082] In this indicator system, each key indicator is clearly defined and directly associated with a specific monitoring target. For example, for business continuity goals, you can set the key indicator of "system availability". The monitoring rules include setting an availability threshold (such as 99.9%) and triggering an alarm when the availability drops below the threshold. In addition, for performance optimization goals, the key indicator can be "response time". The monitoring rule is that when the response time exceeds the set limit (such as 500 milliseconds), the relevant logs are automatically recorded and the operation and maintenance team is notified. In this way, the entire indicator system not only provides a comprehensive perspective to monitor the health of the business, but also can quickly respond to potential problems through real-time monitoring and early warning mechanisms, thereby ensuring the stability of the system and optimizing the efficiency of resource utilization.

[0083] Step 170: Monitor the data features according to the monitoring rules to determine the operating status of each application system.

[0084] The embodiment of the present invention provides an application system monitoring method based on an operation and maintenance big model, comprising: obtaining application data generated by multiple application systems, preprocessing the application data to obtain preprocessed application data, extracting data features of the preprocessed application data, obtaining monitoring targets, determining key indicators based on the monitoring targets and classifying the key indicators to obtain classified key indicators, and constructing an indicator system based on the classified key indicators and the monitoring targets, wherein each key indicator in the indicator system corresponds to a monitoring rule, and the data features are monitored according to the monitoring rules to determine the operating status of each application system. By extracting the data features of the preprocessed application data and monitoring the data features based on the data features and the indicator system, if the data features are abnormal, then the application system corresponding to the data features is abnormal, so there is no need to manually monitor the data of the application systems one by one, ensuring that the abnormal application system is quickly determined, and the abnormal application system is maintained and adjusted.

[0085] In one embodiment, step 160 can be specifically implemented as follows: taking the monitoring target as the root of the tree; determining the category corresponding to the classified key indicator; dividing the root of the tree into multiple branches; wherein each branch corresponds to a category; dividing the branch corresponding to each category into multiple sub-branches; wherein each sub-branch corresponds to a classified key indicator; obtaining the monitoring rules corresponding to the classified key indicator; and constructing an indicator system based on the root of the tree, multiple branches, the classified key indicators, multiple sub-branches, and multiple monitoring rules.

[0086] In the embodiment of the present invention, in order to refine the specific operation indicators, the present invention adopts a tree structure to construct an indicator system. Through the tree structure, the relationship between each key indicator and the monitoring target can be clearly displayed, which is convenient for understanding how each indicator supports the overall target and the mutual influence between different indicators.

[0087] The present invention can construct a tree root, and use the monitoring target as the tree root, and then divide the tree root into multiple branches, each branch corresponding to a category. Each branch can be further divided into multiple sub-branches, and each sub-branch is set to correspond to a classified key indicator, thereby constructing a monitoring framework of the indicator system.

[0088] Optionally, each sub-branch can be split into sub-trees, each of which corresponds to a monitoring rule. Alternatively, each sub-branch corresponds to a classified key indicator and the corresponding monitoring rules for each sub-branch are defined. Key indicators can be added to the indicator system without major adjustments to the entire system, thereby improving flexibility.

[0089] In one embodiment, step 160 can be specifically implemented as follows: setting monitoring thresholds and benchmark values ​​corresponding to each classified key indicator; constructing a monitoring interval based on the monitoring thresholds and benchmark values; step 170 can be specifically implemented as follows: if the characteristic value of the data feature does not satisfy the monitoring interval, determining that the operating state of the application system corresponding to the data feature is an abnormal state.

[0090] In the embodiment of the present invention, in order to monitor whether the running state of the application system is normal, a monitoring threshold and a reference value can be set, and a monitoring interval can be constructed according to the monitoring threshold and the reference value. All feature values ​​that do not meet the data feature of the monitoring interval indicate that the application system corresponding to the data feature is abnormal.

[0091] Figure 2 It is a flowchart of a method for determining an operating state provided by an exemplary embodiment of the present invention.

