Equipment monitoring method, electronic equipment and computer readable storage medium
By obtaining the trend of equipment performance indicators and determining the scope of equipment performance indicators, the problem of poor equipment monitoring flexibility and unable to discover hidden safety hazards in existing technology, and achieve better equipment monitoring results.
Patent Information
- Application Number
- CN202411365551.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-27
- Publication Date
- 2025-01-21
AI Technical Summary
The prior art adopts a fixed threshold method in equipment monitoring, which has poor flexibility and cannot detect safety hazards in the equipment in a timely manner, resulting in poor equipment monitoring effect.
By obtaining the equipment performance index trend of the target equipment, the equipment performance index range is determined, and the equipment is monitored based on this range, and then the safety hazards existing in the equipment are observed.
It improves the flexibility and effectiveness of equipment monitoring, enables timely discovery of equipment safety hazards, and solves the problem of poor equipment monitoring effectiveness under fixed threshold mode.
Smart Images
Figure CN119336592A_ABST
Abstract
Description
Technical Field
[0001] The present application belongs to the field of computers, and specifically relates to a device monitoring method, an electronic device, and a computer-readable storage medium. Background Art
[0002] In daily network operation and maintenance, it is usually necessary to monitor the multi-dimensional performance indicators of massive business equipment, and timely discover problems with business equipment and issue alarms by monitoring performance indicators. If problems with business equipment are not discovered in time, it will have a significant impact on business development. Therefore, how to effectively implement equipment monitoring is a very important issue.
[0003] When related technologies implement fault alarms through monitoring equipment, they usually monitor equipment indicators by setting fixed thresholds. This method has poor flexibility and can only be used to discover performance problems of equipment, but cannot promptly discover safety hazards of equipment, resulting in poor equipment monitoring effects. Summary of the invention
[0004] The embodiments of the present application provide a device monitoring method, an electronic device, and a computer-readable storage medium, which can solve the problem of poor device monitoring effect in the related art.
[0005] In a first aspect, an embodiment of the present application provides a device monitoring method, including: Acquire a first log of a target device, where the first log includes a device performance indicator value of the target device at a target time point; Acquire a device performance indicator trend of the target device, where the device performance indicator trend is used to indicate a change trend of the device performance indicator of the target device in a first time period; wherein the target time point is outside the first time period; Based on the device performance indicator trend, determining a device performance indicator range of the target device in a second time period; wherein the target time point is within the second time period; Based on the device performance indicator range of the target device in the second time period and the device performance indicator value of the target device at the target time point, a monitoring result of the target device is obtained.
[0006] In a second aspect, an embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the method described in the first aspect are implemented.
[0007] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed, the steps of the method described in the first aspect are implemented.
[0008] In a fourth aspect, an embodiment of the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the method described in the first aspect.
[0009] At least one of the above technical solutions provided in the embodiments of the present application can achieve the following technical effects: In an embodiment of the present application, a first log of a target device is obtained, the first log including a device performance indicator value of the target device at a target time point; a device performance indicator trend of the target device is obtained, the device performance indicator trend is used to indicate a trend of changes in the device performance indicators of the target device in a first time period; wherein the target time point is outside the first time period; based on the device performance indicator trend, a range of device performance indicators of the target device in a second time period is determined; wherein the target time point is within the second time period; based on the device performance indicator range of the target device in the second time period and the device performance indicator value of the target device at the target time point, a monitoring result of the target device is obtained. In this way, in the process of monitoring the target device, the device performance indicator trend of the target device is first obtained, and the device performance indicator range of the target device in the second time period is determined based on the device performance indicator trend. Then, the target device can be monitored based on the device performance indicator range of the target device. Compared with the method of monitoring device performance indicators using fixed thresholds in related technologies, this method monitors the target device through the device performance indicator trend of the target device, that is, the target device is monitored by observing the device indicator change trend of the target device in the first time period, and the potential safety hazards of the device can be observed. The equipment monitoring effect is better, which solves the problem of poor equipment monitoring effect in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS
[0010] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.
[0011] Figure 1 is a flow chart of a device monitoring method provided by an embodiment of the present application; Figure 2is a flow chart of another device monitoring method provided by an embodiment of the present application; Figure 3 It is a schematic diagram of the overall concept of a device monitoring method provided in an embodiment of the present application; Figure 4 It is a specific flow chart of a device monitoring method provided in an embodiment of the present application; Figure 5 It is a structural block diagram of a device monitoring device provided in an embodiment of the present application; Figure 6 It is a structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0012] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0013] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.
