Service monitoring method, model training method, equipment, medium and product

Abstract

The invention provides a service monitoring method, a model training method, equipment, a medium and a product, and relates to the field of artificial intelligence, and the service monitoring method comprises the steps: obtaining first operation data of a service platform; analyzing the first operation data, and determining a first log key set in the first operation data; determining a first operation state of the service platform according to the first log key set; and under the condition that the first operation state indicates abnormity, determining a first abnormal service corresponding to the abnormity in the service platform according to the first operation data. Namely, the service platform operation data is taken as a processing object, whether the platform service abnormity exists is judged, the service corresponding to the abnormity is further judged, and the fault positioning efficiency can be improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence, and in particular to a service monitoring method, a model training method, equipment, a medium and a product. Background Art

[0002] In related technologies, as cloud native becomes a growing trend, the use of containerized deployment of various services has been widely used. A large software system may have hundreds or thousands of container group (Pod) instances organized and deployed, which brings huge challenges to the management and operation of software developers. When the Pod running the service fails, it often means service interruption or performance delay, which will have a very adverse impact on the large-scale service system running online.

[0003] The existing online containerized environment operation and maintenance methods are mostly to generate problem tickets or complaints after a service failure in the Pod, and then manually query the logs in the Pod, and then locate the cause of the problem based on the log information and solve it. Due to the complex service architecture of large software systems and the involvement of many microservices, it may be difficult for development and operation personnel to locate its various anomalies. At the same time, as the scale and complexity of current service systems continue to increase, the logs have increased dramatically. In this way, when a problem occurs in the online service, it may take a long time to find the logs and then locate the problem. It can be seen that the existing service fault location process is inefficient. Summary of the invention

[0004] The embodiments of the present invention provide a service monitoring method, a model training method, a device, a medium and a product to solve the problem of low efficiency of the existing service fault location process.

[0005] To solve the above technical problems, the present invention is achieved as follows:

[0006] In a first aspect, an embodiment of the present invention provides a service monitoring method, the method comprising:

[0007] Obtain the first operation data of the service platform;

[0008] Parsing the first operation data to determine a first log key set in the first operation data;

[0009] Determining a first operating state of the service platform according to the first log key set;

[0010] When the first operating status indicates an abnormality, a first abnormal service corresponding to the abnormality in the service platform is determined according to the first operating data.

[0011] In a second aspect, an embodiment of the present invention provides a model training method, the method comprising:

[0012] Acquire third operation data of the service platform, where the third operation data is historical operation data of the service platform with a data tag, and the data tag is an operation status tag corresponding to the historical operation data of the service platform;

[0013] Parsing the historical operation data to determine a second log key set in the historical operation data;

[0014] Model training is performed using the second log key set and the data label to obtain a target model, where the target model is used to determine the operating status of the service platform.

[0015] In a third aspect, an embodiment of the present invention provides a service monitoring device, including:

[0016] A first acquisition module, used to acquire first operation data of the service platform;

[0017] A first parsing module, configured to parse the first operation data and determine a first log key set in the first operation data;

[0018] A first determining module, configured to determine a first operating state of the service platform according to the first log key set;

[0019] A second determination module is configured to determine, when the first operation status indicates an abnormality, a first abnormal service corresponding to the abnormality in the service platform according to the first operation data.

[0020] In a fourth aspect, an embodiment of the present invention provides an electronic device, including a processor,

[0021] The processor is used to obtain first operation data of the service platform;

[0022] Parsing the first operation data to determine a first log key set in the first operation data;

[0023] Determining a first operating state of the service platform according to the first log key set;

[0024] When the first operating status indicates an abnormality, a first abnormal service corresponding to the abnormality in the service platform is determined according to the first operating data.

[0025] In a fifth aspect, an embodiment of the present invention provides a model training device, including:

[0026] A second acquisition module is used to acquire third operation data of the service platform, where the third operation data is historical operation data of the service platform with a data tag, and the data tag is an operation status tag corresponding to the historical operation data of the service platform;

[0027] A second parsing module, configured to parse the historical operation data and determine a second log key set in the historical operation data;

[0028] A training module is used to perform model training using the second log key set and the data label to obtain a target model, and the target model is used to determine the operating status of the service platform.

[0029] In a sixth aspect, an embodiment of the present invention provides an electronic device, including a processor,

[0030] The processor is used to obtain third operation data of the service platform, where the third operation data is historical operation data of the service platform with a data tag, and the data tag is an operation status tag corresponding to the historical operation data of the service platform;

[0031] Parsing the historical operation data to determine a second log key set in the historical operation data;

[0032] Model training is performed using the second log key set and the data label to obtain a target model, where the target model is used to determine the operating status of the service platform.

[0033] In the seventh aspect, an embodiment of the present invention provides an electronic device, comprising: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of the service monitoring method described in the first aspect are implemented; or, when the program is executed by the processor, the steps of the model training method described in the second aspect are implemented.

[0034] In an eighth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the service monitoring method as described in the first aspect above are implemented; or, when the computer program is executed by a processor, the steps of the model training method as described in the second aspect above are implemented.

[0035] In the ninth aspect, a computer program product is provided, comprising computer instructions, which, when executed by a processor, implement the steps of the service monitoring method as described in the first aspect, or, when executed by a processor, implement the steps of the model training method as described in the second aspect.

