Cluster fault prediction method and related device

Abstract

The invention discloses a cluster fault prediction method and a related device, and the method comprises the steps: collecting current cluster log data in a production environment, carrying out the preprocessing of the current cluster log data, obtaining target cluster log data, extracting cluster feature data from the target cluster log data, and carrying out the prediction of a cluster fault. And inputting the cluster feature data into a pre-trained cluster fault prediction model to obtain a cluster fault prediction result, wherein the cluster fault prediction model is obtained by training balanced cluster log data determined based on a lightweight ensemble learning model and a cluster undersampling method as training data. The current cluster log data is collected in real time in the production environment, the cluster features obtained through data preprocessing and feature extraction are input into the cluster fault prediction model for fault prediction, a set of complete process from data collection to fault prediction is completed, occurrence of cluster faults can be predicted in advance, and the fault prediction efficiency is improved. Therefore, the data loss is effectively reduced, the data storage cost is reduced, and the efficiency of the long-period cloud computing task is improved.

Description

Technical Field

[0001] The present application relates to the technical field of fault prediction, and in particular to a cluster fault prediction method and related devices. Background Art

[0002] With the advent of the big data era, the value of data is increasing. Massive data storage poses a huge challenge to the stability of the cluster. Once a cluster fails, the data stored in it may be lost forever. Although clusters can be redundantly backed up, the data storage cost will increase exponentially, and when multiple clusters are damaged, data loss will still occur. This method consumes a lot of time and economic costs. What's more serious is that for high-performance computing tasks, cluster failures will cause the computing tasks of stored data to be interrupted, thereby affecting the efficiency of long-term cloud computing tasks.

[0003] Therefore, how to provide a cluster failure prediction method to reduce data loss, reduce data storage costs, and improve the efficiency of long-term cloud computing tasks has become a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0004] In view of the above problems, this application provides a cluster failure prediction method and related devices to achieve the purpose of data loss, reduce data storage costs, and improve the efficiency of long-term cloud computing tasks. The specific scheme is as follows:

[0005] A cluster failure prediction method, comprising:

[0006] Collect current cluster log data in the production environment;

[0007] Preprocessing the current cluster log data to obtain target cluster log data;

[0008] Extracting cluster feature data from the target cluster log data;

[0009] The cluster feature data is input into a pre-trained cluster fault prediction model to obtain a cluster fault prediction result, wherein the cluster fault prediction model is trained using balanced cluster log data determined based on a lightweight ensemble learning model and a cluster undersampling method as training data.

[0010] Optionally, preprocessing the current cluster log data to obtain target cluster log data includes:

[0011] Correcting abnormal values ​​in the current cluster log data that deviate from a normal range to obtain intermediate cluster log data;

[0012] The missing values ​​in the intermediate cluster log data are filled to obtain the target cluster log data.

[0013] Optionally, extracting cluster feature data from the target cluster log data includes:

[0014] Using a statistical feature method to obtain a plurality of original feature data from the target cluster log data;

[0015] Using a combined feature method to construct a plurality of original feature data to obtain a plurality of combined feature data;

[0016] The cluster feature data is obtained by screening the plurality of combined feature data using a wrapper feature screening method.

[0017] Optionally, the training process of the cluster fault prediction model is as follows:

[0018] Get historical raw cluster log data;

[0019] Processing the historical original cluster log data using a cluster undersampling method to obtain combined cluster data;

[0020] extracting sample feature data from the combined cluster data;

[0021] Inputting the sample feature data into a lightweight ensemble learning model to predict a fault cluster, wherein the fault cluster has a fault identifier;

[0022] Randomly selecting a normal cluster that is relatively balanced with the faulty cluster, wherein the normal cluster has a normal identifier;

[0023] Combining the fault cluster and the normal cluster to obtain balanced cluster log data, and extracting target feature data from the balanced cluster log data;

[0024] The target feature data is used as a training sample, and a classification label of the target feature data is used as a sample label, and a preset neural network is trained to obtain the cluster fault prediction model, wherein the preset neural network is a network composed of a convolutional neural network and a long short-term memory network.

[0025] Optionally, the processing the historical original cluster log data using a cluster undersampling method to obtain combined cluster data includes:

[0026] Preprocessing the historical original cluster log data to obtain historical target cluster log data;

[0027] Clustering the historical target cluster log data using a preset clustering algorithm to divide the historical target cluster log data into multiple categories of data;

[0028] A representative sample is selected from each category of data to obtain the combined cluster data.

[0029] A cluster fault prediction device, comprising:

[0030] The log acquisition unit is used to collect the current cluster log data in the production environment;

[0031] A preprocessing unit, used for preprocessing the current cluster log data to obtain target cluster log data;

[0032] A feature extraction unit, used to extract cluster feature data from the target cluster log data;

[0033] A fault prediction unit is used to input the cluster feature data into a pre-trained cluster fault prediction model to obtain a cluster fault prediction result, wherein the cluster fault prediction model is trained using balanced cluster log data determined based on a lightweight ensemble learning model and a cluster undersampling method as training data.