[0092] like Figure 2 As shown, step 170 may include:

[0093] Step 171: Build an abnormal model based on monitoring rules.

[0094] In the embodiment of the present invention, the present invention can use statistical methods, machine learning methods and deep learning methods to build anomaly models. The statistical method determines anomalies by setting thresholds and rules, while the machine learning method identifies anomalies by training models. The deep learning method learns the characteristics and laws of data by building complex neural networks.

[0095] Specifically, step 171 may include the following steps:

[0096] Step 1711: Acquire test data of multiple test application systems;

[0097] In an embodiment of the present invention, the application data of the present invention may include operating system logs, database logs, middleware logs, application performance data, network traffic data, and the like.

[0098] In addition, in order to ensure the comprehensiveness and accuracy of the data, different data collection technologies and methods need to be adopted, such as log collection, API interface calls, network packet capture, etc., and these data sources are connected to the data collection system, so that the test application data generated by multiple test application systems can be obtained.

[0099] Specifically, log collection refers to the collection of operation records and event information from systems, applications, and devices. These logs can provide real-time monitoring data, which is helpful for analyzing system performance, user behavior, and security events. The application data corresponding to log collection can be obtained by first identifying the target log system, obtaining the log record parameters from the target log system, and then aggregating the log record parameters from different sources into the data collection system through a centralized log management tool, so as to facilitate subsequent analysis and query.

[0100] Among them, the target log system may include servers, databases, network devices, etc. Centralized log management tools include ELK Stack, Splunk, etc. ELK Stack is an open source log management solution consisting of the following three parts: Elasticsearch, Logstash, and Kibana. Elasticsearch is a Lucene-based search and analysis engine that can quickly store, search, and analyze large amounts of data. Logstash is a powerful data processing pipeline tool that can receive, process, and forward log data. Kibana is a data visualization tool that allows users to search and visualize data in Elasticsearch through a graphical interface. Splunk is a commercial log management and data analysis platform that is mainly used to collect, index, and analyze machine-generated data.

[0101] Among them, API (application programming interface) calls are an effective way to collect data, allowing different systems to interact and exchange data. Network packet capture is to monitor network traffic and capture data packets in transit to analyze network protocols, traffic characteristics and data content.

[0102] Step 1712: Determine abnormal data and normal data in the test data based on the monitoring rules;

[0103] Step 1713: Select a preset number of data from the abnormal data and the normal data as training data;

[0104] Step 1714: extracting training data features of the training data;

[0105] Step 1715: Based on the neural network algorithm, an abnormal model is constructed according to the data characteristics of the training data.

[0106] Step 172: Input the data features into the anomaly model to obtain the status results.

[0107] In the embodiment of the present invention, the data features are input into the abnormal model, so as to determine the state result corresponding to the data features based on the correspondence between the data features and the abnormal state and the normal state in the abnormal model, wherein the state result includes the abnormal state and the normal state.

[0108] Step 173: Based on the status result, determine the operating status of each application system.

[0109] In an embodiment of the present invention, when an abnormality is detected in an application system, the system will automatically trigger an early warning and send an early warning notification to relevant personnel through various channels, such as email, text message, instant messaging, etc. At the same time, it is necessary to establish an early warning response process and plan to quickly handle and solve the problem. In actual application, the effect of anomaly detection and early warning may be affected by various factors. Therefore, it is necessary to continuously optimize and adjust anomaly detection and early warning to improve its accuracy and reliability. The effect of anomaly detection and early warning can be improved by continuously adjusting model parameters, updating training data, and optimizing early warning rules.

[0110] In one embodiment, step 120 may be specifically implemented as follows: performing data cleansing on the application data to obtain cleansed application data; converting the cleansed application data into a preset format to obtain converted application data; and performing filling processing on the converted application data to obtain pre-processed application data.