[0014] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0015] The device monitoring method provided in the embodiment of the present application can be performed by an electronic device, which can be one electronic device or multiple electronic devices. That is to say, the device monitoring method provided in the embodiment of the present application can be performed by one electronic device, wherein the electronic device can be a terminal device such as a desktop computer, a laptop computer, a mobile phone, a tablet, etc., or a server, such as an independent physical server, a server cluster composed of multiple servers, and a cloud server capable of cloud computing. In the case where the device monitoring method provided in the embodiment of the present application is performed by multiple electronic devices, these multiple electronic devices can form a service cluster, which cooperate with each other to complete each step.
[0016] The device monitoring method provided in the embodiment of the present application is applied to the monitoring of devices during network operation and maintenance. Specifically, the device performance indicator trend of the target device is first obtained, and the device performance indicator range of the target device in the second time period is determined based on the device performance indicator trend, and then the target device can be monitored based on the device performance indicator range of the target device.
[0017] The device monitoring method provided in the embodiment of the present application is described in detail below through specific embodiments and their application scenarios in conjunction with the accompanying drawings.
[0018] See also Figure 1 , Figure 1 : is a flow chart of a device monitoring method provided by an embodiment of the present application. Figure 1 As shown, the method comprises the following steps: Step 110: Acquire a first log of a target device, where the first log includes a device performance indicator value of the target device at a target time point.
[0019] In an embodiment of the present application, the target device is a device to be monitored, and the target device may include multiple business devices. That is, monitoring of a large number of business devices can be achieved. The device performance indicators of the target device can be monitored by distributing a log monitoring script to the target device to obtain the first log of the target device, and the log monitoring script may be, for example, a python script. Alternatively, the first log can also be obtained by querying the device performance indicator value at the target time point and forwarding it.
[0020] In the process of monitoring the device performance indicators of the target device, the multi-dimensional device performance indicators of the target device can be monitored, and the multi-dimensional device performance indicators can be device performance indicators such as CPU usage, memory usage or disk usage. By monitoring the multi-dimensional device performance indicators of the target device, logs of the multi-dimensional device performance indicators can be obtained.
[0021] Specifically, the first log may include the monitoring time, indicator name and indicator value of the device performance indicator. For example, refer to the following examples, ((202405230856,cpu), (48)), ((202405230856,mem), (56)), ((202405230856,disk), (23)) and ((202405230857,cpu), (14)), "cpu" is used to indicate CPU usage, "mem" is used to indicate memory usage, and "disk" is used to indicate disk usage. The first example is used to indicate that the CPU usage is 48% at 8:56 on May 23, 2024.
[0022] The monitoring time is the target time point. In the actual process of monitoring the multi-dimensional device performance indicators of the target device, the accuracy of the target time point can be hours or minutes. If real-time monitoring of device performance indicators is required, the target time point can be used to indicate the indicator value of the device performance indicator within a certain second.
[0023] Step 120: Acquire a device performance indicator trend of the target device, where the device performance indicator trend is used to indicate a device performance indicator change trend of the target device in a first time period; wherein the target time point is outside the first time period.
[0024] In an embodiment of the present application, the device performance indicator trend may be used to indicate a change trend of an indicator value of a device performance indicator of a target device within a first time period. The first time period may be a historical time period. For example, the first time period may be a historical 7 days, and the device performance indicator trend may be used to indicate a change trend of an indicator value of a device performance indicator of a target device within the historical 7 days.
[0025] The target time point is outside the first time period. For example, if the first time period is 7 days in history, the target time point can be used to indicate a time point today. That is, compared with any time point in the first time period, the target time point is a time point closer to the current time point.
[0026] Exemplarily, in one embodiment of the present application, the device performance indicator trend of the target device can be obtained in the following manner: obtaining the device performance indicator trend of the target device from a target database; wherein the target database stores the device performance indicator trend of the target device, the device performance indicator trend of the target device is determined based on the device performance indicator value of the target device within a first time period, and the device performance indicator value of the target device within the first time period is obtained by collecting through a monitoring script.
[0027] In an embodiment of the present application, the work log of the target device can be collected in real time through a monitoring script to obtain the work log of the target device in the first time period. The log structure of the work log is similar to the first log, that is, the work log includes the device performance indicator value of the target device in the first time period.
[0028] In an embodiment of the present application, after collecting the device performance indicator value of the target device within the first time period, the device performance indicator trend of the target device within the first time period can be determined based on the device performance indicator value of the target device within the first time period, and the device performance indicator trend of the first time period can be stored in a target database to facilitate subsequent monitoring of the target device at the target time point.