[0034] Optionally, the cluster fault prediction device further includes: a model training unit;

[0035] The model training unit is used to train the cluster fault prediction model;

[0036] The model training unit comprises:

[0037] The historical data acquisition subunit is used to obtain historical original cluster log data;

[0038] A cluster undersampling subunit, used for processing the historical original cluster log data using a cluster undersampling method to obtain combined cluster data;

[0039] A feature extraction subunit, used to extract sample feature data from the combined cluster data;

[0040] A prediction subunit, used for inputting the sample feature data into a lightweight ensemble learning model to predict a fault cluster, wherein the fault cluster has a fault identifier;

[0041] A random data selection subunit, used for randomly selecting a normal cluster that is relatively balanced with the fault cluster, wherein the normal cluster has a normal identifier;

[0042] A data combination subunit, used for combining the faulty cluster and the normal cluster to obtain balanced cluster log data, and extracting target feature data from the balanced cluster log data;

[0043] A training subunit is used to use the target feature data as training samples and a classification label of the target feature data as a sample label to train a preset neural network to obtain the cluster fault prediction model, wherein the preset neural network is a network composed of a convolutional neural network and a long short-term memory network.

[0044] A computer program product includes computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements the cluster failure prediction method described above.

[0045] An electronic device comprises at least one processor and a memory connected to the processor, wherein:

[0046] The memory is used to store computer programs;

[0047] The processor is used to execute the computer program so that the electronic device can implement the cluster failure prediction method described above.

[0048] A computer storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement the cluster fault prediction method described above.

[0049] It can be seen from the above technical solutions that the present invention discloses a cluster fault prediction method and related devices, which collect current cluster log data in a production environment, preprocess the current cluster log data to obtain target cluster log data, extract cluster feature data from the target cluster log data, and input the cluster feature data into a pre-trained cluster fault prediction model to obtain a cluster fault prediction result. The cluster fault prediction model is trained using balanced cluster log data determined based on a lightweight ensemble learning model and a cluster undersampling method as training data. The present application collects current cluster log data in real time in a production environment, and inputs the cluster features obtained through data preprocessing and feature extraction as input data into a cluster fault prediction model for fault prediction, completing a complete set of processes of data collection, preprocessing, and fault prediction, thereby being able to predict the occurrence of cluster faults in advance, assisting operation and maintenance personnel in making decisions in a timely manner, realizing intelligent operation and maintenance of clusters, effectively reducing data loss, reducing data storage costs, and improving the efficiency of long-cycle cloud computing tasks. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0051] Figure 1 A schematic diagram of a system architecture provided for this application;

[0052] Figure 2 A schematic diagram of an optional hardware structure of a terminal provided in this application;

[0053] Figure 3 A schematic diagram of the structure of a server provided for this application;

[0054] Figure 4 A schematic diagram of a flow chart of a cluster fault prediction method provided in an embodiment of the present application;

[0055] Figure 5 A flow chart of a cluster fault prediction model training method provided in an embodiment of the present application;

[0056] Figure 6 A schematic diagram of the structure of a cluster fault prediction device provided in an embodiment of the present application;

[0057] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] The following describes the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0059] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0060] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0061] See also Figure 1 , Figure 1 A schematic diagram of a system architecture is shown. The system may include a terminal 100 and a server 200. The server 200 may include one or more servers ( Figure 1In the example, a server is included, and the server 200 can provide the cluster fault prediction method provided in the embodiment of the present application for one or more terminals.

[0062] Among them, an application corresponding to the third-party system can be installed on the terminal 100. The above application and web page can provide an interface. The terminal 100 can receive relevant parameters entered by the user on the interface and send the above parameters to the server 200. The server 200 can obtain processing results based on the received parameters and return the processing results to the terminal 100.

[0063] It should be understood that in some optional implementations, the terminal 100 can also complete the action of obtaining the processing result based on the received parameters by itself without the cooperation of the server, and the embodiments of the present application are not limited to this.

[0064] Next describe Figure 1 The product form of the mid-terminal 100;

[0065] The terminal 100 in the embodiment of the present application can be a mobile phone, a tablet computer, a wearable device, a vehicle-mounted device, an augmented reality (AR) / virtual reality (VR) device, a laptop computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc., and the embodiment of the present application does not impose any limitation on this.

[0066] Figure 2 An optional hardware structure diagram of the terminal 100 is shown.

[0067] refer to Figure 2 As shown, the terminal 100 may include a radio frequency unit 110, a memory 120, an input unit 130, a display unit 140, a camera 150 (optional), an audio circuit 160 (optional), a speaker 161 (optional), a microphone 162 (optional), an earphone jack 163 (optional), a processor 170, an external interface 180, a power supply 190 and other components. Those skilled in the art will appreciate that Figure 2 These are merely examples of terminals or multi-function devices and do not constitute limitations on the terminals or multi-function devices, which may include more or fewer components than those shown in the figures, or combinations of certain components, or different components.

[0068] The input unit 130 can be used to receive input digital or character information, and generate key signal input related to the user settings and function control of the portable multifunctional device. Specifically, the input unit 130 may include a touch screen 131 (optional) and / or other input devices 132. The touch screen 131 can collect the user's touch operations on or near it (such as the user's operation on or near the touch screen using any suitable object such as fingers, joints, stylus, etc.), and drive the corresponding connection device according to a pre-set program. The touch screen can detect the user's touch action on the touch screen, convert the touch action into a touch signal and send it to the processor 170, and can receive and execute the command sent by the processor 170; the touch signal at least includes the touch point coordinate information. The touch screen 131 can provide an input interface and an output interface between the terminal 100 and the user. In addition, the touch screen can be implemented using multiple types such as resistive, capacitive, infrared and surface acoustic wave. In addition to the touch screen 131, the input unit 130 can also include other input devices. Specifically, other input devices 132 may include, but are not limited to, one or more of a physical keyboard, function keys (such as a volume control key, a switch key, etc.), a trackball, a mouse, a joystick, and the like.

