Data processing method and device, storage medium and electronic equipment

Abstract

The invention discloses a data processing method and device, a storage medium and electronic equipment, and relates to the technical field of data processing.The data processing method comprises the steps that operation and maintenance data associated with information technology IT equipment is obtained firstly, and the operation and maintenance data comprises an operation and maintenance operation instruction, operation and maintenance operation log data and transaction alarm data; detecting whether the operation and maintenance data is abnormal or not according to a preset data loss stopping rule; if it is detected that the operation and maintenance data are abnormal, corresponding loss stopping measures are executed according to the type of the abnormal data, and the loss stopping measures comprise an interception guiding loss stopping measure and a driving loss stopping measure. Compared with the prior art, the method has the advantages that the operation and maintenance data are detected according to the data loss stopping rule, the abnormal data are processed through the loss stopping measures, dangerous instructions can be captured and stopped in time before the fault occurs, effective curing and safety reinforcement can be carried out in time after the fault occurs, and the safety of the operation and maintenance data is improved. And the operation stability and the service continuity of the IT equipment are improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data processing method, device, storage medium and electronic device. Background Art

[0002] By entering operation instructions, IT equipment can be managed and controlled, so that IT equipment can run efficiently and stably and meet various business needs. However, abnormal data may be generated in the process of entering instructions in IT equipment. These abnormal data may be caused by various reasons, including input errors, system failures, abnormal operations, etc., which may affect the normal operation of the system and may also cause data loss, security vulnerabilities and business interruptions.

[0003] At present, for these abnormal data and common fault information, most of them can only rely on conventional process rules and operating experience, and use manual monitoring and alarm methods to limit operation and maintenance operation instructions.

[0004] However, this manual monitoring and alarm method can only rely on conventional process rule requirements and operating experience to perform abnormal analysis on operation and maintenance data, and cannot detect, judge and effectively intercept abnormal operations and fault data before a fault occurs. Summary of the invention

[0005] In view of this, the present application provides a data processing method, device, storage medium and electronic device, the main purpose of which is to improve the current technical problem of being unable to detect, judge and effectively intercept abnormal operations and fault data before a fault occurs.

[0006] In a first aspect, the present application provides a data processing method, comprising:

[0007] Obtaining operation and maintenance data associated with IT equipment, the operation and maintenance data including operation and maintenance operation instructions, operation and maintenance operation log data, and abnormal alarm data;

[0008] According to the preset data stop loss rules, detect whether the operation and maintenance data is abnormal;

[0009] If an abnormality is detected in the operation and maintenance data, corresponding stop-loss measures are executed according to the type of abnormal data, and the stop-loss measures include interception and guidance stop-loss measures and driving stop-loss measures.

[0010] In a second aspect, the present application provides a data processing device, comprising:

[0011] An acquisition module is configured to acquire operation and maintenance data associated with IT equipment, wherein the operation and maintenance data includes operation and maintenance operation instructions, operation and maintenance operation log data, and abnormal change alarm data;

[0012] A detection module is configured to detect whether the operation and maintenance data has an abnormality according to a preset data stop loss rule;

[0013] The execution module is configured to execute corresponding stop-loss measures according to the type of abnormal data if an abnormality is detected in the operation and maintenance data. The stop-loss measures include interception and guidance stop-loss measures and driving stop-loss measures.

[0014] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0015] In a fourth aspect, the present application provides an electronic device, comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the method described in the first aspect when executing the computer program.

[0016] In a fifth aspect, the present application provides a computer program product having a computer program stored thereon, wherein the computer program implements the method described in the first aspect when executed by a processor.

[0017] By means of the above technical scheme, the present application provides a data processing method, device, storage medium and electronic device, which first obtains the operation and maintenance data associated with the IT equipment, wherein the operation and maintenance data includes operation and maintenance operation instructions, operation and maintenance operation log data, and abnormal alarm data; then detects whether the operation and maintenance data has abnormalities according to the preset data stop-loss rules; if the operation and maintenance data is detected to have abnormalities, corresponding stop-loss measures are executed according to the type of abnormal data, wherein the stop-loss measures include interception and guidance stop-loss measures and driving stop-loss measures. Compared with the current existing technology, the present application detects the operation and maintenance data according to the data stop-loss rules, and processes the abnormal data using the corresponding stop-loss measures, ensuring that the capture and containment of dangerous instructions can be timely participated in before the failure occurs, and effective healing and safety reinforcement can be carried out in time after the failure occurs, and the safe operation of the front-line operation and maintenance personnel is guaranteed through stop-loss measures with dual protection capabilities, thereby improving the operating stability of IT equipment and the continuity of business.