[0036] In the embodiment of the present invention, the first operation data of the service platform is obtained; the first operation data is parsed to determine the first log key set in the first operation data; the first operation state of the service platform is determined according to the first log key set; when the first operation state indicates an abnormality, the first abnormal service corresponding to the abnormality in the service platform is determined according to the first operation data. That is, the service platform operation data is used as the processing object to determine whether the platform service abnormality exists, and then determine the service corresponding to the abnormality, which can improve the efficiency of fault location. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0038] Figure 1 is a flow chart of a service monitoring method provided by an embodiment of the present invention;

[0039] Figure 2 is a schematic diagram of operation data provided by an embodiment of the present invention;

[0040] Figure 3 is a flow chart of a data structuring algorithm provided by an embodiment of the present invention;

[0041] Figure 4 is a flow chart of a model training method provided by an embodiment of the present invention;

[0042] Figure 5 is a flow chart of a model training and use method provided by an embodiment of the present invention;

[0043] Figure 6 is a structural diagram of a service monitoring device provided by an embodiment of the present invention;

[0044] Figure 7 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention;

[0045] Figure 8 is a structural schematic diagram of a model training device provided by an embodiment of the present invention;

[0046] Fig. 9 It is a schematic diagram of the structure of another electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0049] For ease of understanding, some contents involved in the embodiments of the present invention are described below:

[0050] In related technologies, as cloud native becomes a trend, the use of containerized deployment of various services has been widely used. Many software server architectures (platforms) are based on containerized deployment, for example, based on K8S (Kubernetes), Docker, etc. Taking K8S as an example, K8S is a portable, scalable open source platform for managing containerized workloads and services, which can facilitate declarative configuration and automation. K8S has a large and rapidly growing ecosystem, and K8S services, support, and tools are widely available.

[0051] At the same time, as the scale and complexity of current service systems continue to increase, there is a problem of low efficiency in locating service faults. In the embodiments of the present invention, a service monitoring method, model training method, equipment, medium and product are proposed to solve the problem of low efficiency in locating service faults.

[0052] See also Figure 1 , Figure 1 is a flow chart of a service monitoring method provided by an embodiment of the present invention, such as Figure 1 As shown, the method comprises the following steps:

[0053] Step 101: Obtain the first operation data of the service platform.

[0054] In an embodiment of the present application, the device (first device) that executes the above-mentioned service monitoring method can be a functional module in the service platform itself, or it can be a data analysis device independent of the service platform. When the first device is a data analysis device independent of the service platform, the first operation data of the service platform can be obtained from the service platform through a transceiver device.

[0055] In an embodiment of the present application, the above-mentioned first operating data may be at least one item of all operating data of the service platform, or at least one item of operating data of a specified service in the service platform. Among them, the specified service can be understood as a service that requires service status analysis. The above-mentioned first operating data may be each group of data in the specified service, and steps 102-103 may be performed on each group of data in sequence to perform log key and status analysis, and the first operating data corresponding to the abnormal state may be traced back to obtain the corresponding service (microservice), Pod, etc., thereby achieving rapid fault location.

[0056] Optionally, the above-mentioned first operating data may be the 1st to nth groups of operating data of service A in the service platform, and steps 102-103 are respectively executed for the 1st to nth groups of operating data, where n is a positive integer greater than or equal to 2; at the next execution moment of the embodiment of the present invention, the above-mentioned first operating data may be the 1st to xth groups of operating data of service B in the service platform, and steps 102-103 are executed for the 1st to xth groups of operating data, where x is a positive integer greater than or equal to 2; or, the above-mentioned first operating data may be the mth group of operating data of service A in the service platform, and steps 102-103 are executed for the mth group of operating data; at the next execution moment of the embodiment of the present invention, the above-mentioned first operating data may be the m+1th group of operating data of service A or the yth group of operating data of service B in the service platform, and steps 102-103 are executed for the m+1th group of operating data or the yth group of operating data.

[0057] It is understandable that the service platform targeted by the embodiments of the present application is not limited to the example container service platform (for example, K8S, Docker, etc.), and any service platform that can adapt to the data collection requirements in the embodiments of the present application is acceptable. Taking K8S as an example, the embodiments of the present application can provide a service anomaly diagnosis method in a K8S containerized environment and its corresponding device, or a model method for intelligently diagnosing the POD service status in K8S and its corresponding device.

[0058] Step 102: parse the first operation data to determine a first log key set in the first operation data.

[0059] In the embodiment of the present application, the log key of the operation data can be understood as a key field in the operation data, such as an error field, an alarm field and / or a fault field, etc. It is understandable that even if a log key (error field, alarm field and / or fault field) appears, it does not necessarily cause a service platform operation failure. Whether the service platform has an abnormal state or is about to have an abnormal state requires a comprehensive analysis based on the type of log key.

[0060] At least one log key can be obtained by parsing the operation data. The purpose of this step is to extract valuable features from the operation data (such as the operation log). Since the operation data is unstructured and contains free-form text, the log can be cleaned through step 102 to clean out the time series information of the operation of various indicators.

[0061] Exemplarily, as shown in Table 1, the log key may be a log key for a specific monitoring object.

[0062] Table 1

[0063]

[0064]

[0065] Furthermore, at least one log key can form a log key set, that is, the information of each indicator corresponding to each moment of the anomaly is spliced ​​to generate an anomaly feature vector of fixed dimension for subsequent model training.

[0066] The specific log key analysis method can adopt the log feature extraction method, that is, the structured processing method of the log, for example, using regular expressions, based on source code, or using data mining methods such as clustering and iterative partitioning, etc., which is not limited in the embodiments of the present application.

[0067] Optionally, an embodiment of the present invention further proposes a running data analysis method based on the longest common subsequence (Longest Common Subsequence, LCS), and the specific analysis method is described in the subsequent embodiments.

[0068] Step 103: Determine a first operating state of the service platform according to the first log key set.

[0069] In the embodiment of the present application, a comprehensive analysis is performed on the set of log keys to determine whether the operation status of the current service platform is abnormal or is about to be abnormal. For example, a specific log key combination corresponds to a specific abnormal type, or predicts an abnormal type.

[0070] Optionally, the abnormality indicated by the first operating state includes at least one of the following:

[0071] The service platform operates abnormally;

[0072] The prediction of the service platform is abnormal.

[0073] The existing fault location method is usually the operation and maintenance method of the existing online containerized environment. Most of them are to generate a problem work order or complaint after the service in the Pod fails, and then manually query the log in the Pod, and then locate the cause of the problem and solve it according to the log information, that is, to infer the location log by anomaly, and then determine the service corresponding to the problem. The embodiment of the present application takes the operation data as the analysis object, analyzes the operation data, determines the operation status of the service platform, and then determines whether there is a fault in its operation status, that is, to determine whether there is an anomaly based on the operation data service platform, and then determines the service corresponding to the anomaly. It can be considered to be different from the existing fault location method, which can reduce the time cost of reverse fault inference, thereby improving the efficiency of fault location (for example, quickly diagnose and warn of service anomalies in the Pod), so that the operation and maintenance personnel can quickly locate the anomaly and solve the fault problem.