[0069] Among them, the input device 132 can receive input data and the like.

[0070] The display unit 140 may be used to display information input by a user or provided to a user, various menus of the terminal 100, an interactive interface, file display, and / or playback of any multimedia file.

[0071] The memory 120 can be used to store instructions and data. The memory 120 can mainly include an instruction storage area and a data storage area. The data storage area can store various data, such as multimedia files, texts, etc.; the instruction storage area can store software units such as operating systems, applications, instructions required for at least one function, or their subsets and extensions. It can also include a non-volatile random access memory; provide the processor 170 with hardware, software and data resources including management of computing and processing equipment, and support control software and applications. It is also used for the storage of multimedia files, and the storage of running programs and applications.

[0072] The processor 170 is the control center of the terminal 100. It uses various interfaces and lines to connect various parts of the entire terminal 100. By running or executing instructions stored in the memory 120 and calling data stored in the memory 120, it executes various functions of the terminal 100 and processes data, thereby controlling the terminal device as a whole. Optionally, the processor 170 may include one or more processing units; preferably, the processor 170 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface and application program, and the modem processor mainly processes wireless communication. It is understandable that the above-mentioned modem processor may not be integrated into the processor 170. In some embodiments, the processor and the memory may be implemented on a single chip, and in some embodiments, they may also be implemented separately on separate chips. The processor 170 may also be used to generate corresponding operation control signals, send them to corresponding components of the computing and processing device, read and process data in the software, especially read and process data and programs in the memory 120, so that each functional module therein performs corresponding functions, thereby controlling the corresponding components to act according to the requirements of the instructions.

[0073] The memory 120 may be used to store relevant software codes, the processor 170 may execute the steps of the cluster fault prediction method, and may also schedule other units (such as the above-mentioned input unit 130 and display unit 140) to implement corresponding functions.

[0074] The radio frequency unit 110 (optional) can be used for receiving and sending information or receiving and sending signals during a call, for example, after receiving the downlink information of the base station, it is sent to the processor 170 for processing; in addition, the designed uplink data is sent to the base station. Generally, the RF circuit includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (Low Noise Amplifier, LNA), a duplexer, etc. In addition, the radio frequency unit 110 can also communicate with network devices and other devices through wireless communication. The wireless communication can use any communication standard or protocol, including but not limited to Global System of Mobile communication (Global System of Mobile communication, GSM), General Packet Radio Service (General Packet Radio Service, GPRS), Code Division Multiple Access (Code Division Multiple Access, CDMA), Wideband Code Division Multiple Access (Wideband Code Division Multiple Access, WCDMA), Long Term Evolution (Long Term Evolution, LTE), email, Short Messaging Service (SMS), etc.

[0075] In this embodiment of the present application, the RF unit 110 can send data to the server 200 and receive processing results sent by the server 200.

[0076] It should be understood that the radio frequency unit 110 is optional and can be replaced by other communication interfaces, such as a network port.

[0077] The terminal 100 also includes a power supply 190 (such as a battery) for supplying power to various components. Preferably, the power supply can be logically connected to the processor 170 through a power management system, so that the power management system can manage functions such as charging, discharging, and power consumption.

[0078] The terminal 100 further includes an external interface 180 , which may be a standard Micro USB interface or a multi-pin connector, and may be used to connect the terminal 100 to communicate with other devices, or to connect a charger to charge the terminal 100 .

[0079] Although not shown, the terminal 100 may also include a flashlight, a wireless fidelity (WiFi) module, a Bluetooth module, sensors with different functions, etc., which are not described in detail here. Some or all of the methods described below may be applied in the following embodiments. Figure 2 In the terminal 100 shown.

[0080] Next describe Figure 1 The product form of the server 200;

[0081] Figure 3 A structural diagram of a server 200 is provided, such as Figure 3 As shown, the server 200 includes a bus 201, a processor 202, a communication interface 203, and a memory 204. The processor 202, the memory 204, and the communication interface 203 communicate with each other via the bus 201.

[0082] The bus 201 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0083] The processor 202 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0084] The memory 204 may include a volatile memory, such as a random access memory (RAM). The memory 204 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard drive (HDD), or a solid state drive (SSD).

[0085] The memory 204 may be used to store relevant software codes, and the processor 202 may execute the steps of the chip cluster fault prediction method, and may also schedule other units to implement corresponding functions.

[0086] It should be understood that the above-mentioned terminal 100 and server 200 can be centralized or distributed devices, and the processors in the above-mentioned terminal 100 and server 200 (such as processor 170 and processor 202) can be hardware circuits (such as application specific integrated circuit (ASIC), field-programmable gate array (FPGA), general-purpose processor, digital signal processor (DSP), microprocessor or microcontroller, etc.), or a combination of these hardware circuits. For example, the processor can be a hardware system with an instruction execution function, such as a CPU, DSP, etc., or a hardware system without an instruction execution function, such as an ASIC, FPGA, etc., or a combination of the above-mentioned hardware systems without an instruction execution function and hardware systems with an instruction execution function.