[0029] Specifically, the work log of the target device in the first time period can be obtained through the data analysis and calculation tool, from which the index values of the multi-dimensional device performance indicators (such as CPU usage, memory usage, and disk usage) of the target device in the first time period are obtained, so as to analyze the usage of the multi-dimensional device performance indicators and determine the device performance indicator trend of the target device in the first time period. The data analysis and calculation tool can be, for example, Spark, which is a distributed computing tool that can be used in various data processing scenarios such as SQL, machine learning, graph processing, and stream processing.
[0030] In the process of determining the device performance indicator trend of the target device within the first time period, the device performance indicator may include multi-dimensional device performance indicators, and for each dimension of the multi-dimensional device performance indicators, the indicator value of the device performance indicator of the dimension may be averaged. The following description is made using CPU usage as an example. The first time period may be divided into multiple first time periods according to a fixed time period length, and for any one of the multiple first time periods, the CPU usage of all time points within the first time period may be averaged to obtain the CPU usage average of the target device within the first time period. The device performance indicator trend of the target device within the first time period is determined by the CPU usage within the multiple first time periods. After spark generates the device performance indicator trend of the target device within the first time period, the device performance indicator trend may be stored in a target database, which may be, for example, a redis database.
[0031] In addition, the device performance index trend changes with the change of the first time period. For example, the device performance index trend obtained by the device performance index values from June 1 to June 7 may be different from the device performance index trend obtained by the device performance index values from June 2 to June 8. The device performance index trend stored in the target database may be updated according to the latest acquired device performance index trend, so as to obtain the device performance index trend of the updated date from the target database. In fact, Spark may obtain the device performance index trend based on the device performance index values of the historical time period every day, and store the device performance index trend in the target database.
[0032] Step 130: Based on the device performance indicator trend, determine the device performance indicator range of the target device in the second time period; wherein the target time point is within the second time period.
[0033] In an embodiment of the present application, the second time period and the first time period may be time periods close to each other on the time axis, and the second time period and the first time period have no overlapping parts in time. Since the first time period is close to the second time period, there is usually no large difference in the index value between the device performance index value of the target device in the first time period and the device performance index value in the second time period. For example, the device performance index value of the target device between 2 pm and 3 pm is usually not much different from the device performance index value of the target device between 3 pm and 4 pm. Therefore, the device performance index range of the target device in the second time period can be estimated by obtaining the device performance index trend of the target device in the first time period.
[0034] Exemplarily, in one embodiment of the present application, the first time period is a historical time period, the device performance indicator trend is obtained based on the device performance indicator value of the target device in the historical time period, and the second time period is a time period after the first time period.
[0035] In an embodiment of the present application, the device performance indicator trend of the target device can be determined based on the device performance indicator value of the target device in the first time period, and the device performance indicator range of the target device in the second time period after the first time period can be determined through the device performance indicator trend.
[0036] For example, it is currently June 6th, the first time period may be June 1st to June 5th, and the second time period may be June 6th to June 7th. That is to say, the device performance indicator trend of the target device can be determined by the device performance indicator value of the target device from June 1st to June 5th, and the device performance indicator range of the target device from June 6th to June 7th can be determined through the device performance indicator trend.
[0037] In one embodiment of the present application, the equipment performance indicator trend is in the form of an equipment performance indicator trend curve, and the equipment performance indicator trend curve is used to predict the equipment performance indicator range of a future time period, and the future time period includes the second time period.
[0038] In the embodiment of the present application, in fact, the device performance index value of the target device usually has an implicit change trend, and the index value in a certain time period is usually high, and the index value in another time period is usually low. For example, the CPU usage rate of the target device is usually high during the day, and the CPU usage rate of the target device is low at night. Therefore, based on the device performance index trend of the target device in the first time period, the device index performance value of the target device in the future time period can be predicted.
[0039] In an embodiment of the present application, the device performance trend may be in the form of a device performance trend curve, which is obtained based on the device performance indicator value of the target device in a historical time period. Regression analysis can be performed on the device performance trend curve to predict the device performance indicator range of the target device in a future time period.
[0040] In one embodiment of the present application, the device performance indicator trend is not limited to the form of a curve. In fact, the device performance indicator trend can be in any form that can achieve trend observation, for example, the device performance indicator trend can also be in the form of a table.
[0041] Step 140: Obtain a monitoring result of the target device based on the device performance indicator range of the target device in the second time period and the device performance indicator value of the target device at the target time point.
[0042] In the embodiment of the present application, the device performance indicator range of the target device in the second time period and the device performance indicator value of the target device at the target time point can be matched to determine whether the device performance indicator value of the target device at the target time point is within the device performance indicator range. If the device performance indicator value is within the device performance indicator range, it is determined that the device performance indicator value of the target device is within the normal range, and the monitoring result of the target device is determined to be normal.