[0111] In the embodiment of the present invention, in order to remove noise and irrelevant information in the application data, it is necessary to perform data cleaning on the application data, mainly to remove noise and irrelevant information in the data. Then, in order to ensure the uniform format of the application data, it is necessary to convert the format of the cleaned application data, wherein data conversion is to convert the data into a uniform format and type. Since there are missing data and abnormal data in the converted application data, the missing data can be supplemented and the abnormal data can be replaced with normal data according to the rules of the data in the preset time period. Through data preprocessing, the quality and availability of the data can be improved.

[0112] In one embodiment, after step 120, the application system monitoring method based on the operation and maintenance big model can be specifically implemented as follows: determine the data containing user information and the data containing operation information in the preprocessed application data in each application system; map the data containing user information and the data containing operation information to obtain mapped application data; step 130 can be specifically implemented as follows: extract data features of the mapped application data.

[0113] In the embodiment of the present invention, since some of the collected data have no association, the data containing user information and the data containing operation information can be mapped and associated, that is, each application system corresponds to data containing user information and data containing operation information, so the data containing user information and the data containing operation information can be mapped, so that the operation corresponding to each user can be determined. Then, the data features of the mapped application data are extracted comprehensively, thereby improving the efficiency and speed of data feature extraction.

[0114] In one embodiment, after step 120, the application system monitoring method based on the operation and maintenance big model can be specifically implemented as follows: determining the real-time data stream in the preprocessed application data; based on the stream processing framework, performing data processing on the real-time data stream to obtain the real-time processed application data; step 130 can be specifically implemented as follows: extracting data features of the real-time processed application data.

[0115] In the embodiments of the present invention, real-time data stream refers to a data sequence that is continuously generated over time and needs to be processed immediately. In order to quickly process the real-time data stream in the application data, real-time data stream processing technology can be used to process the real-time data stream. Real-time data stream processing technology can realize the collection, processing and analysis of real-time data, as well as rapid response to emergencies. For example, using message queues and stream processing technologies, such as Apache Kafka and Apache Storm, real-time data stream processing and monitoring can be realized.

[0116] The present invention can process the real-time data stream through a stream processing framework. The stream processing framework can be used as a processing window, and the window passes through the real-time data stream in sequence according to the time sequence of the real-time data stream, and performs data processing on the real-time data stream in the window.

[0117] In one embodiment, after step 120, the application system monitoring method based on the operation and maintenance big model can be specifically implemented as follows: based on the K-means algorithm, the preprocessed application data is clustered to obtain clustered application data; and the clustered application data is plotted into a scatter plot.

[0118] In an embodiment of the present invention, the present invention can cluster the preprocessed application data. The K-means algorithm mainly divides the observation points in the data set into K clusters in an iterative manner, so that each data point belongs to the cluster where the cluster center closest to it is located. When clustering the preprocessed application data, the K-means algorithm can reveal the hidden structure in the data, which is used to understand the distribution and characteristics of the data. The present invention plots the clustered application data into a scatter plot, so that the dynamics of the data can be intuitively obtained. The present invention can also present complex analysis and model results to the user in an intuitive manner through visualization tools such as dashboards, charts, etc. At the same time, through interactive analysis, users can dynamically adjust parameters and models and observe the changes and impacts of data in real time. Through data visualization and interactive analysis, the user experience and participation can be improved.

[0119] In addition, the present invention can use a distributed file system and column storage technology to store preprocessed application data. In order to support the storage and rapid query of massive data, efficient data storage and indexing technology needs to be adopted. For example, using a distributed file system and column storage technology, such as Hadoop Distributed File System (HDFS) and Apache Cassandra, the storage and management of massive data can be achieved. At the same time, using a search engine and indexing technology, such as Elasticsearch, rapid query and retrieval of data can be achieved.