[0087] The present invention provides a cluster fault prediction method, which is applied to Figure 1 The computer device in the example is used for illustration, and the computer device may specifically be the terminal 100 in the above figure or a system composed of the terminal 100 and the server 200. The cluster fault prediction method provided by the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0088] Reference Figure 4 , Figure 4 A schematic diagram of a flow chart of a cluster fault prediction method provided in an embodiment of the present application, the method comprising:

[0089] Step S401: Collect current cluster log data in the production environment.

[0090] In actual applications, the current cluster log data in the production environment can be collected from the cluster database.

[0091] The current cluster log data refers to the log information generated by each node, service, application or container in the cluster during operation. These logs record system events, errors, warnings, debugging information, etc., which are essential for understanding system behavior, diagnosing problems and optimizing performance.

[0092] Step S402: pre-process the current cluster log data to obtain target cluster log data.

[0093] Specifically, the abnormal values ​​that deviate from the normal range in the current cluster log data are corrected to obtain the intermediate cluster log data;

[0094] The missing values ​​in the intermediate cluster log data are filled to obtain the target cluster log data.

[0095] Among them, the methods used to fill missing values ​​include but are not limited to mean interpolation method, modeling prediction method and high-dimensional mapping method.

[0096] This application solves the problems of missing data and large differences in attribute ranges by preprocessing the current cluster log data. In practical applications, the preprocessing of the current cluster log data includes but is not limited to outlier correction and missing value filling, and may also include other data processing strategies, such as data format standardization, data merging, data transformation, etc.

[0097] Step S403: extract cluster feature data from the target cluster log data.

[0098] Cluster feature data usually contains many aspects to fully describe the characteristics and behaviors of clusters. Cluster feature data include but are not limited to cluster spatial distribution characteristics (such as the geometric shape of clusters in space, the spatial range occupied by clusters), cluster density characteristics (such as the ratio of the number of individuals or elements in a cluster to the space occupied), cluster structure characteristics (such as organizational structure, connection mode, etc.), etc.

[0099] In practical applications, statistical features and combined features can be used to determine cluster feature data.

[0100] Step S404: input the cluster feature data into a pre-trained cluster fault prediction model to obtain a cluster fault prediction result.

[0101] The cluster fault prediction model is trained using balanced cluster log data determined based on a lightweight ensemble learning model and a cluster undersampling method as training data.

[0102] The lightweight ensemble learning model combines multiple lightweight base learners and uses their diversity to improve the accuracy and robustness of the overall model. The purpose of using the lightweight ensemble learning model in this application is to select the cluster with the most likely fault in a shorter time, so as to provide a fault cluster for the subsequent training of the cluster fault prediction model.

[0103] Since most clusters are in normal working state in most cases, the number of fault log records is far less than the number of normal log records. Therefore, there is a sample imbalance problem in the cluster log data. Based on this, this application uses the method of clustering first and then undersampling to reduce the number of normal records in the cluster and obtain balanced cluster log data to improve the accuracy of cluster fault prediction model training.

[0104] In actual applications, cluster fault prediction results can be visualized on the front-end interface to facilitate operation and maintenance personnel to troubleshoot and take effective measures in a timely manner.

[0105] In summary, the present application discloses a cluster fault prediction method, which collects current cluster log data in a production environment, preprocesses the current cluster log data to obtain target cluster log data, extracts cluster feature data from the target cluster log data, and inputs the cluster feature data into a pre-trained cluster fault prediction model to obtain a cluster fault prediction result. The cluster fault prediction model is trained using balanced cluster log data determined based on a lightweight ensemble learning model and a cluster undersampling method as training data. The present application collects current cluster log data in real time in a production environment, and inputs the cluster features obtained through data preprocessing and feature extraction as input data into a cluster fault prediction model for fault prediction, completing a complete set of processes of data collection, preprocessing, and fault prediction, thereby being able to predict the occurrence of cluster faults in advance, assisting operation and maintenance personnel in making timely decisions, realizing intelligent operation and maintenance of clusters, effectively reducing data loss, reducing data storage costs, and improving the efficiency of long-cycle cloud computing tasks.

[0106] In one embodiment, step S403 may specifically include:

[0107] A statistical feature method is used to obtain multiple original feature data from the target cluster log data;

[0108] Using a combined feature method to construct a plurality of original feature data to obtain a plurality of combined feature data;

[0109] The cluster feature data is obtained by screening the plurality of combined feature data using a wrapper feature screening method.

[0110] Among them, the statistical feature method is a method of describing, analyzing and summarizing the quantitative characteristics and attribute characteristics of data through mathematical statistics, aiming to reveal the inherent laws and characteristics of data and provide a scientific basis for data analysis and decision-making. Based on this, this application uses the statistical feature method to obtain multiple original feature data from the target cluster log data.

[0111] The combined feature method refers to a method in machine learning that creates new features by combining two or more basic features in some form. These new features provide a new perspective for describing data and help the model discover and learn more complex patterns in the data. This application uses the combined feature method to process multiple original feature data to construct multiple combined feature data.