[0043] When the device performance index value is not within the device performance index range, it can be preliminarily determined that the device performance index value of the target device is abnormal. In order to avoid misjudgment, the error value between the device performance index value and the device performance index range can be determined, and it can be further determined whether the error value is less than a preset error threshold.
[0044] Among them, when the error value is less than the error threshold, since the error value is too small, the error value of the device performance index value can be ignored, and the device performance index of the target device is determined to be within the normal range, and the monitoring result of the target device is determined to be normal. When the error value is greater than the error threshold, since the error value is large, the error value of the device performance index value cannot be ignored at this time, and it can be determined that the device performance index of the target device is within the abnormal range. The abnormal behavior may be caused by the attack on the target device, and the target device may have a security risk problem. The monitoring result of the target device is determined to be abnormal, and an alarm signal can be generated to notify the relevant person in charge to further investigate and solve the problem.
[0045] Exemplarily, in one embodiment of the present application, the device monitoring method, in addition to steps 110 to 140, further includes: obtaining a second log of the target device, the second log containing text content related to the performance of the target device; obtaining a target dictionary table, the target dictionary table including error keywords; based on the target dictionary table, determining whether there are text errors in the text content; and in the event that there are text errors in the text content, performing alarm processing on the target device.
[0046] In the embodiment of the present application, in fact, when monitoring the performance indicators of the target device, the text log of the target device, i.e., the second log, can also be obtained. The second log is obtained by monitoring the target indicator set for the target device, and the target indicator is different from the device performance indicator, such as the ping indicator. The second log may include the monitoring time, the indicator name and the log content. The monitoring time is the generation time of the log content. The log content may include the work log related to the monitoring indicator, such as a successful login log or a failed login log.
[0047] In fact, after distributing the log monitoring script to the target device, the device performance log of the target device can be obtained. After obtaining the device performance log, the device performance log can be parsed first, and the device performance log can be labeled according to the parsed result, and the device performance log can be divided into a first log and a second log. The log structure of the first log can be: time, indicator name and indicator value, and the log structure of the second log can be: time, indicator name and log content.
[0048] For the second log, the target dictionary table can be used to check the error keywords of the second log. The target dictionary table includes error keywords, and the target operation and maintenance personnel can add, delete, modify and query the error keywords through the target dictionary table. In addition, different error keywords can be configured according to different types of target indicators to facilitate the target operation and maintenance personnel to maintain the target dictionary table.
[0049] In an embodiment of the present application, it can be determined whether there are error keywords in the target dictionary table in the second log. In the case where there are error keywords in the target dictionary table in the second log, an alarm signal can be generated based on the existing error keywords, and the alarm signal is used to notify relevant persons in charge to conduct timely investigation. In the case where there are no error keywords in the target dictionary table in the second log, it can be determined that the target indicator of the target device is in a normal state.
[0050] In an embodiment of the present application, by setting a target dictionary table, the target operation and maintenance personnel can add, delete, modify and query the error keywords through the target dictionary table, which is convenient for the target operation and maintenance personnel to maintain and manage the error keywords.
[0051] In an embodiment of the present application, a first log of a target device is obtained, the first log including a device performance indicator value of the target device at a target time point; a device performance indicator trend of the target device is obtained, the device performance indicator trend is used to indicate a trend of changes in the device performance indicators of the target device in a first time period; wherein the target time point is outside the first time period; based on the device performance indicator trend, a range of device performance indicators of the target device in a second time period is determined; wherein the target time point is within the second time period; based on the device performance indicator range of the target device in the second time period and the device performance indicator value of the target device at the target time point, a monitoring result of the target device is obtained. In this way, in the process of monitoring the target device, the device performance indicator trend of the target device is first obtained, and the device performance indicator range of the target device in the second time period is determined based on the device performance indicator trend. Then, the target device can be monitored based on the device performance indicator range of the target device. Compared with the method of monitoring device performance indicators using fixed thresholds in related technologies, this method monitors the target device through the device performance indicator trend of the target device, that is, the target device is monitored by observing the device indicator change trend of the target device in the first time period, and the potential safety hazards of the device can be observed. The equipment monitoring effect is better, which solves the problem of poor equipment monitoring effect in related technologies.
[0052] See also Figure 2 , Figure 2 is a flow chart of another device monitoring method provided by an embodiment of the present application. Figure 2 As shown, the method comprises the following steps: Step 210: Acquire a first log of a target device, where the first log includes a device performance indicator value of the target device at a target time point.
[0053] Step 220: Acquire a device performance indicator trend of the target device, where the device performance indicator trend is used to indicate a device performance indicator change trend of the target device in a first time period; wherein the target time point is outside the first time period.