[0018] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0020] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0021] Figure 1 A schematic diagram of a data processing method provided in an embodiment of the present application is shown;

[0022] Figure 2 A schematic diagram showing a flow chart of another data processing method provided in an embodiment of the present application is shown;

[0023] Figure 3 A schematic diagram of an example process provided by an embodiment of the present application is shown;

[0024] Figure 4 A schematic diagram of an example process provided by an embodiment of the present application is shown;

[0025] Figure 5 A schematic diagram of an example process provided by an embodiment of the present application is shown;

[0026] Figure 6 A structural schematic diagram of a data processing device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0027] The embodiments of the present application will be described in more detail below with reference to the accompanying drawings. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0028] In order to improve the current technical problem of being unable to detect and effectively intercept abnormal operations and fault data before a fault occurs. This embodiment provides a data processing method, such as Figure 1 As shown, the method includes:

[0029] Step 101: Obtain operation and maintenance data associated with IT equipment.

[0030] In some examples, operation and maintenance data includes not only real-time collected IT equipment data, but also operation and maintenance operation instructions, operation and maintenance operation log data, abnormal alarm data (or abnormal convergence data), associations between devices, etc. Among them, operation and maintenance operation instructions refer to specific commands or operation steps executed by operation and maintenance personnel or automation tools, which can be used to record all performed operations, facilitate auditing and tracking, automated scripts and task scheduling, and provide operation history during troubleshooting. Operation and maintenance operation log data records detailed information about operation and maintenance activities, including timestamps, executors, operation content, results, etc. For example, system logs record system startup, shutdown, error information, etc., and application logs record log information when applications are running, which can be used to monitor the system's operating status and performance indicators, and check whether there are unauthorized operations or potential security threats. Abnormal alarm data refers to alarm information generated when the system detects an abnormal situation, usually including alarm level, timestamp, affected equipment or services, alarm details, etc. Through abnormal alarm data, abnormal situations in the system can be discovered and responded to in a timely manner, and relevant personnel can be notified through emails, text messages, instant messages, etc., and by further analyzing historical alarm data, trends and common problems can be identified, and system configuration can be optimized. By obtaining and analyzing the above operation and maintenance data, and adding a data audit module to improve the integrity and accuracy of the data, the accuracy of reasoning abnormal faults can be greatly increased, the root cause of the problem can be effectively and quickly located, and the investment of subsequent operation and maintenance personnel can be reduced.

[0031] In the disclosed embodiments, the computing power warehouse may be a data center, a server room, or a part of a computing cluster that stores or manages computing power. The fault computing power warehouse may support access to operation and maintenance instructions, operation and maintenance log data, abnormal alarm data, etc. through File Transfer Protocol (FTP), Application Programming Interface (API), Elasticsearch (ES), Apache Kafka (KAFKA), etc. The acquisition of operation and maintenance data may include perceiving data quality through the system to ensure that data specifications are met, including format specifications, data desensitization, etc. If missing data is perceived, data completion may be completed intelligently and automatically according to data audit rules. It is also possible to connect the IT equipment forest distribution view network in series based on the automatically discovered IT equipment relationship view, so as to facilitate the later detection of equipment failures associated with the mesh topology, and display the fault overview of the operation and maintenance data in the IT equipment from a visual perspective.

[0032] Step 102: Detect whether the operation and maintenance data is abnormal according to the preset data stop loss rule.

[0033] For example, the collected data can be transmitted to the central management platform or directly to the fault computing warehouse through a secure channel by SdscAgent, and the fault computing warehouse detects the operation and maintenance data in combination with the data stop loss rule. The data stop loss rule can be a judgment logic based on the threshold. For example, if the operation and maintenance data contains consumption instruction data such as the central processing unit (CPU) is full and the memory overflows, it can be judged that the operation and maintenance data is abnormal.

[0034] Step 103: If an abnormality is detected in the operation and maintenance data, corresponding stop-loss measures are executed according to the type of abnormal data.

[0035] Among them, the stop loss measures include interception and guidance stop loss measures and driving stop loss measures. The difference between interception and guidance stop loss and driving stop loss is that when an abnormal instruction that does not comply with the rules appears before a fault occurs, interception and guidance stop loss must be mobilized. If the fault has occurred and is irreversible, driving stop loss will be mobilized to participate in the later stage, and the automated operation and maintenance will be linked to quickly reduce the fault time limit and repair it.

[0036] In some examples, when a fault is detected based on the detection method in step 102, the danger level of the current operation and maintenance operation can be determined based on data computing power inference, so as to select a matching interception guidance stop-loss module or a driving stop-loss module, and the automated operation and maintenance capabilities can be linked to perform emergency recovery actions, thereby shortening the duration of the fault impact and reducing the loss caused by the spread of the fault.