[0074] Optionally, in an embodiment of the present application, online stream processing is used to acquire and parse the first operating data, which is different from the existing method of first performing a large amount of offline processing and then performing log locating, and can further improve the efficiency of fault locating.

[0075] In the embodiment of the present application, it is possible to determine whether there is an abnormality in the operating status of the current service platform, and it is also possible to determine whether the operating status of the current service platform is about to become abnormal, that is, the abnormality indicated by the first operating status includes the predicted operating abnormality of the service platform; in this way, the service can be optimized before the Pod fails, reducing the probability of the service platform sending a failure.

[0076] The analysis method of the set of log keys can determine the operating status of the service platform based on the judgment of a specific log key or a combination of log keys, and can also analyze the operating status of the service platform through a pre-trained data model. The data model can, for example, use the historical multi-source operation and maintenance data of the service platform (such as Figure 2 The training is performed using the historical record data shown in FIG.

[0077] Step 104: When the first operating status indicates an abnormality, determine a first abnormal service corresponding to the abnormality in the service platform according to the first operating data.

[0078] In the embodiment of the present application, when the log key set determines that the service platform is operating abnormally, the corresponding abnormal service can be determined based on the first operating data corresponding to the log key set whose status result is abnormal.

[0079] For example, the above-mentioned first operating data can be the 1st to nth groups of operating data of service A in the service platform. Steps 102-103 are respectively executed for the 1st to nth groups of operating data, where n is a positive integer greater than or equal to 2; when the service platform status is determined to be abnormal based on the log key set corresponding to any group of data in the 1st to nth groups of operating data (the i-th group of operating data), the service A corresponding to the i-th group of operating data is determined to be an abnormal service.

[0080] Alternatively, the above-mentioned first operating data can be the mth group of operating data of service A in the service platform. Steps 102-103 are executed on the mth group of operating data. When the service platform status is determined to be abnormal based on the log key set corresponding to the mth group of operating data, the service A corresponding to the mth group of operating data is determined to be an abnormal service.

[0081] In the embodiment of the present application, the first operation data of the service platform is obtained; the first operation data is parsed to determine the first log key set in the first operation data; the first operation state of the service platform is determined according to the first log key set; when the first operation state indicates an abnormality, the first abnormal service corresponding to the abnormality in the service platform is determined according to the first operation data. That is, the service platform operation data is used as the processing object to determine whether the platform service abnormality exists, and then determine the service corresponding to the abnormality, which can improve the efficiency of fault location.

[0082] Optionally, the first operating data includes business data of the service platform and operation and maintenance data of the service platform.

[0083] In an embodiment of the present application, the above-mentioned business data may be log data, and the above-mentioned operation and maintenance data may be monitoring data. The above-mentioned operation and maintenance data may be understood as monitoring of the operation status of system equipment, and may include but is not limited to processor usage, disk usage, network status, etc.

[0084] The above business data and operation and maintenance data may include log keys.

[0085] In the prior art, conventional anomaly monitoring solutions usually only focus on log data. In the embodiments of the present application, for example Figure 2 As shown, multi-source operation and maintenance data is used, including both the business data of the service platform and the operation and maintenance data of the service platform. By introducing operation and maintenance data, the accuracy of abnormal diagnosis can be improved, especially by analyzing operation and maintenance data (for example, processor usage, disk usage, network status), service abnormalities can be predicted more accurately. Figure 2 The historical record data in can be data used for model training, and the system runtime data is the first operating data in the embodiment of the present application.

[0086] Optionally, the embodiment of the present application may use two open source tools, LOKI and prometheus, to collect multi-source operation and maintenance data in PODs within K8S.

[0087] Among them, Loki can collect service log data of containers running in Pod, including operational log data and transaction log data, and prometheus will collect monitoring data of POD runtime, such as CPU usage, disk I / O number and other data. When Pod is abnormal, Loki and prometheus can collect the operation log output by the corresponding microservice and the abnormal data of the status data of Pod operation. When the POD carrying the (micro) service runs normally, the average value of the monitoring data per unit time can also appropriately reflect the operation theme of POD, and the log data will not record abnormal errors.

[0088] In the embodiment of the present application, abnormal log information in a table is regularly collected online through historical log data of the service and historical indicator values ​​of POD status monitoring, and used as historical record data for model training.

[0089] Optionally, parsing the first operation data to determine a first log key set in the first operation data includes:

[0090] Using the longest common subsequence (LCS) algorithm, matching the first log key in the first running data;

[0091] In the case where the first log key is matched, using the first log key as a log key in the first log key set;

[0092] If the first log key is not matched, a second log key is generated using second operating data, and the second log key is set as a log key in the first log key set, wherein the second operating data is data obtained by filtering the first operating data through the LCS algorithm.

[0093] After the operation data is collected, the operation data is parsed in order to process the structured operation data. The first log key can be understood as a pre-set log key type, and the second log key can be understood as a newly added log key when no preset log key is matched.

[0094] Optionally, an embodiment of the present application proposes an LCS-based operation data parsing method, which can be applied to structured streaming parsing of operation data, can dynamically accept data input, process input in real time, and continuously generate new data templates, and can adapt to the online stream processing method of acquiring and parsing the first operation data.

[0095] The key to the LCS-based streaming data parsing method is to maintain a data structure (i.e., the first log key set), which can be called LCSMap (which can be understood as an LCS bitmap, LCS map, or LCS matrix), for storing log keys and other information. In LCSMap, each specific log key content is represented by an LCS object (LCSObject) data structure, which consists of two parts: the parsed LCS sequence (LCSseq) and the parameter position (paramPos) of the parameter position list. The above parameter position can be the time information corresponding to the running data (for example, the timestamp position). During the maintenance process, such as Figure 3 As shown in the figure, when new running data arrives, the existing log key is first checked in the pre-filtered search prefix tree. If no matching log key is found, the matching log key is further searched in the inverted index. If a matching log key is still not found, a simple loop traversal method is used to compare it with all the log keys stored in the LCSMap. If a matching log key is still not found after traversal, a new LCSObject is calculated and created to save the log key, and it is inserted into the LCSMap, and the LCSMap is updated accordingly.