[0054] Step 230: Based on the device performance indicator trend, determine the device performance indicator range of the target device in the second time period; wherein the target time point is within the second time period.
[0055] In the embodiment of the present application, after determining the device performance index range of the target device in the second time period, it is further determined whether the device performance index value of the target device at the target time point is within the device performance index range of the target device in the second time period. If the device performance index value of the target device at the target time point is within the device performance index range, the following step 240 is executed; if the device performance index value of the target device at the target time point is not within the device performance index range, the following step 250 is executed.
[0056] Step 240: If the device performance indicator value of the target device at the target time point is within the device performance indicator range of the target device in the second time period, it is determined that the monitoring result of the target device is normal.
[0057] In the embodiment of the present application, the device performance indicator of the target device may include multi-dimensional device performance indicators, such as CPU usage, memory usage, and disk usage. For any device performance indicator of the multi-dimensional device performance indicators, it can be determined whether the device performance indicator of each dimension is in a normal state. When all device performance indicators of the target device are in a normal state, it can be determined that the monitoring result of the target device is normal.
[0058] Taking CPU usage as an example, if the CPU usage of the target device at the target time point is 50%, and the device performance indicator range of CPU usage is 40% to 60%, it can be determined that the CPU usage of the target device is in a normal state.
[0059] Step 250: If the device performance indicator value of the target device at the target time point is outside the device performance indicator range of the target device in the second time period, determine that the monitoring result of the target device is abnormal.
[0060] In the embodiment of the present application, for any one dimension of the multi-dimensional device performance indicators, it can be determined whether the device performance indicators of each dimension are in an abnormal state. If a device performance indicator of a certain dimension among the device performance indicators of the target device is in an abnormal state, it can be determined that the monitoring result of the target device is abnormal, and an alarm signal can be generated for the device performance indicator in the abnormal state, so as to promptly notify the relevant responsible personnel to conduct cause investigation and maintenance.
[0061] Taking CPU usage as an example, if the CPU usage of the target device at the target time point is 70%, and the device performance indicator range of CPU usage is 40% to 60%, it can be determined that the CPU usage of the target device is in an abnormal state.
[0062] Exemplarily, in one embodiment of the present application, the device monitoring method, in addition to steps 210 to 250, further includes: counting the number of times the monitoring results of the target device are abnormal; when the number of times the monitoring results of the target device are abnormal exceeds a threshold, performing alarm processing on the target device.
[0063] In the embodiment of the present application, in order to avoid the occurrence of false alarm events, during the monitoring process of the target device, the number of abnormalities in the monitoring results of the target device can be counted. When multiple abnormalities (exceeding the threshold) appear in the monitoring results of the target device in succession, an alarm signal can be generated to notify the relevant responsible personnel to handle it. In this case, the alarm signal has a higher credibility and can avoid the occurrence of false alarms. The threshold can be set according to experience during the operation, for example, the threshold can be set to 3.
[0064] In an embodiment of the present application, the device performance indicator range of the target device is determined by the device performance indicator trend of the target device within the first time period to judge the device performance indicator value of the target device at the target time point. Compared with the judgment through a fixed threshold, this method can more flexibly observe the problems existing in the target device and discover the potential safety hazards that may be hidden in the target device. At the same time, real-time monitoring of the target device can be achieved, thereby improving the work efficiency of equipment monitoring.
[0065] See also Figure 3 and Figure 4 , Figure 3 is a schematic diagram of the overall concept of a device monitoring method provided in an embodiment of the present application, Figure 4 It is a specific flow chart of a device monitoring method provided in an embodiment of the present application.
[0066] The following combination Figure 3The system is described with specific examples, and log monitoring scripts (python scripts) can be distributed to multiple target devices to monitor the multi-dimensional device performance indicators of multiple target devices to obtain real-time device performance logs of multiple target devices. For any one of the multiple target devices, the real-time device performance log of the target device is obtained, and the real-time device performance log is parsed, and the real-time device performance log is labeled according to the parsing result of the real-time device performance log. The indicators are divided into two categories: device performance indicators and target indicators through labels. Among them, the device performance indicators include indicators such as CPU usage, memory usage, and disk usage memory, and the target indicators may be, for example, ping indicators.
[0067] The log structure of the first log output for the device performance indicator is: time, indicator name, indicator value. The log structure of the second log output for the target indicator is: time, indicator name, log content. The first log and the second log are reported to the KAFKA message middleware and the distributed file system (Hadoop Distributed File System, HDFS) at the same time. Among them, the KAFKA message middleware is a distributed messaging system. At the same time, Figure 3 The offline log data in the includes the first log and the second log in the cold storage.