[0037] In some examples, by performing abnormal analysis on operation and maintenance data, effectively intercepting and guiding operation and maintenance analysis and judgment of abnormal operations and fault data, effective replay and security reinforcement can be achieved after a fault occurs. In addition, the data mining results and automated operation and maintenance capabilities are stretched and connected, and there is no need for experienced manual operation and maintenance intervention, which can achieve unattended operation and reduce the technical threshold for operation and maintenance.

[0038] Compared with the current existing technology, by applying the technical solution of this embodiment, the operation and maintenance data associated with the IT equipment is first obtained, wherein the operation and maintenance data includes operation and maintenance operation instructions, operation and maintenance operation log data, and abnormal alarm data; then, according to the preset data stop-loss rules, whether the operation and maintenance data is abnormal is detected; if the operation and maintenance data is detected to be abnormal, the corresponding stop-loss measures are executed according to the type of abnormal data, wherein the stop-loss measures include interception and guidance stop-loss measures and driving stop-loss measures. The operation and maintenance data is detected according to the data stop-loss rules, and the abnormal data is processed using the corresponding stop-loss measures to ensure that the capture and containment of dangerous instructions can be timely participated in before the failure occurs, and effective healing and safety reinforcement can be carried out in time after the failure occurs. The stop-loss measures with dual protection capabilities are used to ensure the safe operation of front-line operation and maintenance personnel, thereby improving the operating stability of IT equipment and the continuity of business.

[0039] In order to further illustrate the specific implementation process of the method of this embodiment, this embodiment provides the following Figure 2 The specific method shown includes:

[0040] Step 201: Obtain operation and maintenance data associated with IT equipment.

[0041] Among them, operation and maintenance data includes operation and maintenance operation instructions, operation and maintenance operation log data, and abnormal change alarm data.

[0042] For example, real-time monitoring of IT equipment hardware and software, computer room dynamic environment, camera equipment, etc. can be achieved by integrating monitoring tools into the operation and maintenance platform. These tools can collect the operating status data of the equipment and transmit the data to the operation and maintenance platform through efficient data transmission technology to achieve unified management and monitoring of the data. The operation and maintenance data collected by the monitoring tools can be stored on a centralized server. In order to ensure that the data can be smoothly transmitted between the monitoring tools and the operation and maintenance platform, APIs can be used to obtain operation and maintenance data to meet the needs of real-time data transmission.

[0043] In some examples, in order to improve the management efficiency and fault response speed of IT equipment, it is necessary to ensure that the collected data covers real-time collection data, operation and maintenance instructions, operation and maintenance log data, abnormal alarm data, and vertical (such as equipment hierarchical relationships) and horizontal (such as equipment association relationships) forest distribution views of IT equipment. The data is verified through multiple dimensions to ensure the accuracy of the data, so that the root cause of the fault can be quickly located and the impact of the fault on related equipment or business can be evaluated. By comprehensively managing and analyzing these operation and maintenance data, not only can the stability and security of the system be improved, but also the operation and maintenance efficiency can be improved and the operating costs can be reduced.

[0044] Optionally, the method of this embodiment may also include: aggregating and completing operation and maintenance data according to preset data audit rules; constructing a forest network model based on the operation and maintenance data, the forest network model showing the relationship between various production business links of IT equipment in the style of primitive forest shrubs.

[0045] In some examples, such as Figure 3 As shown, based on the IT equipment forest distribution view connected in series with the IT equipment relationship topology network, the three parts of data, namely, the operation and maintenance instructions, operation log data, and abnormal alarm data of the IT equipment are supplemented in the topology view formed by the terminal data through the fault computing warehouse, so as to facilitate the association of equipment failures through the mesh topology, and the IT equipment forest distribution view can be intuitively displayed from a visual perspective.

[0046] Exemplarily, data auditing means can be used to improve the attributes and missing relationships of operation and maintenance data. Specifically, the forest distribution view can be used to aggregate the collected IT equipment information resources based on the data auditing rules. Before supplementing the data of the IT equipment forest distribution view, the operation and maintenance data obtained from the API can be used to consider the high-frequency problems such as missing data attributes and disordered relationships. The collected data can be audited through preset data rules to see if there are any missing data. The data auditing rules are shown in Table 1. In the auditing mode, full auditing of operation and maintenance data attributes and relationships is supported, and the integrity and reliability of the data can also be audited one by one through the audit item classification. In order to make up for the data audit integrity, the data can be supplemented manually or by agreement.