[0096] Optionally, the same log and the same ID of the program correspond to the same LCSMap vector, and at least one LCSMap vector constitutes an LCSMap matrix.

[0097] In the process of maintaining LCSMap, sometimes a log key element is mistakenly judged as a parameter (non-log key element), or a parameter (non-log key element) is mistakenly judged as a log key element. In order to solve these two situations, the embodiment of the present application is also used to periodically apply splitting and merging LCSMap to clean up the currently parsed log keys.

[0098] Through this LCS-based streaming log parsing method, the structured logs can be efficiently processed and new log templates can be generated in real time through the provided log key template (log key). This method not only provides accurate log parsing results, but also has high processing efficiency and real-time performance. In addition, this method weakens the need for knowledge background in a specific field and can be applied to more complex operation data analysis.

[0099] In the embodiment of the present application, two open source tools, LOKI and prometheus, can be used to collect service logs and collect data from multiple operation and maintenance data sources. Furthermore, in order to process unstructured multi-source operation and maintenance data, a streaming log parsing method based on LCS is used to convert it into structured LCSMap data. This step makes full use of excellent data processing technology, enabling the system to learn high-dimensional features and improve classification accuracy.

[0100] Optionally, determining the first operating state of the service platform according to the first log key set includes:

[0101] inputting the first log key set into a target model;

[0102] Determining a first operating state of the service platform according to an output of the target model;

[0103] The target model is trained using third operating data, the third operating data is historical operating data of the service platform with data labels, and the data labels are operating status labels corresponding to the historical operating data of the service platform.

[0104] In the embodiment of the present application, the operation data analysis result is used as the input of the target model. For example, the operation data processed by the streaming data analysis method of LCS is converted into LSCMap data to form a feature vector with time series information, and a set of [V1, V2, ..., V t ,...,V T ] feature vector, as input to the input layer.

[0105] The training of the target model uses the third operation data, which includes historical operation data and data labels corresponding to the historical operation data (operation status labels corresponding to the historical operation data of the service platform). The acquisition and analysis methods of the historical operation data can refer to the acquisition and analysis methods of the first operation data, which will not be repeated here. For specific training methods, please refer to Figure 4 An embodiment of the model training method is shown.

[0106] Compared with the existing related technologies, the embodiments of the present application can reduce the time for operation and maintenance personnel to manually search for the cause of database anomalies in huge logs, can more reliably give the cause of the current service anomaly, and reduce the downtime of online services. At the same time, the embodiments of the present application collect multi-source operation and maintenance data of the operation of various online systems, and use the LCS-based streaming log parsing method to process unstructured log data, which can more comprehensively capture the log data of microservice anomalies. At the same time, the Adam adaptive moment stochastic gradient algorithm can be used when constructing the CNN model, which improves the calculation speed of the system and the accuracy of anomaly classification.

[0107] See also Figure 4 , Figure 4 is a flow chart of a model training method provided in an embodiment of the present application, such as Figure 4 As shown, the method comprises the following steps:

[0108] Step 401: Acquire third operation data of the service platform, where the third operation data is historical operation data of the service platform with a data tag, and the data tag is an operation status tag corresponding to the historical operation data of the service platform.

[0109] In an embodiment of the present application, the device (second device) that executes the above-mentioned model training method can be a functional module in the service platform itself, or it can be a data analysis device independent of the service platform. It can be the same device as the first device or a different device from the first device. When the second device is a data analysis device independent of the service platform, the third operation data of the service platform can be obtained from the service platform through a transceiver device.

[0110] In the embodiment of the present application, the method of obtaining historical operation data is similar to Figure 1 The method for obtaining the first operating data in the illustrated embodiment will not be described in detail here.

[0111] Optionally, the historical operation data includes: historical business data of the service platform and historical operation and maintenance data of the service platform.

[0112] In the embodiment of the present application, the data labels corresponding to the historical operation data may be manually labeled, or may be automatically labeled according to the operation status of the service platform itself during its operation.

[0113] The data labels corresponding to the above historical operation data can be understood as the historical operation status of the service platform corresponding to the above historical operation data. It can be the abnormal / normal operation of the service platform at the current moment corresponding to the historical operation data, or it can be the abnormal / normal operation of the service platform at a later moment corresponding to the historical operation data.

[0114] Optionally, the data tag includes at least one of the following:

[0115] The service platform operates abnormally;

[0116] The service platform operates normally;

[0117] The predicted operation of the service platform is abnormal;

[0118] The prediction of the service platform is running normally.

[0119] The above service platforms can correspond to Figure 1 The service platform in the illustrated embodiment.

[0120] Step 402: parse the historical operation data to determine a second log key set in the historical operation data.

[0121] In the embodiment of the present application, the parsing method of historical operation data is similar to Figure 1 The method of parsing the first operating data in the illustrated embodiment will not be described in detail here.

[0122] Optionally, parsing the historical operation data to determine a second log key set in the historical operation data includes:

[0123] Using the longest common subsequence (LCS) algorithm, matching the third log key in the historical operation data;

[0124] In the case where the third log key is matched, using the third log key as a log key in the second log key set;

[0125] If the third log key is not matched, a fourth log key is generated using the fourth operation data, and the fourth log key is used as a log key in the second log key set, wherein the fourth operation data is the historical operation data filtered by the LCS algorithm.

[0126] The third log key may be at least partially identical to the first log key.

[0127] Step 403: Perform model training using the second log key set and the data label to obtain a target model, where the target model is used to determine the operating status of the service platform.

[0128] In the embodiment of the present application, the above target model may correspond to Figure 1 The target model in the illustrated embodiment is used to determine the operating status of the service platform. The training method can be understood as a supervised model training method. The second log key set is used as the model input data, and the output is compared with the data label to adjust the model parameters, and finally the target model is obtained.