[0120] In addition, based on the extracted features, machine learning algorithms can be used to model and analyze the data. For example, methods such as time series analysis, cluster analysis, and association rule mining can be used to conduct in-depth analysis of the data and mine patterns and laws in the data. At the same time, predictive models such as support vector machines and neural networks can be built to predict future system states and potential risks. Through data modeling and analysis, in-depth understanding and prediction of multiple application systems can be achieved; in the process of data processing and analysis, the constructed model needs to be evaluated and optimized. Model evaluation can evaluate the accuracy and generalization ability of the model through methods such as cross-validation, confusion matrix, and ROC curve. Model optimization is to improve the performance and effect of the model by adjusting the parameters, structure, and algorithm of the model. Through model evaluation and optimization, it can be ensured that the constructed model has high accuracy and reliability; based on the results of data processing and analysis, it is necessary to interpret and transform them to support the decision-making of operation and maintenance personnel. Result interpretation is to transform the output and prediction of the model into understandable and actionable conclusions and suggestions. Decision support is to provide decision support and guidance based on the results of the interpretation to help operation and maintenance personnel make correct decisions and operations. Through result interpretation and decision support, the results of data analysis can be transformed into actual operation and maintenance value.

[0121] Figure 3 FIG. 1 is a schematic diagram of the structure of an application system monitoring device based on an operation and maintenance large model provided by an exemplary embodiment of the present invention. Figure 3 As shown, the application system monitoring device based on the operation and maintenance big model includes: a first acquisition module 201, used to acquire application data generated by multiple application systems; a preprocessing module 202, used to preprocess the application data to obtain preprocessed application data; an extraction module 203, used to extract data features of the preprocessed application data; a second acquisition module 204, used to acquire monitoring targets; a determination module 205, used to determine key indicators based on the monitoring targets and classify the key indicators to obtain classified key indicators; a construction module 206, used to construct an indicator system based on the classified key indicators and monitoring targets; wherein each key indicator in the indicator system corresponds to a monitoring rule; a monitoring module 207, used to monitor the data features according to the monitoring rules to determine the operating status of each application system.

[0122] The embodiment of the present invention provides an application system monitoring device based on an operation and maintenance big model, comprising: a first acquisition module acquires application data generated by multiple application systems, a preprocessing module preprocesses the application data to obtain preprocessed application data, an extraction module extracts data features of the preprocessed application data, a second acquisition module acquires monitoring targets, a determination module determines key indicators based on the monitoring targets and classifies the key indicators to obtain classified key indicators, and a construction module constructs an indicator system based on the classified key indicators and monitoring targets, wherein each key indicator in the indicator system corresponds to a monitoring rule, and the monitoring module monitors the data features according to the monitoring rules to determine the operating status of each application system. By extracting the data features of the preprocessed application data and monitoring the data features based on the data features and the indicator system, if the data features are abnormal, then the application system corresponding to the data features is abnormal, so there is no need to manually monitor the data of the application systems one by one, ensuring that the abnormal application system is quickly determined, and the abnormal application system is maintained and adjusted.

[0123] Figure 4 FIG. 1 is a schematic diagram of the structure of an application system monitoring device based on an operation and maintenance large model provided by another exemplary embodiment of the present invention. Figure 4As shown, the construction module 206 may include: a setting unit 2061, which is used to take the monitoring target as the tree root; a category determination unit 2062, which is used to determine the category corresponding to the classified key indicator; a first division unit 2063, which is used to divide the tree root into multiple branches; wherein each branch corresponds to a category; a second division unit 2064, which is used to divide the branch corresponding to each category into multiple sub-branches; wherein each sub-branch corresponds to a classified key indicator; a rule monitoring unit 2065, which is used to obtain the monitoring rules corresponding to the classified key indicator; a construction unit 2066, which is used to construct an indicator system according to the tree root, multiple branches, the classified key indicators, multiple sub-branches and multiple monitoring rules.

[0124] In one embodiment, the rule monitoring unit 2065 can be specifically configured as follows: setting monitoring thresholds and benchmark values ​​corresponding to each classified key indicator; constructing a monitoring interval based on the monitoring thresholds and benchmark values; wherein the monitoring module 207 can be specifically configured as follows: if the characteristic value of a data feature does not satisfy the monitoring interval, then determining that the operating state of the application system corresponding to the data feature is an abnormal state.