[0047] Table 1

[0048]

[0049] In some examples, auditing based on data auditing rules ensures the integrity and relevance of operation and maintenance data. By pushing the operation and maintenance instruction data, operation log data, and abnormal alarm data associated with IT equipment to the IT equipment forest distribution view, and performing global 3D forest mesh modeling and rendering on the data, a plug-and-play forest mesh model that can observe the global deep forest appearance is formed. Compared with the traditional IT equipment topology map, the distribution of IT equipment is presented in the style of original forest shrubs, which realizes the visualization of operation and maintenance data, can clearly show the linkage relationship between various production business links, and has the ability to observe complex operation and maintenance scenarios.

[0050] Optionally, the above-mentioned construction of a forest network model based on operation and maintenance data may specifically include: based on the operation and maintenance data, connecting the geographical location of the IT equipment, the operating tasks it carries, the connected service devices and the flow direction to obtain a forest network model.

[0051] In some examples, each IT device can be defined as a node in the model based on operation and maintenance instructions, operation and maintenance log data, and abnormal alarm data. The node contains basic information such as the unique identification, name, and type of the device. The connection between nodes is defined based on the association relationship in the operation and maintenance data. Among them, these relationships can be physical connections (such as network connections, cable connections), logical connections (such as data dependencies, service calls), or business associations (such as the sequence in business processes). Then, a weight is assigned to each relationship based on the importance or closeness of the relationship. The weight can be used for subsequent fault location, impact analysis, etc., and then the mesh model is visualized using graphical tools to facilitate operation and maintenance personnel to intuitively understand the system structure.

[0052] Exemplarily, the geographical location of IT equipment, the tasks it carries out, the service devices it connects to, the flow direction, etc. are further interconnected, and a 3D forest mesh model is laid out, which visualizes the distribution of IT equipment in a way that is similar to that of an original forest shrub. The forest mesh model can intuitively display the associations, dependencies, and mutual influences between IT equipment, which helps operation and maintenance personnel better understand and analyze the operating status of the system, and promptly discover and resolve potential problems. Fault location: The mesh model can be used to quickly locate the fault point and its impact range, thereby improving the efficiency of fault handling. By analyzing the relationships and weights between nodes, the potential risks of the system can be assessed, providing a basis for the formulation of preventive measures. Based on the display and analysis results of the model, resource allocation can be optimized, resource utilization can be improved, and intuitive data support and basis can be provided for operation and maintenance decisions, thereby improving the scientificity and accuracy of decision-making.

[0053] In some examples, the accuracy and completeness of the model can be verified by comparing it with the actual operation and maintenance scenario. Based on the verification results, the model can be adjusted and optimized as necessary, such as adding missing nodes or relationships, correcting incorrect weights, etc. As the system develops and operation and maintenance data accumulates, the model is updated regularly to keep it synchronized with the actual system. Historical data analysis can also be performed on operation and maintenance data to identify common failure modes and performance bottlenecks, providing a basis for optimization.

[0054] Step 202: If the operation and maintenance data contains the loss instruction data indicated in the data stop loss rule, it is determined that the operation and maintenance data is abnormal.

[0055] In some examples, the wear command data can reveal the wear and tear of the equipment during operation in the equipment failure loss calculation and data collection. For example, as shown in Table 2, for different data types (operation and maintenance operation instructions, operation and maintenance operation logs, abnormal alarm data), the wear command data may include: Rm, mv, dd, fsck, mount, ORA-*, Crash, Exception, CPU full, memory overflow, host down, etc. Through wear command data and data analysis, enterprises can understand the causes and losses of equipment failures, and then formulate preventive measures and maintenance plans to improve the reliability and stability of equipment.

[0056] Table 2

[0057]

[0058] Exemplarily, based on the data interface API, the acquired IT equipment operation and maintenance operation instructions, operation and maintenance operation record logs, and abnormal alarm data are synchronized to the computing power warehouse. When a front-line operation and maintenance personnel performs dangerous instructions on IT equipment, the input information of the instruction is extracted and matched through the computing power warehouse (data stop loss rules) as shown in Table 2.

[0059] For example, when the operation and maintenance personnel have not executed the device input instructions, the computing power warehouse detects and determines whether there are risks and anomalies in the input loss instruction data. The detection method may include detecting the operation and maintenance operation instructions through SdscAgent detection, and detecting the operation and maintenance operation logs and abnormal alarm data through Kafka platform push. When it is detected that the operation and maintenance data input by the operation and maintenance personnel meets one of the loss instruction data in the stop loss rule, such as dd is detected in the operation and maintenance operation instruction, or memory overflow is detected in the abnormal alarm data, it can be determined that the current operation and maintenance data has an abnormality.