[0129] For the convenience of explanation, the training of the target model is described by taking Convolutional Neural Networks (CNN) as an example. It is understandable that the embodiments of the present application are not limited to the CNN model, but can also be other big data models such as Recurrent Neural Network (RNN), Transformer, etc.

[0130] In the supervised training process of the CNN model, the weight matrix and bias parameters of the model are constantly adjusted to minimize the loss function (cost function) and determine the optimal weight matrix and bias of the model. The training process is divided into two stages: forward propagation and back propagation.

[0131] Before the training of the CNN model begins, the weight parameters and bias values ​​need to be initialized, usually setting them to random numbers close to zero. During the forward propagation process, the original data samples are input into the CNN model, and the probability distribution of the samples for each fault type is calculated through layer-by-layer feature extraction and mapping, and the results are output. The back propagation stage is the inverse process of the forward propagation, starting from the output layer, by propagating the gradient, calculating the gradient of the weight, and updating the weight and bias according to the learning rate.

[0132] Specifically, the gradient descent method can be used to update the weight matrix and bias parameters, where the weight matrix is ​​iteratively updated according to formula (1-1). Where w represents the weight matrix to be updated, η represents the learning rate, Δw represents the gradient of the weight matrix, and J represents the loss function. The loss function takes the partial derivative of the full stack matrix to obtain the gradient of the weight matrix.

[0133]

[0134] In the training process of CNN model, error back propagation is used to calculate the gradient of the parameters in the model, and the parameters are continuously updated through multiple iterations to minimize the loss function and achieve the goal of parameter convergence. The choice of optimization algorithm will affect the way the parameters are updated. Gradient descent is one of the most commonly used optimization algorithms. It updates the parameters in the opposite direction of the gradient to minimize the cost function. However, for large-scale data or deep models, the traditional stochastic gradient descent (SGD) algorithm has some shortcomings, such as difficulty in selecting a suitable learning rate, inability to adapt to the update of all parameters in the model, and easy to fall into local optimality.

[0135] In order to overcome these problems, the embodiments of the present application apply different adaptive learning rates to each parameter.

[0136] Optionally, each parameter of the target model is trained using an adaptive learning rate.

[0137] Optionally, the Adam (Adaptive Moment) algorithm can be used as the optimization algorithm. The Adam algorithm has the advantages of fast calculation speed, low memory consumption, and adaptability to large-scale data and a large number of parameters.

[0138] Unlike the traditional SGD algorithm, the Adam algorithm applies a different adaptive learning rate to each parameter of the model and combines the first-order momentum (m t ) and second-order momentum (V t ) to calculate the gradient. Formulas (1-2) and (1-3) describe the calculation process of the first-order momentum and the second-order momentum, where t is the number of iterations of model training, θt is the model parameter waiting to be updated, g t When θ is the tth iteration t gradient.

[0139] m t =β1*m t-1 +(1-β1)*g t (1-2)

[0140]

[0141] As shown in the above formula, β1 and β2 are the decay rates of the first and second order momentum estimates. For example, the empirical values ​​of β1 are 0.9 and β2 are 0.999.

[0142]

[0143] In the above formula, m′ t represents the first-order momentum estimate, V t ′ represents the second-order momentum estimate.

[0144] Finally, the model parameters θ are updated:

[0145]

[0146] In formula (1-6), η represents the initial learning rate, and the stability constant ε is 10 -8 , The term dynamically constrains the numerical range of the learning rate, laying a certain foundation for the numerical range of model parameter adjustment.

[0147] It is understandable that the embodiment of the present application takes CNN training as an example. In the training process of other models, the adaptive learning rate adjustment method such as Adam can also be used to use an adaptive learning rate for each parameter training of the target model.

[0148] In the embodiment of the present application, the Adam adaptive moment stochastic gradient algorithm is used for optimization. The Adam algorithm has the advantages of high computing speed, low memory consumption, constant gradient diagonal scaling process, and adaptability to large-scale data and multi-parameter problem solving, providing strong support for the computing speed and classification accuracy of the model.

[0149] In the supervised training process of the CNN model, because the classification problem based on the running data is a multi-class classification problem, the softmax cross entropy loss function can directly optimize the probability distribution of the prediction results. It takes the multi-class classification problem as the goal, trains the model by minimizing the difference between the predicted probability and the true label, and performs better when dealing with the problem of class imbalance. Because it is optimized based on the probability of each category, it can better handle samples of a few categories and avoid the deviation caused by the sample. Compared with other loss functions, this direct optimization of the probability distribution property makes the model closer to the output we expect. Therefore, in the embodiment of the present application, the softmax cross entropy (Cross Entropy) loss function is specifically used as the loss function. The loss function performs softmax mapping on the result of the output layer, and then calculates the cross entropy between the output and the label to evaluate the performance of the model and optimize the parameters. The use of softmax mapping can increase the running speed of the program and reduce the time consuming calculation.

[0150] Specifically, in the softmax cross entropy loss function, the output y is calculated using formulas (1-7) and (1-8). i Perform softmax mapping and then calculate the output y i and label (true value) y i The cross entropy H between y′ (y). This calculation method can more effectively measure the difference between the model output and the true label.

[0151]

[0152] H y′ (y)=-∑ i y i ′log (y i ) (1-8)

[0153] The fault diagnosis CNN model in the embodiment of the present application adopts a supervised learning method for fault diagnosis of application services in K8S. In this model, historical data is converted into LCSMap data as training data input for the model (e.g., CNN) for model training, and the output value is the fault probability. The training sample label of the model can be the service anomaly and fault data recorded by the operation and maintenance department.

[0154] Exemplarily, the structure of the fault diagnosis CNN model of the embodiment of the present application consists of 2 convolutional layers, 2 pooling layers, 1 fully connected layer and 1 Dropout layer. The specific settings are as follows: the first convolutional layer has 64 convolution kernels, each of which has a size of 125 and a step size of 16; the second convolutional layer has 96 convolution kernels, each of which has a size of 15 and a step size of 4; the pooling window size of the two pooling layers is 2, and the step size is 2; the fully connected layer has 128 neurons; a ReLu activation function layer is added after each convolutional layer and fully connected layer; the last Dropout layer sets the discard rate to 0.3, and randomly discards 30% of the neurons in each training batch to enhance the robustness of the model and avoid overfitting. Optionally, the structural parameters of the above model can be adjusted using the automated parameter adjustment tool scikit-learn's GridSearchCV and RandomizedSearchCV for model parameter adjustment.