[0068] The embodiment of the present application provides a page for configuring a target dictionary table. By configuring the target dictionary table, different error keywords can be configured for different indicators. The page for configuring the target dictionary table can facilitate target operation and maintenance personnel to maintain error keywords.
[0069] like Figure 3 As shown, Spark can be used to read the first log and the second log of the seven days of history stored in the HDFS system every day. Spark is a distributed computing tool that can be used in various data processing scenarios such as SQL, machine learning, graph processing, and stream processing. Then, the target dictionary table can be obtained, and the second log can be filtered by the error keywords configured in the target dictionary table.
[0070] When error keywords in the target dictionary table exist in the second log, a daily machine performance error report can be generated based on the error keywords in the second log. The machine performance errors can be used to provide error report statistical analysis for relevant persons in charge. At the same time, the machine performance errors can also facilitate archiving queries and attribute equipment abnormalities.
[0071] For the first log, the first log includes the device performance indicator value, from which the usage of the device performance indicators (such as CPU usage, memory usage, disk usage and other device performance indicators) can be analyzed. Then, the time and indicator name in the first log can be used as the key in the tuple, and the indicator value can be used as the value in the tuple to calculate the average of the indicator values of the device performance indicators of the same dimension. And generate a daily device performance indicator trend curve, and write the device performance indicator trend curve into redis. The device performance indicator trend curve can provide a range benchmark for the performance data analysis of the day. Among them, redis is a memory data structure storage, usually used as a database.
[0072] Spark provides a component for streaming computing on real-time data, namely Figure 3 Sparkstreaming in. The first log and the second log can be read from the KAFKA message middleware through Spark streaming. At the same time, the error keywords in the target dictionary table can be read, and the normal range benchmark (that is, the equipment performance indicator range mentioned above) analyzed the previous day can be read from redis. For the first log, if there is a device performance indicator value of a certain dimension in the first log that exceeds the normal range benchmark, an exception is recorded once, and the abnormal monitoring result is written to redis. Once three consecutive abnormal monitoring results are observed, an alarm signal is generated and sent to the relevant responsible person. For the second log, if there is an error keyword in the target dictionary table in the target indicator of a certain dimension in the second log, an alarm signal is generated and sent to the relevant responsible person.
[0073] By implementing the device monitoring method in the above manner, real-time performance detection of massive devices can be achieved under the condition of read-write separation of the redis database, thereby improving the work efficiency of target operation and maintenance personnel in discovering problems in a timely manner.
[0074] like Figure 4 As shown, the device monitoring method provided in the embodiment of the present application includes the following steps: Step 410: Obtain a first log of a target device, where the first log includes a device performance indicator value of the target device at a target time point.
[0075] Step 420: Obtain a device performance indicator trend of the target device from a target database, where the device performance indicator trend is used to indicate a device performance indicator change trend of the target device in a first time period; wherein the target time point is outside the first time period.
[0076] The target database stores the equipment performance indicator trend of the target device, which is determined based on the equipment performance indicator value of the target device in a first time period, and the equipment performance indicator value of the target device in the first time period is collected by a monitoring script.
[0077] Step 430: Based on the device performance indicator trend, determine the device performance indicator range of the target device in the second time period; wherein the target time point is within the second time period.
[0078] In the embodiment of the present application, the first time period is a historical time period, the device performance index trend is obtained based on the device performance index value of the target device in the historical time period, and the second time period is a time period after the first time period. The device performance index trend is in the form of a device performance index trend curve, and the device performance index trend curve is used to predict the device performance index range of a future time period, and the future time period includes the second time period.
[0079] In the embodiment of the present application, after determining the device performance index range of the target device in the second time period, it is further determined whether the device performance index value of the target device at the target time point is within the device performance index range of the target device in the second time period. If the device performance index value of the target device at the target time point is within the device performance index range, the following step 440 is executed; if the device performance index value of the target device at the target time point is not within the device performance index range, the following step 450 is executed.
[0080] Step 440: If the device performance indicator value of the target device at the target time point is within the device performance indicator range of the target device in the second time period, it is determined that the monitoring result of the target device is normal.
[0081] Step 450: If the device performance indicator value of the target device at the target time point is outside the device performance indicator range of the target device in the second time period, determine that the monitoring result of the target device is abnormal.
[0082] Step 460: Count the number of times the monitoring result of the target device is abnormal.
[0083] Step 470: When the number of abnormalities in the monitoring result of the target device exceeds a threshold, an alarm is processed for the target device.