[0060] In some examples, based on real-time data collection, operation and maintenance logs and operation instructions, potential dangers can also be graded based on forest distribution views combined with data analysis and reasoning. The higher the danger level, the more urgent the response measures. Dangerous execution instructions can be intercepted in time by designing interception devices. During the interception process, combined with the operation and maintenance experience library associated with reasoning, interception methods and rule interpretations are provided to operation and maintenance operators to reduce the danger level and associated impact after the stop loss operation.

[0061] Step 203: If an abnormality is detected in the operation and maintenance data, corresponding stop-loss measures are executed according to the type of abnormal data.

[0062] Among them, the stop loss measures include interception guidance stop loss measures and driving stop loss measures. When an abnormal instruction that does not comply with the rules appears before a fault occurs, it is necessary to mobilize the interception guidance stop loss. If the fault has occurred and is irreversible, the driving stop loss will be mobilized to participate in the later stage, and the automated operation and maintenance will be linked to quickly reduce the fault time limit and repair it.

[0063] For example, in order to reduce the impact of failures on the business and the trial-and-error costs of operation and maintenance personnel, when destructive failures occur, mature automated operation and maintenance capabilities can be relied upon to quickly restore business. At the same time, dual protection capabilities (such as technical protection and process protection) are used to ensure the safe operation of operation and maintenance personnel, improve the stable operation capability and continuity of the business, and ensure that the business can be quickly restored in the face of failures. The experience gained in the fault handling process can also be platformized to form a reusable knowledge base. This not only helps to lower the skill threshold of operation and maintenance personnel, but also improves the team's overall fault response capabilities. Through the command interception mechanism and the strengthening of fault response and operation and maintenance capabilities, the management efficiency and fault response speed of IT equipment can be significantly improved, providing a strong guarantee for the stable operation of the business.

[0064] Optionally, step 203 may specifically include: if the type of abnormal data is an operation and maintenance instruction, executing interception and guidance stop-loss measures; if the type of abnormal data is operation and maintenance operation log data and / or abnormal change alarm data, executing driving stop-loss measures.

[0065] In some examples, if the type of abnormal data is an operation and maintenance instruction, the interception and guidance stop loss in the corresponding stop loss measures in Table 2 (data stop loss rules) can be used to intervene in advance, disconnect the Screen session window, and promptly cut off the operation and maintenance personnel from continuing to perform the operation, so as to effectively avoid hidden dangers before failure. At the same time, considering the problem of data omissions or huge data volume in the middle, the capture of loss instructions will eventually lead to the probability of failure. If the type of abnormal data is operation and maintenance operation log data and / or abnormal alarm data, the computing power warehouse can call the automated operation and maintenance capability plan scenario intervention after the failure through driving stop loss to perform one-click repair and disposal. The loss instruction data corresponding to the data type in the data stop loss rule can be customized through the configuration file, and the entire computing power warehouse capacity can be optimized and improved by continuously updating the configuration.

[0066] Exemplarily, based on the stop-loss measures, calling the algorithm warehouse algorithm to identify abnormalities and intervene in advance risks in time can effectively prevent the spread of risks. Based on the stop-loss measures, the computing warehouse intercepts three types of data, namely, operation and maintenance operation instructions, operation and maintenance operation logs, and abnormal alarm data, and implements stop-loss measures to reduce risks. When dealing with driving stop-loss measures, the computing warehouse focuses on operation and maintenance operation log data, abnormal alarm data, and operation and maintenance operation instructions. Using these data, combined with the detection capabilities of the computing warehouse and the fault self-healing scheduling mechanism, the quality requirements of two specific scenarios (interception-guided stop-loss scenarios and driving stop-loss scenarios) are monitored and identified by extracting data logs and using Kafka for data push. Specifically, when the operation and maintenance operation causes keywords related to loss instructions to appear in the log, and these keywords are associated with resource relationships in abnormal convergence data, the computing warehouse will determine that a fault has occurred. Once the fault is confirmed, the computing warehouse will immediately call the driving stop-loss measures to intervene according to the preset stop-loss measures rules. During the fault handling process, the computing warehouse will also call the corresponding emergency repair plan from the solution library based on the information derived from the fault. This step is aimed at achieving rapid handling and recovery of the fault, thereby minimizing the impact of the fault. In this way, the computing warehouse can effectively respond to the challenges in driving loss prevention measures and ensure the stability and reliability of the system.