[0155] In an embodiment of the present application, a method can be adopted that uses LCS streaming to process service logs and combines a CNN network to perform classification prediction based on log keys, and uses scikit-learn's GridSearchCV and RandomizedSearchCV technical means to optimize and adjust the parameters of the CNN model to achieve online intelligent diagnosis of abnormal POD service status in K8S, while achieving the technical effect of high-accuracy service fault prediction and alarm.

[0156] In the embodiment of the present application, optionally, by combining the LCS streaming processing and CNN model method with the scikit-learn parameter adjustment tool, it is possible to realize online intelligent diagnosis of abnormal diagnosis of POD service status in K8S. Through streaming log parsing and structured data processing, log data can be processed efficiently to improve the model learning effect. At the same time, the use of the Adam optimization algorithm can accelerate the optimization process of the deep network and improve the calculation speed and classification accuracy of the model. The embodiment of the present application can have a positive impact on the field of intelligent diagnosis of service anomalies.

[0157] For example, Figure 5 As shown in the figure, the specific steps of the CNN-based K8S application service fault diagnosis model are as follows:

[0158] 1. Process the log data LCS streaming data into LSCMap data, and use Python code for format processing;

[0159] 2. Build a CNN network model and initialize network parameters such as learning rate, number of iterations, and batch size;

[0160] 3. Use historical data for training, use the automated parameter adjustment tool scikit-learn's GridSearchCV and RandomizedSearchCV to adjust the model parameters, and determine the global optimal model parameters in multiple trainings.

[0161] 4. Use online real-time data to verify the effectiveness of the CNN model in service application fault diagnosis and visualize the prediction results.

[0162] Figure 5 The online data in can be understood Figure 1 The first operation data in the illustrated embodiment is parsed and enters the trained target model to obtain an output result, which can be understood as the probability of occurrence of a service failure.

[0163] In an embodiment of the present application, the third operating data of the service platform is obtained, and the third operating data is the historical operating data of the service platform with a data label, and the data label is the operating status label corresponding to the historical operating data of the service platform; the historical operating data is parsed to determine the second log key set in the historical operating data; the model training is performed using the second log key set and the data label to obtain a target model, and the target model is used to determine the operating status of the service platform. That is, a target model for judging the operating status of the service platform based on the service platform operating data is provided, corresponding to the target model in the aforementioned service monitoring method, and can judge whether the operating status of the service platform is abnormal or not, thereby improving the monitoring efficiency of the service platform. Furthermore, corresponding to the target model in the aforementioned service monitoring method, the target model in the embodiment of the present application can be applied to fault location scenarios to improve the efficiency of fault location.

[0164] See also Figure 6 , Figure 6 is a schematic diagram of the structure of a service monitoring device provided by an embodiment of the present invention, such as Figure 6 As shown, the service monitoring device 600 includes:

[0165] The first acquisition module 601 is used to acquire the first operation data of the service platform;

[0166] A first parsing module 602, configured to parse the first operation data to determine a first log key set in the first operation data;

[0167] A first determination module 603, configured to determine a first operating state of the service platform according to the first log key set;

[0168] The second determining module 604 is configured to determine, when the first operating state indicates an abnormality, a first abnormal service corresponding to the abnormality in the service platform according to the first operating data.

[0169] Optionally, the first operating data includes business data of the service platform and operation and maintenance data of the service platform.

[0170] Optionally, the first parsing module 602 includes:

[0171] A first matching module, configured to match a first log key in the first running data by using a longest common subsequence (LCS) algorithm;

[0172] a second matching module, configured to use the first log key as a log key in the first log key set when the first log key is matched;

[0173] The third matching module is used to generate a second log key using second operating data when the first log key is not matched, and set the second log key as a log key in the first log key set, wherein the second operating data is data after the first operating data is filtered by the LCS algorithm.

[0174] Optionally, the first determining module 603 includes:

[0175] An input module, used for inputting the first log key set into a target model;

[0176] A first determination submodule, configured to determine a first operating state of the service platform according to an output of the target model;

[0177] The target model is trained using third operating data, the third operating data is historical operating data of the service platform with data labels, and the data labels are operating status labels corresponding to the historical operating data of the service platform.

[0178] Optionally, the abnormality indicated by the first operating state includes at least one of the following:

[0179] The service platform operates abnormally;

[0180] The prediction of the service platform is abnormal.

[0181] It should be noted that the service monitoring device provided in the embodiment of the present invention is a device capable of executing the above service monitoring method, and all implementation methods in the above service monitoring method embodiment are applicable to the service monitoring device and can achieve the same or similar beneficial effects. To avoid repeated description, this embodiment will not be described in detail.

[0182] For details, see Figure 7As shown, an embodiment of the present invention further provides an electronic device, including a bus 701 , a transceiver 702 , an antenna 703 , a bus interface 704 , a processor 705 and a memory 706 .

[0183] Processor 705, used to obtain first operation data of the service platform;

[0184] Parsing the first operation data to determine a first log key set in the first operation data;

[0185] Determining a first operating state of the service platform according to the first log key set;

[0186] When the first operating status indicates an abnormality, a first abnormal service corresponding to the abnormality in the service platform is determined according to the first operating data.

[0187] Alternatively, the transceiver 702 is used to obtain the first operation data of the service platform;

[0188] Processor 705, configured to parse the first operation data and determine a first log key set in the first operation data;

[0189] Determining a first operating state of the service platform according to the first log key set;

[0190] When the first operating status indicates an abnormality, a first abnormal service corresponding to the abnormality in the service platform is determined according to the first operating data.

[0191] Optionally, the first operating data includes business data of the service platform and operation and maintenance data of the service platform.