[0084] In addition to the above-mentioned steps 410 to 470, the device monitoring method provided in the embodiment of the present application also includes: obtaining a second log of the target device, the second log containing text content related to the performance of the target device; obtaining a target dictionary table, the target dictionary table including error keywords; based on the target dictionary table, determining whether there is a text error in the text content; and in the case of a text error in the text content, performing alarm processing on the target device.
[0085] In an embodiment of the present application, a first log of a target device is obtained, the first log including a device performance indicator value of the target device at a target time point; a device performance indicator trend of the target device is obtained, the device performance indicator trend is used to indicate a trend of changes in the device performance indicators of the target device in a first time period; wherein the target time point is outside the first time period; based on the device performance indicator trend, a range of device performance indicators of the target device in a second time period is determined; wherein the target time point is within the second time period; based on the device performance indicator range of the target device in the second time period and the device performance indicator value of the target device at the target time point, a monitoring result of the target device is obtained. In this way, in the process of monitoring the target device, the device performance indicator trend of the target device is first obtained, and the device performance indicator range of the target device in the second time period is determined based on the device performance indicator trend. Then, the target device can be monitored based on the device performance indicator range of the target device. Compared with the method of monitoring device performance indicators using fixed thresholds in related technologies, this method monitors the target device through the device performance indicator trend of the target device, that is, the target device is monitored by observing the device indicator change trend of the target device in the first time period, and the potential safety hazards of the device can be observed. The equipment monitoring effect is better, which solves the problem of poor equipment monitoring effect in related technologies.
[0086] It is important to understand that Figures 1 to 4 The explanations of the same or corresponding steps in the above may refer to each other. For example, Figure 1 The explanation of step 110 and step 120 in Figure 2 Step 210 and step 220 in .
[0087] At the same time, it should be understood that a device monitoring method provided in an embodiment of the present application can have the following beneficial effects: First, the device monitoring method provided in an embodiment of the present application can realize real-time performance detection of massive devices, and improve the work efficiency of target operation and maintenance personnel in timely discovering problems. Second, the device monitoring method provided in an embodiment of the present application provides a target dictionary table, which is convenient for target maintenance personnel to add, delete, modify and query error keywords. Third, the device monitoring method provided in an embodiment of the present application can generate a device performance index trend every day, and the device performance index trend can provide a range benchmark for performance data analysis, rather than monitoring the index based on a fixed threshold. If the CPU usage rate increases abnormally at night, this phenomenon usually has no effect on the performance of the device and may be a network security risk problem. The method based on a fixed threshold cannot timely detect the network security risk problem, and the device monitoring method provided in an embodiment of the present application can better detect such problems. Fourth, for situations that exceed the range of device performance indicators, an alarm signal is generated only after multiple consecutive occurrences, which can avoid false alarm events.
[0088] See also Figure 5 , Figure 5 is a structural block diagram of a device monitoring device provided in an embodiment of the present application. Figure 5 As shown, an embodiment of the present application provides a device monitoring apparatus 500 , and the device monitoring apparatus 500 includes: an acquisition module 510 , a determination module 520 and a monitoring module 530 .
[0089] The acquisition module 510 is used to acquire a first log of a target device, wherein the first log includes a device performance indicator value of the target device at a target time point; and acquire a device performance indicator trend of the target device, wherein the device performance indicator trend is used to indicate a change trend of the device performance indicator of the target device in a first time period; wherein the target time point is outside the first time period; The determination module 520 is used to input the question information and the auxiliary information into a language processing model to obtain a response result corresponding to the question information.
[0090] The monitoring module 530 is used to obtain a monitoring result of the target device based on a device performance indicator range of the target device in the second time period and a device performance indicator value of the target device at a target time point.
[0091] In an embodiment of the present application, a first log of a target device is obtained, the first log including a device performance indicator value of the target device at a target time point; a device performance indicator trend of the target device is obtained, the device performance indicator trend is used to indicate a trend of changes in the device performance indicators of the target device in a first time period; wherein the target time point is outside the first time period; based on the device performance indicator trend, a range of device performance indicators of the target device in a second time period is determined; wherein the target time point is within the second time period; based on the device performance indicator range of the target device in the second time period and the device performance indicator value of the target device at the target time point, a monitoring result of the target device is obtained. In this way, in the process of monitoring the target device, the device performance indicator trend of the target device is first obtained, and the device performance indicator range of the target device in the second time period is determined based on the device performance indicator trend. Then, the target device can be monitored based on the device performance indicator range of the target device. Compared with the method of monitoring device performance indicators using fixed thresholds in related technologies, this method monitors the target device through the device performance indicator trend of the target device, that is, the target device is monitored by observing the device indicator change trend of the target device in the first time period, and the potential safety hazards of the device can be observed. The equipment monitoring effect is better, which solves the problem of poor equipment monitoring effect in related technologies.