[0067] In some examples, such as Figure 4As shown, when an operation and maintenance personnel receives a job task, they can log in to the server and execute the technical stack instructions according to the requirements of the job task. The content of the instructions may involve the loss instruction data in the stop-loss measures. Once the operation and maintenance personnel input instructions involving loss instructions, the instructions fall into the system session layer, and the current session log is passed to the faulty computing power warehouse through the SdscAgent detection method. Since the computing power warehouse turns on the actual measurement mode in real time, the host of the operation and maintenance operation will be continuously detected, including whether there is an abnormal change alarm on the host and whether the historical data includes loss disk data. When a danger is detected, the computing power warehouse will turn on the interception and guidance stop-loss mode, and pop up the interception guidance box before the instruction is issued. Afterwards, the driving stop-loss is mobilized to complete the emergency repair action to achieve recovery.

[0068] Optionally, the above-mentioned execution of driving loss prevention measures may specifically include: conducting iterative analysis in combination with abnormal alarm data and historical wear and tear disk data, and making a comprehensive time series prediction of resource performance trends and fault ranges of IT equipment through algorithm exponential displacement; determining fault scenarios based on resource performance trends and fault ranges; and eliminating the root causes of faults using healing rules corresponding to the fault scenarios.

[0069] In some examples, for driving stop loss, it is necessary to perform iterative analysis based on abnormal data and historical data, conduct comprehensive prediction of time series through algorithm index displacement, give early warning of insufficient performance problems, and process abnormal data in advance to avoid affecting the business system. At the same time, it can flexibly detect inefficient host resources and take inefficient and low-energy hosts offline to achieve cost reduction and efficiency improvement.

[0070] Exemplarily, the scope of the fault can be predicted based on simple exponential smoothing technology, including using the data benchmark of the current stage to predict the next time period and a certain point in time, wherein the data benchmark of the current stage uses the weighted average of the observed value and the predicted value (the predicted value based on historical performance data, i.e., the value of the previous time) at the current moment as the estimated value of the current level.

[0071] For example, the virtual machine system is subject to the performance of input / output (IO), concentrated burst failures and business volume fluctuations, which are prone to performance bottlenecks and data skew problems, which may often lead to the occurrence of business system failures. Therefore, it is necessary to predict resource performance in advance to avoid system failures. Performance indicators are the main core indicators for judging the performance of storage, usually involving indicators such as disk insertion and writing rate, virtual configuration inflation explosion trend, and network fluctuation. In this scenario, by analyzing the historical data of host performance indicators, a reasonable prediction of future host resource trends can be achieved to avoid the problems of excessive local load of the host and uneven overall resource allocation, and the intervention self-healing operation and maintenance guarantee process of the overall host system can be planned in advance, such as optimizing resource consumption processes, application service fuses, and diversion. The intelligent agent algorithm model is used for the scope and probability of failure after the occurrence, and the maximum probability of the failure relationship type can be found through the algorithm improved by exponential displacement.

[0072] Exemplarily, the algorithm index displacement can be calculated by the following formula:

[0073] S0=x0 (Formula 1)

[0074]

[0075] Among them, S0 is the first smoothed value, x0 is the first observed value, and x m is the mth observation value, S m-1 is the m-1th smoothing value, is the predicted value of the mth observation. The loss function is defined as shown in Formula 4. α is the smoothing coefficient (weight). Since the parameter α is unknown, the predicted value of the parameter α can be obtained by minimizing SSE (α). Based on this algorithm, the critical point cycle duration of the failure occurring in the trend and time stage is calculated. When the value reaches a certain critical point, and the failure scenario classified by the critical point is within the healing rules shown in Table 3, such as failure of operation and maintenance instruction interception, performance inflation explosion trend of 100%, application hang trend showing 0, etc., the healing power can be mobilized through the API to take corresponding healing operations for the fault scenario, such as Umount uninstallation / mount mounting, kill / restore process ID, Rm / backup alternation, diversion service healing, killing high-consumption resource applications, restart healing, etc.

[0076] Table 3

[0077]

[0078]

[0079] For example, the faulty computing warehouse divides the handling of impending accidents and the handling of accidents after they occur into two stop-loss measures, as follows: The first interception and guidance stop-loss measures are as follows: Figure 5 As shown in the figure, it is detected that the manual instruction input and the backend configuration instruction are the same before the incident, and the dangerous instruction can be correctly identified and cannot be issued for execution. Therefore, the algorithm warehouse will restrict the operation and maintenance personnel from pressing Enter to execute a certain instruction operation through interception. After the operation and maintenance operation enters the instruction, the instruction may contain unsupervised dangerous operation instructions such as Rm, dd, and fsck. Through the session mode of the operating system, the real-time online input instructions are detected, and the session data of a certain time difference is returned to the computing power warehouse for comparison. When the fault computing warehouse receives the data of the screen session, the dangerous instructions of the backend library will be traversed and queried in the session. The data dictionary of the background can support custom extensions and bad improvement strategies. When the computing power warehouse traverses and matches the dangerous information, there is no need for approval or other notifications. The authority will be directly called to restrict the operation instructions executed by the current operation and maintenance personnel, and the operation and maintenance personnel will not be able to execute the instruction again. Another driving stop loss measure is to prevent the fault computing power warehouse from missing during the interception and guidance process when a large number of manual instructions are entered. By continuously measuring abnormal alarm data and the historical logs transmitted back, it is determined whether there is a fault that needs to be intervened. The abnormal alarm data includes key information such as CPU full, memory overflow, host down, etc. Once a fault leak affects the business and the operation safety of the host, the algorithm warehouse will call the driving stop loss measure to intervene and perform healing actions, so as to reduce the subsequent fault to the minimum level.