[0192] Optionally, parsing the first operation data to determine a first log key set in the first operation data includes:

[0193] Using the longest common subsequence (LCS) algorithm, matching the first log key in the first running data;

[0194] In the case where the first log key is matched, using the first log key as a log key in the first log key set;

[0195] If the first log key is not matched, a second log key is generated using second operating data, and the second log key is set as a log key in the first log key set, wherein the second operating data is data obtained by filtering the first operating data through the LCS algorithm.

[0196] Optionally, determining the first operating state of the service platform according to the first log key set includes:

[0197] inputting the first log key set into a target model;

[0198] Determining a first operating state of the service platform according to an output of the target model;

[0199] The target model is trained using third operating data, the third operating data is historical operating data of the service platform with data labels, and the data labels are operating status labels corresponding to the historical operating data of the service platform.

[0200] Optionally, the abnormality indicated by the first operating state includes at least one of the following:

[0201] The service platform operates abnormally;

[0202] The prediction of the service platform is abnormal.

[0203] exist Figure 7 In the embodiment, the bus architecture (represented by bus 701) may include any number of interconnected buses and bridges, and bus 701 links various circuits including one or more processors represented by processor 705 and memory represented by memory 706. Bus 701 may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. Bus interface 704 provides an interface between bus 701 and transceiver 702. Transceiver 702 may be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. Data processed by processor 705 is transmitted on a wireless medium via antenna 703, and further, antenna 703 also receives data and transmits the data to processor 705.

[0204] The processor 705 is responsible for managing the bus 701 and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management and other control functions. The memory 706 can be used to store data used by the processor 705 when performing operations.

[0205] Optionally, the processor 705 may be a CPU, an ASIC, an FPGA or a CPLD.

[0206] It should be noted that the electronic device provided in the embodiment of the present invention is a device capable of executing the above service monitoring method, and all implementation methods in the above service monitoring method embodiment are applicable to the electronic device and can achieve the same or similar beneficial effects. To avoid repeated description, this embodiment will not be repeated.

[0207] See also Figure 8 , Figure 8 is a schematic diagram of the structure of a model training device provided by an embodiment of the present invention, such as Figure 8 As shown, the model training device 800 includes:

[0208] The second acquisition module 801 is used to acquire third operation data of the service platform, where the third operation data is historical operation data of the service platform with a data tag, and the data tag is an operation status tag corresponding to the historical operation data of the service platform;

[0209] A second parsing module 802 is used to parse the historical operation data to determine a second log key set in the historical operation data;

[0210] The training module 803 is used to perform model training using the second log key set and the data label to obtain a target model, and the target model is used to determine the operating status of the service platform.

[0211] Optionally, the historical operation data includes: historical business data of the service platform and historical operation and maintenance data of the service platform.

[0212] Optionally, the second parsing module 802 includes:

[0213] a fourth matching module, configured to match a third log key in the historical operation data by using a longest common subsequence (LCS) algorithm;

[0214] a fifth matching module, configured to use the third log key as a log key in the second log key set when the third log key is matched;

[0215] The sixth matching module is used to generate a fourth log key using the fourth operation data when the third log key is not matched, and use the fourth log key as the log key in the second log key set, wherein the fourth operation data is the data after the historical operation data is filtered by the LCS algorithm.

[0216] Optionally, the data tag includes at least one of the following:

[0217] The service platform operates abnormally;

[0218] The service platform operates normally;

[0219] The predicted operation of the service platform is abnormal;

[0220] The prediction of the service platform is running normally.

[0221] Optionally, each parameter of the target model is trained using an adaptive learning rate.

[0222] It should be noted that the model training device provided in the embodiment of the present invention is a device capable of executing the above-mentioned model training method, and all implementation methods in the above-mentioned model training method embodiment are applicable to the model training device, and can achieve the same or similar beneficial effects. To avoid repeated description, this embodiment will not be repeated.

[0223] For details, see Fig. 9 As shown, an embodiment of the present invention further provides an electronic device, including a bus 901 , a transceiver 902 , an antenna 903 , a bus interface 904 , a processor 905 and a memory 906 .

[0224] Processor 905 is used to obtain third operation data of the service platform, where the third operation data is historical operation data of the service platform with a data tag, and the data tag is an operation status tag corresponding to the historical operation data of the service platform;

[0225] Parsing the historical operation data to determine a second log key set in the historical operation data;

[0226] Model training is performed using the second log key set and the data label to obtain a target model, where the target model is used to determine the operating status of the service platform.

[0227] Alternatively, the transceiver 902 is used to obtain third operation data of the service platform, where the third operation data is historical operation data of the service platform with a data tag, and the data tag is an operation status tag corresponding to the historical operation data of the service platform.

[0228] Further, the processor 905 is used to parse the historical operation data to determine a second log key set in the historical operation data;

[0229] Model training is performed using the second log key set and the data label to obtain a target model, where the target model is used to determine the operating status of the service platform.

[0230] Optionally, the historical operation data includes: historical business data of the service platform and historical operation and maintenance data of the service platform.

[0231] Optionally, parsing the historical operation data to determine a second log key set in the historical operation data includes:

[0232] Using the longest common subsequence (LCS) algorithm, matching the third log key in the historical operation data;

[0233] In the case where the third log key is matched, using the third log key as a log key in the second log key set;

[0234] If the third log key is not matched, a fourth log key is generated using the fourth operation data, and the fourth log key is used as a log key in the second log key set, wherein the fourth operation data is the historical operation data filtered by the LCS algorithm.

[0235] Optionally, the data tag includes at least one of the following:

[0236] The service platform operates abnormally;

[0237] The service platform operates normally;

[0238] The predicted operation of the service platform is abnormal;

[0239] The prediction of the service platform is running normally.

[0240] Optionally, each parameter of the target model is trained using an adaptive learning rate.

[0241] exist Fig. 9 In the embodiment, the bus architecture (represented by bus 901) may include any number of interconnected buses and bridges, and bus 901 links various circuits including one or more processors represented by processor 905 and memory represented by memory 906. Bus 901 may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. Bus interface 904 provides an interface between bus 901 and transceiver 902. Transceiver 902 may be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. Data processed by processor 905 is transmitted on a wireless medium via antenna 903, and further, antenna 903 also receives data and transmits the data to processor 905.