[0112] The wrapper feature screening method (also known as the wrapper method) is a feature selection technique that evaluates the effectiveness of feature subsets in the context of machine learning models. The core idea of ​​this method is to regard the selection of subsets as a search optimization problem, by generating different feature combinations and evaluating these combinations using a prediction model to find the optimal feature subset. In order to obtain the optimal cluster feature data, this application uses the wrapper feature screening method to filter cluster feature data from multiple combined feature data.

[0113] In one embodiment, see Figure 5 , a flow chart of a training method for a cluster fault prediction model disclosed in an embodiment of the present application, the method comprising:

[0114] Step S501: Obtain historical original cluster log data.

[0115] In actual applications, historical raw cluster log data within a period of time (for example, one month) can be obtained from the cluster database.

[0116] Step S502: Process the historical original cluster log data using a cluster undersampling method to obtain combined cluster data.

[0117] Most clusters are in normal working state in most cases. The number of cluster fault log records is much smaller than the number of cluster normal log records. Therefore, there is a sample imbalance problem in the cluster log data. To solve this problem, this application adopts the method of clustering first and then undersampling to reduce the number of cluster normal records.

[0118] Therefore, the specific implementation process of step S502 includes:

[0119] Preprocess the historical original cluster log data to obtain the historical target cluster log data;

[0120] Clustering the historical target cluster log data using a preset clustering algorithm to divide the historical target cluster log data into multiple categories of data;

[0121] A representative sample is selected from each category of data to obtain the combined cluster data.

[0122] The preprocessing of the historical original cluster log data includes but is not limited to outlier correction, missing value filling, data standardization, etc.

[0123] The preset clustering algorithm is determined according to actual needs. For example, the preset clustering algorithm may be a KMeans clustering algorithm, which is not limited in the present invention.

[0124] This application clusters the historical target cluster log data obtained by preprocessing, samples from each category of data, and selects representative samples, which can ensure that the obtained combined cluster data can retain the original valuable information to the greatest extent.

[0125] Step S503: extracting sample feature data from the combined cluster data.

[0126] In practical applications, this application uses statistical features and combined features to construct features, and uses a wrapper feature screening method to screen features to obtain sample feature data in the combined cluster data.

[0127] Step S504: input the sample feature data into a lightweight ensemble learning model to predict a fault cluster.

[0128] The fault cluster has a fault identifier.

[0129] After undersampling the clusters at the record level, the next step of this application is to use a lightweight ensemble learning model to sample the cluster attribute data at the cluster level, and use the lightweight ensemble learning model to select the cluster with the highest probability of failure, that is, the failure cluster, in a shorter time.

[0130] The reason why this application uses a lightweight ensemble learning model to predict fault clusters is that cluster fault prediction model training is based on the fault clusters predicted by the lightweight ensemble learning model, and the processing data for cluster fault prediction model training is often an order of magnitude less than the data processed by the lightweight ensemble learning model. If the lightweight ensemble learning model takes a long time, it will significantly increase the duration of the entire training process.

[0131] The ensemble learning model was chosen because it performs relatively well in predicting extremely unbalanced data and can achieve good generalization performance. After training a lightweight ensemble learning model on the training set and adjusting the model parameters, a high recall rate can often be achieved, but the precision rate is still not satisfactory. Therefore, the deep learning model of the cluster fault prediction model training is needed to improve the overall cluster fault prediction precision.

[0132] Step S505: randomly select a normal cluster that is relatively balanced with the faulty cluster.

[0133] The normal cluster has a normal identifier.

[0134] Step S506: Combine the faulty cluster and the normal cluster to obtain balanced cluster log data, and extract target feature data from the balanced cluster log data.

[0135] In practical applications, statistical features and combined features can be used to extract target feature data from balanced cluster log data.

[0136] The extracted target feature data may also be subjected to feature scaling to adjust the scale or magnitude of the data feature to ensure that all features are within the same magnitude range.

[0137] Step S507: Using the target feature data as training samples and a classification label of the target feature data as a sample label, a preset neural network is trained to obtain the cluster fault prediction model.

[0138] Among them, the preset neural network is a network composed of a convolutional neural network and a long short-term memory network.

[0139] In order to make full use of the temporal and spatial characteristics of cluster log data, this application uses a convolutional neural network combined with a long short-term memory network to form a network to build a cluster fault prediction model.

[0140] Convolutional neural network is a special type of artificial neural network. Different from other neural network models (such as BP neural network, RNN neural network, etc.), its most important feature is the convolution operation. Therefore, convolutional neural network has excellent performance in many fields, especially image-related tasks, such as image classification, image semantic segmentation, image retrieval, object detection and other computer vision problems.

[0141] The Long Short-term Memory (LSTM) network uses LSTM units to replace the neurons in RNN (Recurrent Neural Networks), and adds input gates, output gates, and forget gates to control the amount of information passing through, thereby solving the problem of gradient disappearance or explosion.

[0142] The output of the cluster fault prediction model trained in the present application is a determination result of whether each cluster will fail within a preset time period in the future (for example, within 30 days), where 0 indicates that the prediction result of the cluster fault prediction model is that the cluster will not fail, and 1 indicates that the prediction result of the cluster fault prediction model is that the cluster will fail.