[0080] Compared with the current existing technology, by applying the technical solution of this embodiment, the operation and maintenance data of IT equipment is visualized using the forest distribution view, which is convenient for operation and maintenance personnel to intuitively understand the system structure, detect the operation and maintenance data according to the data stop loss rules, and use the corresponding stop loss measures to process abnormal data, ensuring that dangerous operation and maintenance instructions are detected before the failure occurs, and the stop loss rule module intervenes in advance to intercept, and timely participate in the capture and containment of dangerous instructions. After the failure occurs, the operation and maintenance experience library can also be dispatched in time for automatic repair and healing, so as to achieve effective healing and security reinforcement. The stop loss measures with dual protection capabilities ensure the safe operation of front-line operation and maintenance personnel, thereby improving the operational stability of IT equipment and the continuity of business.

[0081] Further, as Figure 1 and Figure 2 The specific implementation of the method shown in this embodiment provides a data processing device, such as Figure 6 As shown, the device includes: an acquisition module 31, a detection module 32, and an execution module 33.

[0082] The acquisition module 31 is configured to acquire operation and maintenance data associated with the IT equipment, wherein the operation and maintenance data includes operation and maintenance operation instructions, operation and maintenance operation log data, and abnormal alarm data;

[0083] The detection module 32 is configured to detect whether the operation and maintenance data is abnormal according to a preset data stop loss rule;

[0084] The execution module 33 is configured to execute corresponding stop-loss measures according to the type of abnormal data if an abnormality is detected in the operation and maintenance data. The stop-loss measures include interception and guidance stop-loss measures and driving stop-loss measures.

[0085] In some examples of this embodiment, the detection module 32 is specifically configured to determine that there is an abnormality in the operation and maintenance data if there is loss instruction data indicated in the data stop loss rule in the operation and maintenance data.

[0086] In some examples of this embodiment, the acquisition module 31 is specifically configured to aggregate and complete the operation and maintenance data according to preset data audit rules; based on the operation and maintenance data, a forest network model is constructed, and the forest network model displays the relationship between various production business links of the IT equipment in the style of primitive forest shrubs.

[0087] In some examples of this embodiment, the acquisition module 31 is further specifically configured to connect in series the geographical location, operating tasks, connected service devices and traffic trends of the IT equipment based on the operation and maintenance data to obtain the forest network model.

[0088] In some examples of this embodiment, the execution module 33 is specifically configured to execute interception and guidance stop-loss measures if the type of the abnormal data is an operation and maintenance operation instruction; if the type of the abnormal data is operation and maintenance operation log data and / or abnormal change alarm data, then execute driving stop-loss measures.

[0089] In some examples of this embodiment, the execution module 33 is further specifically configured to perform iterative analysis in combination with the abnormal alarm data and the historical consumption disk data, and to make a comprehensive time series prediction of the resource performance trend and fault range of the IT equipment through algorithm exponential displacement; determine the fault scenario based on the resource performance trend and the fault range; and eliminate the root cause of the fault using the healing rules corresponding to the fault scenario.

[0090] It should be noted that the data processing device provided in this embodiment and other corresponding descriptions of the functional units involved can be referred to in Figure 1 and Figure 2 The corresponding description in will not be repeated here.

[0091] Based on the above Figure 1 and Figure 2The method shown in the embodiment also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned Figure 1 and Figure 2 The method shown.

[0092] Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, USB flash drive, mobile hard disk, etc.), including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods of various implementation scenarios of the present application.

[0093] Based on the above Figure 1 and Figure 2 The method shown, and Figure 6 In order to achieve the above-mentioned purpose, the embodiment of the present application also provides an electronic device, such as a personal computer, a server, a laptop computer, an intelligent robot or other intelligent terminal, which includes a storage medium and a processor; the storage medium is used to store a computer program; the processor is used to execute the computer program to achieve the above-mentioned Figure 1 and Figure 2 The method shown.