[0125] In one embodiment, the monitoring module 207 may be specifically configured as follows: constructing an abnormal model based on monitoring rules; inputting data features into the abnormal model to obtain status results; and determining the operating status of each application system based on the status results.

[0126] In one embodiment, the monitoring module 207 can be specifically configured as follows: obtaining test data of multiple test application systems; determining abnormal data and normal data in the test data based on monitoring rules; selecting a preset number of data from the abnormal data and normal data as training data; extracting training data features of the training data; and constructing an abnormal model based on the data features of the training data based on a neural network algorithm.

[0127] In one embodiment, the preprocessing module 202 can be specifically configured to: perform data cleansing on the application data to obtain cleaned application data; convert the cleaned application data into a preset format to obtain converted application data; and perform filling processing on the converted application data to obtain preprocessed application data.

[0128] In one embodiment, after the preprocessing module 202, the application system monitoring based on the operation and maintenance big model can be specifically configured as follows: determining the data containing user information and the data containing operation information in the preprocessed application data in each application system; mapping the data containing user information and the data containing operation information to obtain mapped application data; wherein the extraction module 203 can be specifically configured as follows: extracting data features of the mapped application data.

[0129] In one embodiment, after the preprocessing module 202, the application system monitoring based on the operation and maintenance big model can be specifically configured as: determining the real-time data flow in the preprocessed application data; based on the stream processing framework, performing data processing on the real-time data flow to obtain the real-time processed application data; wherein, the extraction module 203 can be specifically configured as: extracting the data features of the real-time processed application data.

[0130] In one embodiment, after the preprocessing module 202, the application system monitoring based on the operation and maintenance big model can be specifically configured as follows: based on the K-means algorithm, the preprocessed application data is clustered to obtain clustered application data; and the clustered application data is plotted into a scatter plot.

[0131] Figure 5 A block diagram of an electronic device according to an embodiment of the present application is illustrated.

[0132] like Figure 5 As shown, the electronic device 10 includes one or more processors 11 and a memory 12 .

[0133] The processor 11 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 10 to perform desired functions.

[0134] The memory 12 may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 11 may run the program instructions to implement the application system monitoring method based on the operation and maintenance large model of each embodiment of the present application described above and / or other desired functions. Various contents such as input signals, signal components, noise components, etc. may also be stored in the computer-readable storage medium.

[0135] In one example, the electronic device 10 may further include: an input device 13 and an output device 14, and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0136] When the electronic device 10 is a stand-alone device, the input device 13 may be a communication network connector for receiving collected input signals from the first device and the second device.

[0137] In addition, the input device 13 may also include, for example, a keyboard, a mouse, etc.

[0138] The output device 14 can output various information to the outside, including the determined distance information, direction information, etc. The output device 14 can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0139] Of course, to simplify, Figure 5 Only some of the components related to the present application in the electronic device 10 are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the electronic device 10 may also include any other appropriate components.

[0140] The computer program product may be written in any combination of one or more programming languages ​​to write program codes for performing the operations of the embodiments of the present application, including object-oriented programming languages, such as Java, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0141] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0142] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present application to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

[0143] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for monitoring an application system based on a large operation and maintenance model, characterized in that: include: Obtain application data generated by multiple application systems; Preprocessing the application data to obtain preprocessed application data; Extracting data features of the preprocessed application data; Get monitoring targets; Based on the monitoring objectives, key indicators are determined and the key indicators are classified to obtain classified key indicators; Based on the classified key indicators and the monitoring objectives, an indicator system is constructed; wherein each key indicator in the indicator system corresponds to a monitoring rule; According to the monitoring rules, the data features are monitored to determine the operating status of each application system.