[0143] After using the convolution-long short-term memory network model, the overall accuracy of the cluster fault prediction model has been greatly improved. This is because the fault cluster after the lightweight ensemble learning model predicts the output is no longer a problem of extreme data imbalance. In the case of not extremely imbalanced data, using the convolution-long short-term memory network for prediction can achieve higher accuracy.

[0144] In summary, this application also solves the problem of imbalanced cluster fault data categories when training a cluster fault prediction model. On the one hand, starting from the record attributes of the cluster, clustering is performed first, and then each category is undersampled, so that only a part of the large number of normal records is selected as input, while retaining useful information to the maximum extent; on the other hand, starting from the cluster itself, a lightweight integrated learning model is first used to screen out more likely fault clusters, and then mixed with randomly selected normal clusters that are relatively balanced with the fault cluster to form a new cluster set, that is, balanced cluster log data, and target feature data is extracted from the balanced cluster log data as the input of the convolution-long short-term memory network, so that the input of the convolution-long short-term memory network model is a balanced data set. After establishing a balanced data set, the role of the neural network model can be better utilized to improve the prediction accuracy of the cluster fault prediction model.

[0145] A cluster fault prediction method provided by an embodiment of the present application is introduced above. A device for executing the cluster fault prediction method is introduced below.

[0146] See also Figure 6 , Figure 6 A schematic diagram of the structure of a cluster fault prediction device provided in an embodiment of the present application, the device comprising:

[0147] The log acquisition unit 601 is used to collect the current cluster log data in the production environment;

[0148] In actual applications, the current cluster log data in the production environment can be collected from the cluster database.

[0149] The current cluster log data refers to the log information generated by each node, service, application or container in the cluster during operation. These logs record system events, errors, warnings, debugging information, etc., which are essential for understanding system behavior, diagnosing problems and optimizing performance.

[0150] A preprocessing unit 602 is used to preprocess the current cluster log data to obtain target cluster log data;

[0151] The preprocessing unit 602 may be specifically used for:

[0152] Correcting abnormal values ​​in the current cluster log data that deviate from a normal range to obtain intermediate cluster log data;

[0153] The missing values ​​in the intermediate cluster log data are filled to obtain the target cluster log data.

[0154] Among them, the methods used to fill missing values ​​include but are not limited to mean interpolation method, modeling prediction method and high-dimensional mapping method.

[0155] This application solves the problems of missing data and large differences in attribute ranges by preprocessing the current cluster log data. In practical applications, the preprocessing of the current cluster log data includes but is not limited to outlier correction and missing value filling, and may also include other data processing strategies, such as data format standardization, data merging, data transformation, etc.

[0156] A feature extraction unit 603 is used to extract cluster feature data from the target cluster log data;

[0157] Cluster feature data usually contains many aspects to fully describe the characteristics and behaviors of clusters. Cluster feature data include but are not limited to cluster spatial distribution characteristics (such as the geometric shape of clusters in space, the spatial range occupied by clusters), cluster density characteristics (such as the ratio of the number of individuals or elements in a cluster to the space occupied), cluster structure characteristics (such as organizational structure, connection mode, etc.), etc.

[0158] In practical applications, statistical features and combined features can be used to determine cluster feature data.

[0159] The fault prediction unit 604 is used to input the cluster feature data into a pre-trained cluster fault prediction model to obtain a cluster fault prediction result, wherein the cluster fault prediction model is trained using balanced cluster log data determined based on a lightweight ensemble learning model and a cluster undersampling method as training data.

[0160] The cluster fault prediction model is trained using balanced cluster log data determined based on a lightweight ensemble learning model and a cluster undersampling method as training data.

[0161] The lightweight ensemble learning model combines multiple lightweight base learners and uses their diversity to improve the accuracy and robustness of the overall model. The purpose of using the lightweight ensemble learning model in this application is to select the cluster with the most likely fault in a shorter time, so as to provide a fault cluster for the subsequent training of the cluster fault prediction model.

[0162] Since most clusters are in normal working state in most cases, the number of fault log records is far less than the number of normal log records. Therefore, there is a sample imbalance problem in the cluster log data. Based on this, this application uses the method of clustering first and then undersampling to reduce the number of normal records in the cluster and obtain balanced cluster log data to improve the accuracy of cluster fault prediction model training.

[0163] In actual applications, the cluster failure prediction results can be displayed on the front-end interface for users to view.

[0164] In summary, the present application discloses a cluster fault prediction device, which collects current cluster log data in a production environment, preprocesses the current cluster log data to obtain target cluster log data, extracts cluster feature data from the target cluster log data, and inputs the cluster feature data into a pre-trained cluster fault prediction model to obtain a cluster fault prediction result. The cluster fault prediction model is trained using balanced cluster log data determined based on a lightweight ensemble learning model and a cluster undersampling method as training data. The present application collects current cluster log data in real time in a production environment, and inputs the cluster features obtained through data preprocessing and feature extraction as input data into a cluster fault prediction model for fault prediction, completing a complete set of processes of data collection, preprocessing, and fault prediction, thereby being able to predict the occurrence of cluster faults in advance, assisting operation and maintenance personnel in making timely decisions, realizing intelligent operation and maintenance of clusters, effectively reducing data loss, reducing data storage costs, and improving the efficiency of long-cycle cloud computing tasks.