[0094] Optionally, the above-mentioned physical device may also include a user interface, a network interface, a camera, a radio frequency (RF) circuit, a sensor, an audio circuit, a WI-FI module, etc. The user interface may include a display, an input unit such as a keyboard, etc., and the optional user interface may also include a USB interface, a card reader interface, etc. The network interface may optionally include a standard wired interface, a wireless interface (such as a WI-FI interface), etc.

[0095] Those skilled in the art will appreciate that the above-mentioned physical device structure provided in this embodiment does not constitute a limitation on the physical device, and may include more or fewer components, or a combination of certain components, or different arrangements of components.

[0096] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the above-mentioned physical device, and supports the operation of the information processing program and other software and / or programs. The network communication module is used to realize the communication between the components inside the storage medium, and the communication with other hardware and software in the information processing physical device.

[0097] Through the description of the above implementation methods, the technical personnel in this field can clearly understand that the present application can be implemented by means of software plus the necessary general hardware platform, or by hardware. By applying the scheme of this embodiment, compared with the current existing technology, the method of this embodiment uses a forest distribution view to visualize the operation and maintenance data of IT equipment, which is convenient for operation and maintenance personnel to intuitively understand the system structure, detect the operation and maintenance data according to the data stop loss rules, and use the corresponding stop loss measures to process abnormal data, ensuring that dangerous operation and maintenance instructions are detected before the failure occurs, and the stop loss rule module intervenes in advance to intercept, and timely participate in the capture and containment of dangerous instructions, and after the failure occurs, the operation and maintenance experience library can be dispatched in time to automatically repair and cure, so as to achieve effective healing and security reinforcement. The stop loss measures with dual protection capabilities ensure the safe operation of front-line operation and maintenance personnel, thereby improving the operating stability of IT equipment and the continuity of business.

[0098] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0099] The above is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features applied for herein.

Claims

1. A data processing method, characterized in that: include: Obtaining operation and maintenance data associated with information technology IT equipment, the operation and maintenance data including operation and maintenance operation instructions, operation and maintenance operation log data, and abnormal alarm data; According to the preset data stop loss rules, detect whether the operation and maintenance data is abnormal; If an abnormality is detected in the operation and maintenance data, corresponding stop-loss measures are executed according to the type of abnormal data, and the stop-loss measures include interception and guidance stop-loss measures and driving stop-loss measures.

2. The method according to claim 1, characterized in that The detecting whether the operation and maintenance data is abnormal according to the preset data stop loss rule includes: If the operation and maintenance data contains the loss instruction data indicated in the data stop loss rule, it is determined that the operation and maintenance data is abnormal.

3. The method according to claim 1, characterized in that The method further comprises: Aggregate and complete the operation and maintenance data according to the preset data audit rules; Based on the operation and maintenance data, a forest network model is constructed, and the forest network model displays the correlation relationship between various production business links of the IT equipment in the style of original forest bushes.

4. The method according to claim 3, characterized in that The step of constructing a forest network model based on the operation and maintenance data includes: Based on the operation and maintenance data, the geographical location, the operating tasks carried out, the connected service devices and the flow direction of the IT equipment are connected in series to obtain the forest network model.

5. The method according to claim 1, characterized in that The corresponding stop loss measures are executed according to the type of abnormal data, including: If the type of the abnormal data is an operation and maintenance instruction, interception and guidance stop loss measures are executed; If the type of the abnormal data is operation and maintenance log data and / or abnormal alarm data, driving loss prevention measures are executed.

6. The method according to claim 5, characterized in that The implementation of driving loss prevention measures includes: Iterative analysis is performed on the abnormal alarm data and the historical consumption data, and a comprehensive time series prediction of the resource performance trend and fault range of the IT equipment is performed through algorithm index displacement; Determine a fault scenario according to the resource performance trend and the fault scope; Eliminate the root cause of the fault using the cure rule corresponding to the fault scenario.

7. A data processing device, characterized in that: include: An acquisition module is configured to acquire operation and maintenance data associated with information technology IT equipment, wherein the operation and maintenance data includes operation and maintenance operation instructions, operation and maintenance operation log data, and abnormal change alarm data; A detection module is configured to detect whether the operation and maintenance data has an abnormality according to a preset data stop loss rule; The execution module is configured to execute corresponding stop-loss measures according to the type of abnormal data if an abnormality is detected in the operation and maintenance data. The stop-loss measures include interception and guidance stop-loss measures and driving stop-loss measures.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

9. An electronic device comprising a storage medium, a processor, and a computer program stored in the storage medium and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product having a computer program stored thereon, characterized in that: When the computer program product is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images