2. The application system monitoring method based on the operation and maintenance big model according to claim 1 is characterized in that: The constructing of the indicator system based on the classified key indicators and the monitoring objectives includes: Taking the monitoring target as the tree root; Determine the categories corresponding to the classified key indicators; Dividing the tree root into multiple branches, wherein each branch corresponds to a category; Divide the branch corresponding to each category into multiple sub-branches; each sub-branch corresponds to a key indicator after classification; Obtain monitoring rules corresponding to the classified key indicators; An indicator system is constructed according to the tree root, the multiple branches, the classified key indicators, the multiple sub-branches and the multiple monitoring rules.

3. The application system monitoring method based on the operation and maintenance big model according to claim 2 is characterized in that: The monitoring rules corresponding to the key indicators after classification are obtained include: Set monitoring thresholds and benchmark values ​​for each classified key indicator; Constructing a monitoring interval according to the monitoring threshold and the reference value; Wherein, monitoring the data features according to the monitoring rules to determine the operating status of each application system includes: If the characteristic value of the data characteristic does not satisfy the monitoring interval, it is determined that the running state of the application system corresponding to the data characteristic is an abnormal state.

4. The application system monitoring method based on the operation and maintenance big model according to claim 1 is characterized in that: The monitoring of the data features according to the monitoring rules to determine the operating status of each application system includes: Based on the monitoring rules, construct an anomaly model; Inputting the data features into the anomaly model to obtain a status result; Based on the status results, the operating status of each application system is determined.

5. The application system monitoring method based on the operation and maintenance big model according to claim 4 is characterized in that: The constructing of an abnormal model based on the monitoring rules includes: Obtain test data for multiple test application systems; Based on the monitoring rules, determining abnormal data and normal data in the test data; Selecting a preset number of data from the abnormal data and normal data as training data; extracting training data features of the training data; Based on the neural network algorithm, an abnormal model is constructed according to the data characteristics of the training data.

6. The application system monitoring method based on the operation and maintenance big model according to claim 1 is characterized in that: The preprocessing of the application data to obtain preprocessed application data includes: Performing data cleaning on the application data to obtain cleaned application data; Converting the cleaned application data into a preset format to obtain converted application data; The converted application data is filled to obtain pre-processed application data.

7. The application system monitoring method based on the operation and maintenance big model according to claim 1 is characterized in that: After the application data is preprocessed to obtain the preprocessed application data, the method further includes: Determining data containing user information and data containing operation information in the preprocessed application data in each application system; Mapping the data containing the user information and the data containing the operation information to obtain mapped application data; The step of extracting data features of the preprocessed application data includes: The data features of the mapped application data are extracted.

8. The application system monitoring method based on the operation and maintenance big model according to claim 1 is characterized in that: After the application data is preprocessed to obtain the preprocessed application data, the method further includes: Determining a real-time data stream in the preprocessed application data; Based on the stream processing framework, data processing is performed on the real-time data stream to obtain real-time processed application data; The step of extracting data features of the preprocessed application data includes: Extracting data features of the real-time processed application data.

9. The application system monitoring method based on the operation and maintenance big model according to claim 1 is characterized in that: After the application data is preprocessed to obtain the preprocessed application data, the method further includes: Based on the K-means algorithm, cluster the preprocessed application data to obtain clustered application data; The clustered application data is plotted into a scatter plot.

10. An application system monitoring device based on an operation and maintenance big model, characterized in that: include: A first acquisition module is used to acquire application data generated by multiple application systems; A preprocessing module, used for preprocessing the application data to obtain preprocessed application data; An extraction module, used for extracting data features of the preprocessed application data; The second acquisition module is used to acquire the monitoring target; A determination module, used to determine key indicators based on the monitoring target and classify the key indicators to obtain classified key indicators; A construction module, used to construct an indicator system based on the classified key indicators and the monitoring objectives; wherein each key indicator in the indicator system corresponds to a monitoring rule; The monitoring module is used to monitor the data features according to the monitoring rules to determine the operating status of each application system.

Images