[0165] In one embodiment, the feature extraction unit 603 may be specifically used for:

[0166] A statistical feature method is used to obtain multiple original feature data from the target cluster log data;

[0167] Using a combined feature method to construct a plurality of original feature data to obtain a plurality of combined feature data;

[0168] The cluster feature data is obtained by screening the plurality of combined feature data using a wrapper feature screening method.

[0169] Among them, the statistical feature method is a method of describing, analyzing and summarizing the quantitative characteristics and attribute characteristics of data through mathematical statistics, aiming to reveal the inherent laws and characteristics of data and provide a scientific basis for data analysis and decision-making. Based on this, this application uses the statistical feature method to obtain multiple original feature data from the target cluster log data.

[0170] The combined feature method refers to a method in machine learning that creates new features by combining two or more basic features in some form. These new features provide a new perspective for describing data and help the model discover and learn more complex patterns in the data. This application uses the combined feature method to process multiple original feature data to construct multiple combined feature data.

[0171] The wrapper feature screening method (also known as the wrapper method) is a feature selection technique that evaluates the effectiveness of feature subsets in the context of machine learning models. The core idea of ​​this method is to regard the selection of subsets as a search optimization problem, by generating different feature combinations and evaluating these combinations using a prediction model to find the optimal feature subset. In order to obtain the optimal cluster feature data, this application uses the wrapper feature screening method to filter cluster feature data from multiple combined feature data.

[0172] In one embodiment, the cluster fault prediction device further includes: a model training unit, configured to train the cluster fault prediction model.

[0173] Among them, the model training unit may include:

[0174] The historical data acquisition subunit is used to obtain historical original cluster log data;

[0175] A cluster undersampling subunit, used for processing the historical original cluster log data using a cluster undersampling method to obtain combined cluster data;

[0176] A feature extraction subunit, used to extract sample feature data from the combined cluster data;

[0177] A prediction subunit, used for inputting the sample feature data into a lightweight ensemble learning model to predict a fault cluster, wherein the fault cluster has a fault identifier;

[0178] A random data selection subunit, used for randomly selecting a normal cluster that is relatively balanced with the fault cluster, wherein the normal cluster has a normal identifier;

[0179] A data combination subunit, used for combining the faulty cluster and the normal cluster to obtain balanced cluster log data, and extracting target feature data from the balanced cluster log data;

[0180] A training subunit is used to use the target feature data as training samples and a classification label of the target feature data as a sample label to train a preset neural network to obtain the cluster fault prediction model, wherein the preset neural network is a network composed of a convolutional neural network and a long short-term memory network.

[0181] After undersampling the clusters at the record level, the next step of this application is to use a lightweight ensemble learning model to sample the cluster attribute data at the cluster level, and use the lightweight ensemble learning model to select the cluster with the highest probability of failure, that is, the failure cluster, in a shorter time.

[0182] The reason why this application uses a lightweight ensemble learning model to predict fault clusters is that cluster fault prediction model training is based on the fault clusters predicted by the lightweight ensemble learning model, and the processing data for cluster fault prediction model training is often an order of magnitude less than the data processed by the lightweight ensemble learning model. If the lightweight ensemble learning model takes a long time, it will significantly increase the duration of the entire training process.

[0183] The ensemble learning model was chosen because it performs relatively well in predicting extremely unbalanced data and can achieve good generalization performance. After training a lightweight ensemble learning model on the training set and adjusting the model parameters, a high recall rate can often be achieved, but the precision rate is still not satisfactory. Therefore, the deep learning model of the cluster fault prediction model training is needed to improve the overall cluster fault prediction precision.

[0184] In summary, this application also solves the problem of imbalanced cluster fault data categories when training a cluster fault prediction model. On the one hand, starting from the record attributes of the cluster, clustering is performed first, and then each category is undersampled, so that only a part of the large number of normal records is selected as input, while retaining useful information to the maximum extent; on the other hand, starting from the cluster itself, a lightweight integrated learning model is first used to screen out more likely fault clusters, and then mixed with randomly selected normal clusters that are relatively balanced with the fault cluster to form a new cluster set, that is, balanced cluster log data, and target feature data is extracted from the balanced cluster log data as the input of the convolution-long short-term memory network, so that the input of the convolution-long short-term memory network model is a balanced data set. After establishing a balanced data set, the role of the neural network model can be better utilized to improve the prediction accuracy of the cluster fault prediction model.

[0185] Most clusters are in normal working state in most cases. The number of cluster fault log records is much smaller than the number of cluster normal log records. Therefore, there is a sample imbalance problem in the cluster log data. To solve this problem, this application adopts the method of clustering first and then undersampling to reduce the number of cluster normal records.

[0186] The cluster undersampling subunit can be specifically used for:

[0187] Preprocessing the historical original cluster log data to obtain historical target cluster log data;

[0188] Clustering the historical target cluster log data using a preset clustering algorithm to divide the historical target cluster log data into multiple categories of data;

[0189] A representative sample is selected from each category of data to obtain the combined cluster data.