[0242] The processor 905 is responsible for managing the bus 901 and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management and other control functions. The memory 906 can be used to store data used by the processor 905 when performing operations.

[0243] Optionally, the processor 905 may be a CPU, an ASIC, an FPGA or a CPLD.

[0244] It should be noted that the electronic device provided in the embodiment of the present invention is a device capable of executing the above-mentioned model training method, and all implementation methods in the above-mentioned model training method embodiment are applicable to the electronic device and can achieve the same or similar beneficial effects. To avoid repeated description, this embodiment will not be repeated.

[0245] An embodiment of the present invention also provides an electronic device, comprising: a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, the various processes of the above-mentioned service monitoring method embodiment are implemented; alternatively, when the program is executed by the processor, the various processes of the above-mentioned model training method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0246] The embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned service monitoring method embodiment is implemented, or when the computer program is executed by a processor, each process of the above-mentioned model training method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0247] The present application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the above Figure 1 or Figure 4 The various processes of the method embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0248] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0249] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0250] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

Claims

1. A service monitoring method, characterized in that: The method comprises: Obtain the first operation data of the service platform; Parsing the first operation data to determine a first log key set in the first operation data; Determining a first operating state of the service platform according to the first log key set; When the first operating status indicates an abnormality, a first abnormal service corresponding to the abnormality in the service platform is determined according to the first operating data.

2. The method according to claim 1, characterized in that The first operation data includes business data of the service platform and operation and maintenance data of the service platform.

3. The method according to any one of claims 1 to 2, characterized in that: The parsing the first operation data to determine a first log key set in the first operation data includes: Using the longest common subsequence (LCS) algorithm, matching the first log key in the first running data; In the case where the first log key is matched, using the first log key as a log key in the first log key set; If the first log key is not matched, a second log key is generated using second operating data, and the second log key is set as a log key in the first log key set, wherein the second operating data is data obtained by filtering the first operating data through the LCS algorithm.

4. The method according to claim 1, characterized in that: Determining the first operating state of the service platform according to the first log key set includes: inputting the first log key set into a target model; Determining a first operating state of the service platform according to an output of the target model; The target model is trained using third operating data, the third operating data is historical operating data of the service platform with data labels, and the data labels are operating status labels corresponding to the historical operating data of the service platform.

5. The method according to any one of claims 1 to 2 and 4, characterized in that: The abnormality indicated by the first operating state includes at least one of the following: The service platform operates abnormally; The prediction of the service platform is abnormal.

6. A model training method, characterized in that: The method comprises: Acquire third operation data of the service platform, where the third operation data is historical operation data of the service platform with a data tag, and the data tag is an operation status tag corresponding to the historical operation data of the service platform; Parsing the historical operation data to determine a second log key set in the historical operation data; Model training is performed using the second log key set and the data label to obtain a target model, where the target model is used to determine the operating status of the service platform.

7. The method according to claim 6, characterized in that The historical operation data includes: historical business data of the service platform and historical operation and maintenance data of the service platform.

8. The method according to any one of claims 6 to 7, characterized in that: The parsing the historical operation data to determine a second log key set in the historical operation data includes: Using the longest common subsequence (LCS) algorithm, matching the third log key in the historical operation data; In the case where the third log key is matched, using the third log key as a log key in the second log key set; If the third log key is not matched, a fourth log key is generated using the fourth operation data, and the fourth log key is used as a log key in the second log key set, wherein the fourth operation data is the historical operation data filtered by the LCS algorithm.

9. The method according to any one of claims 6 to 7, characterized in that: The data tag includes at least one of the following: The service platform operates abnormally; The service platform operates normally; The predicted operation of the service platform is abnormal; The prediction of the service platform is running normally.

10. The method according to any one of claims 6 to 7, characterized in that: Each parameter of the target model is trained using an adaptive learning rate.

11. A service monitoring device, characterized in that: include: A first acquisition module, used to acquire first operation data of the service platform; A first parsing module, configured to parse the first operation data and determine a first log key set in the first operation data; A first determining module, configured to determine a first operating state of the service platform according to the first log key set; The second determining module is used to determine a first abnormal service corresponding to the abnormality in the service platform according to the first operating data when the first operating status indicates an abnormality.

12. An electronic device, characterized in that: Including processor, The processor is used to obtain first operation data of the service platform; Parsing the first operation data to determine a first log key set in the first operation data; Determining a first operating state of the service platform according to the first log key set; When the first operating status indicates an abnormality, a first abnormal service corresponding to the abnormality in the service platform is determined according to the first operating data.

13. A model training device, characterized in that: include: A second acquisition module is used to acquire third operation data of the service platform, where the third operation data is historical operation data of the service platform with a data tag, and the data tag is an operation status tag corresponding to the historical operation data of the service platform; A second parsing module, configured to parse the historical operation data and determine a second log key set in the historical operation data; A training module is used to perform model training using the second log key set and the data label to obtain a target model, and the target model is used to determine the operating status of the service platform.

14. An electronic device, characterized in that: Including processor, The processor is used to obtain third operation data of the service platform, where the third operation data is historical operation data of the service platform with a data tag, and the data tag is an operation status tag corresponding to the historical operation data of the service platform; Parsing the historical operation data to determine a second log key set in the historical operation data; Model training is performed using the second log key set and the data label to obtain a target model, where the target model is used to determine the operating status of the service platform.

15. An electronic device, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the service monitoring method as described in any one of claims 1 to 5, or the program, when executed by the processor, implements the steps of the model training method as described in any one of claims 6 to 10.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the service monitoring method as described in any one of claims 1 to 5, or, when executed by a processor, implements the steps of the model training method as described in any one of claims 6 to 10.

17. A computer program product, characterized in that It comprises computer instructions, which, when executed by a processor, implement the steps of the service monitoring method as described in any one of claims 1 to 5, or, when executed by a processor, implement the steps of the model training method as described in any one of claims 6 to 10.

Images