[0092] The equipment monitoring device provided in the embodiment of the present application can implement each process implemented in the above method embodiment, and will not be described again here to avoid repetition.
[0093] like Figure 6As shown, an embodiment of the present application also provides an electronic device 600. The electronic device 600 includes: a processor 610 and a memory 620, and the memory 620 stores a program or instruction, and the program or instruction is executed by the processor 610 to implement the steps of any of the methods described above. For example, when the program is executed by the processor 610, the following process is implemented: obtaining a first log of the target device, the first log contains the device performance indicator value of the target device at the target time point; obtaining the device performance indicator trend of the target device, the device performance indicator trend is used to indicate the device performance indicator change trend of the target device in the first time period; wherein the target time point is outside the first time period; based on the device performance indicator trend, determining the device performance indicator range of the target device in the second time period; wherein the target time point is within the second time period; based on the device performance indicator range of the target device in the second time period and the device performance indicator value of the target device at the target time point, obtaining the monitoring result of the target device. In this way, in the process of monitoring the target device, the device performance indicator trend of the target device is first obtained, and the device performance indicator range of the target device in the second time period is determined based on the device performance indicator trend. Then, the target device can be monitored based on the device performance indicator range of the target device. Compared with the method of monitoring device performance indicators using fixed thresholds in related technologies, this method monitors the target device through the device performance indicator trend of the target device, that is, the target device is monitored by observing the device indicator change trend of the target device in the first time period, and the potential safety hazards of the device can be observed. The equipment monitoring effect is better, which solves the problem of poor equipment monitoring effect in related technologies.
[0094] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of each embodiment of the device monitoring method are implemented and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.
[0095] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.
[0096] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
[0097] An embodiment of the present application provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement the various processes of the above-mentioned method embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
[0098] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.
[0099] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.
[0100] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.
Claims
1. A device monitoring method, characterized in that: include: Acquire a first log of a target device, where the first log includes a device performance indicator value of the target device at a target time point; Acquire a device performance indicator trend of the target device, where the device performance indicator trend is used to indicate a change trend of the device performance indicator of the target device in a first time period; wherein the target time point is outside the first time period; Based on the device performance indicator trend, determining a device performance indicator range of the target device in a second time period; wherein the target time point is within the second time period; Based on the device performance indicator range of the target device in the second time period and the device performance indicator value of the target device at the target time point, a monitoring result of the target device is obtained.
2. The method according to claim 1, characterized in that The first time period is a historical time period, the device performance indicator trend is obtained based on the device performance indicator value of the target device in the historical time period, and the second time period is a time period after the first time period.
3. The method according to claim 1 or 2, characterized in that: The obtaining the monitoring result of the target device based on the device performance indicator range of the target device in the second time period and the device performance indicator value of the target device at the target time point includes: If the device performance index value of the target device at the target time point is within the device performance index range of the target device in the second time period, determining that the monitoring result of the target device is normal; If the device performance indicator value of the target device at the target time point is outside the device performance indicator range of the target device in the second time period, it is determined that the monitoring result of the target device is abnormal.
4. The method according to claim 3, characterized in that After obtaining the monitoring result of the target device, the method further includes: Counting the number of times the monitoring result of the target device is abnormal; When the number of abnormalities in the monitoring result of the target device exceeds a threshold, an alarm is performed on the target device.
5. The method according to claim 1, characterized in that The obtaining of the device performance indicator trend of the target device includes: Acquire a device performance indicator trend of the target device from a target database; The target database stores the equipment performance indicator trend of the target device, which is determined based on the equipment performance indicator value of the target device in a first time period, and the equipment performance indicator value of the target device in the first time period is collected by a monitoring script.
6. The method according to claim 1, characterized in that The equipment performance indicator trend is in the form of an equipment performance indicator trend curve, and the equipment performance indicator trend curve is used to predict the equipment performance indicator range of a future time period, and the future time period includes the second time period.
7. The method according to claim 1, characterized in that The method further comprises: Acquire a second log of the target device, where the second log contains text content related to the performance of the target device; Obtaining a target dictionary table, wherein the target dictionary table includes error keywords; Based on the target dictionary table, determining whether there is a text error in the text content; In the case where there is a text error in the text content, an alarm process is performed on the target device.
8. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a program or instruction running on the processor, and when the program or instruction is executed by the processor, the steps of the method according to any one of claims 1 to 7 are implemented.
9. A computer-readable storage medium, characterized in that: The medium stores a program or an instruction, and when the program or the instruction is executed, the steps of the method according to any one of claims 1 to 7 are implemented.
10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 7 when being executed by a processor.