[0190] The present application also provides an electronic device in an embodiment. Figure 7 As shown, it shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiment of the present application. The electronic device in the embodiment of the present application may include but is not limited to fixed terminals such as mobile phones, laptops, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, etc. Figure 7 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0191] like Figure 7 As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 to a random access memory (RAM) 703. When the electronic device is powered on, various programs and data required for the operation of the electronic device are also stored in the RAM 703. The processing device 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0192] Typically, the following devices may be connected to the I / O interface 705: an input device 706 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 707 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 708 including, for example, a memory card, a hard disk, etc.; and a communication device 709. The communication device 709 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although Figure 7An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0193] An embodiment of the present application also provides a computer program product including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements any cluster fault prediction method provided in the embodiment of the present application.

[0194] A computer-readable storage medium is also provided in an embodiment of the present application. The storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any cluster fault prediction method provided in an embodiment of the present application.

[0195] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0196] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0197] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0198] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

Claims

1. A cluster failure prediction method, characterized in that: include: Collect current cluster log data in the production environment; Preprocessing the current cluster log data to obtain target cluster log data; Extracting cluster feature data from the target cluster log data; The cluster feature data is input into a pre-trained cluster fault prediction model to obtain a cluster fault prediction result, wherein the cluster fault prediction model is trained using balanced cluster log data determined based on a lightweight ensemble learning model and a cluster undersampling method as training data.

2. The cluster failure prediction method according to claim 1, characterized in that: Preprocessing the current cluster log data to obtain target cluster log data includes: Correcting abnormal values ​​in the current cluster log data that deviate from a normal range to obtain intermediate cluster log data; The missing values ​​in the intermediate cluster log data are filled to obtain the target cluster log data.

3. The cluster failure prediction method according to claim 1, characterized in that: The step of extracting cluster feature data from the target cluster log data includes: Using a statistical feature method to obtain a plurality of original feature data from the target cluster log data; Using a combined feature method to construct a plurality of original feature data to obtain a plurality of combined feature data; The cluster feature data is obtained by screening the plurality of combined feature data using a wrapper feature screening method.

4. The cluster failure prediction method according to any one of claims 1 to 3, characterized in that: The training process of the cluster fault prediction model is as follows: Get historical raw cluster log data; Processing the historical original cluster log data using a cluster undersampling method to obtain combined cluster data; extracting sample feature data from the combined cluster data; Inputting the sample feature data into a lightweight ensemble learning model to predict a fault cluster, wherein the fault cluster has a fault identifier; Randomly selecting a normal cluster that is relatively balanced with the faulty cluster, wherein the normal cluster has a normal identifier; Combining the fault cluster and the normal cluster to obtain balanced cluster log data, and extracting target feature data from the balanced cluster log data; The target feature data is used as a training sample, and a classification label of the target feature data is used as a sample label, and a preset neural network is trained to obtain the cluster fault prediction model, wherein the preset neural network is a network composed of a convolutional neural network and a long short-term memory network.

5. The cluster failure prediction method according to claim 4, characterized in that: The method of processing the historical original cluster log data by using a cluster undersampling method to obtain combined cluster data includes: Preprocessing the historical original cluster log data to obtain historical target cluster log data; Clustering the historical target cluster log data using a preset clustering algorithm to divide the historical target cluster log data into multiple categories of data; A representative sample is selected from each category of data to obtain the combined cluster data.

6. A cluster failure prediction device, characterized in that: include: The log acquisition unit is used to collect the current cluster log data in the production environment; A preprocessing unit, used for preprocessing the current cluster log data to obtain target cluster log data; A feature extraction unit, used to extract cluster feature data from the target cluster log data; A fault prediction unit is used to input the cluster feature data into a pre-trained cluster fault prediction model to obtain a cluster fault prediction result, wherein the cluster fault prediction model is trained using balanced cluster log data determined based on a lightweight ensemble learning model and a cluster undersampling method as training data.

7. The cluster failure prediction device according to claim 6, characterized in that: The cluster fault prediction device also includes: a model training unit; The model training unit is used to train the cluster fault prediction model; The model training unit comprises: The historical data acquisition subunit is used to obtain historical original cluster log data; A cluster undersampling subunit, used for processing the historical original cluster log data using a cluster undersampling method to obtain combined cluster data; A feature extraction subunit, used to extract sample feature data from the combined cluster data; A prediction subunit, used for inputting the sample feature data into a lightweight ensemble learning model to predict a fault cluster, wherein the fault cluster has a fault identifier; A random data selection subunit, used for randomly selecting a normal cluster that is relatively balanced with the fault cluster, wherein the normal cluster has a normal identifier; A data combination subunit, used for combining the faulty cluster and the normal cluster to obtain balanced cluster log data, and extracting target feature data from the balanced cluster log data; A training subunit is used to use the target feature data as training samples and a classification label of the target feature data as a sample label to train a preset neural network to obtain the cluster fault prediction model, wherein the preset neural network is a network composed of a convolutional neural network and a long short-term memory network.

8. A computer program product, characterized in that The method comprises computer-readable instructions, and when the computer-readable instructions are executed on an electronic device, the electronic device implements the cluster fault prediction method according to any one of claims 1 to 5.

9. An electronic device, characterized in that: The method comprises at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the electronic device can implement the cluster failure prediction method according to any one of claims 1 to 5.

10. A computer storage medium, characterized in that: The storage medium carries one or more computer programs, and when the one or more computer programs are executed by an electronic device, the electronic device can implement the cluster failure prediction method as described in any one of claims 1 to 5.

Images