System monitoring method and device, computer equipment and storage medium

Abstract

The invention relates to the field of data processing and financial science and technology, and provides a system monitoring method and device, computer equipment and a storage medium, and the method comprises the steps: obtaining log data of a target system about a user transaction in real time, extracting an operation index of the target system from the log data, and obtaining an index data flow; calculating a monitoring index corresponding to a first time period in a first time period closest to the current time of the target system based on the index data stream, and storing the monitoring index corresponding to the first time period in a preset database; obtaining monitoring indexes corresponding to a first time period in a second time period adjacent to the first time period from a preset database, and calculating a change rate absolute value between the monitoring indexes corresponding to the first time period in the first time period and the second time period; and when the absolute value of the change rate meets an early warning condition, outputting early warning information. According to the invention, fault early warning of the target system can be realized.

Description

Technical Field

[0001] The present application relates to the fields of data processing and financial technology, and in particular to system monitoring methods, devices, computer equipment and storage media. Background Art

[0002] With the development of the times and the advancement of science and technology, various application systems have been put into use and provide people with a variety of services. The application system is an integrated human-computer system that connects concepts, designs and technologies with the actual situation of users, directly faces users, and supports and serves the actual work of users. For example, a financial service system that can provide financial services, purchase financial products, complete financial transactions, and transmit financial information. In order to enable the application system to run smoothly and provide services to users continuously, it is necessary to perform fault detection on the application system so that it can be repaired in a timely manner after a fault occurs.

[0003] However, when an application system fails, the normal use of users will be affected during the failure and the process of fault repair, and even cause losses. For example, a failure in a financial service system will cause users to be unable to complete transactions smoothly. Therefore, how to monitor the application system to achieve early warning of application system failures has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] The present application provides a system monitoring method, apparatus, computer equipment and storage medium, which can realize fault warning of application system.

[0005] In a first aspect, the present application provides a system monitoring method, which includes: acquiring log data about user transactions of a target system in real time, extracting operating indicators of the target system from the log data, and obtaining an indicator data stream; calculating the monitoring indicators corresponding to a first time period within a first time period closest to a current time of the target system based on the indicator data stream, and storing the monitoring indicators corresponding to the first time period in a preset database; acquiring the monitoring indicators corresponding to a first time period within a second time period adjacent to the first time period from the preset database, and calculating the absolute value of the change rate between the monitoring indicators corresponding to the first time period within the first time period and the first time period within the second time period; and outputting a warning message when the absolute value of the change rate meets a warning condition.

[0006] In a second aspect, the present application provides a system monitoring device, which includes: an acquisition module, which is used to acquire log data about user transactions of a target system in real time, extract operating indicators of the target system from the log data, and obtain an indicator data stream; a calculation module, which is used to calculate the monitoring indicators corresponding to a first time period within a first time period closest to the current time of the target system based on the indicator data stream, store the monitoring indicators corresponding to the first time period in a preset database, and obtain the monitoring indicators corresponding to the first time period within a second time period adjacent to the first time period from the preset database, and calculate the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the first time period in the second time period; an early warning module, which is used to output early warning information when the absolute value of the change rate meets the early warning condition.

[0007] In a third aspect, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned system monitoring method when executing the computer program.

[0008] In a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned system monitoring method are implemented.

[0009] The present application obtains the log data of user transactions of the target system in real time through the service end, extracts the operation index of the target system from the log data, obtains the index data stream, and calculates the monitoring index corresponding to the first time period in the first time period closest to the current time of the target system based on the index data stream, stores the monitoring index corresponding to the first time period in the preset database, obtains the monitoring index corresponding to the first time period in the second time period adjacent to the first time period from the preset database, calculates the absolute value of the change rate between the monitoring index corresponding to the first time period in the first time period and the first time period in the second time period, and then outputs the warning information when the absolute value of the change rate meets the warning condition. The present application obtains the monitoring index corresponding to each time period based on the index data stream of the target system to quantify the operation of each time period of the target system, and then calculates the absolute value of the change rate between the monitoring index corresponding to the first time period in the first time period and the first time period in the second time period to reflect the change trend of the operation of the target system. When the absolute value of the change rate meets the warning condition, it indicates that the operation of the target system is not stable, and the service end outputs the warning information to timely carry out fault warning when the operation of the target system is not stable, effectively reducing the possibility of failure of the target system, and effectively improving the stability and reliability of the operation of the target system. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0011] Figure 1 is a schematic diagram of an application environment of a system monitoring method in one embodiment of the present invention;

[0012] Figure 2 is a flow chart of a system monitoring method in one embodiment of the present invention;

[0013] Figure 3 is a structural schematic diagram of a system monitoring device in one embodiment of the present invention;

[0014] Figure 4 is a schematic diagram of a structure of a computer device in one embodiment of the present invention;

[0015] Figure 5 It is another structural schematic diagram of a computer device in one embodiment of the present invention. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0017] The system monitoring method provided in the embodiment of the present application can be applied in Figure 1In an application environment, the client communicates with the server through a network. The server can obtain the log data of the target system about the user transaction in real time, extract the operation index of the target system from the log data, obtain the index data stream, and calculate the monitoring index corresponding to the first time period in the first time period closest to the current time of the target system based on the index data stream, store the monitoring index corresponding to the first time period in a preset database, obtain the monitoring index corresponding to the first time period in the second time period adjacent to the first time period from the preset database, calculate the absolute value of the change rate between the monitoring indexes corresponding to the first time period in the first time period and the second time period, and then output the warning information when the absolute value of the change rate meets the warning condition. The present application obtains the monitoring index corresponding to each time period based on the index data stream of the target system to quantify the operation of each time period of the target system, and then calculates the absolute value of the change rate between the monitoring index corresponding to the first time period in the first time period and the first time period in the second time period to reflect the change trend of the operation of the target system. When the absolute value of the change rate meets the early warning condition, it indicates that the operation of the target system is not stable. The server outputs early warning information to timely provide fault early warning when the operation of the target system is not stable, effectively reducing the possibility of failure of the target system and effectively improving the stability and reliability of the operation of the target system. Among them, the client can be but not limited to various personal computers, laptops, smart phones, tablet computers and portable wearable devices. The server can be implemented with an independent server or a server cluster composed of multiple servers. The present application is described in detail below through specific embodiments.

[0018] See also Figure 2 As shown, Figure 2 A flow chart of a monitoring method for a system provided in an embodiment of the present application includes the following steps:

[0019] S100: Obtain log data about user transactions of a target system in real time, extract operation indicators of the target system from the log data, and obtain an indicator data stream.

[0020] The target system is an application system, which may include one or more application software. When the target system is running, the application software included in the target system can provide users with various information and services. The target system can be an application system such as a financial service system, an e-commerce system, or other systems.

[0021] Log data is data that records detailed information about system operation in real time. The log data of the target system about user transactions includes information such as transaction events initiated by users, related business lines, time of submitting transaction events, time of target system responding to transactions, etc. The server can record data in real time during the operation of the target system to obtain the log data of the target system. In some embodiments, the SDK (tool code) for collecting operation data is implanted in the target system to record the data generated by the operation of the target system, thereby obtaining the log data of the target system.

[0022] For example, if user A submits a payment settlement transaction event, the log data will record the payment settlement transaction event, and record that the corresponding business line is the insurance business line, the user's operation time is 12:53:13.05 on January 2, and the target system's response time is 12:53:13.55 on January 2. For another example, if user B submits a product purchase transaction event, the log data will record the product purchase transaction event, and record that the corresponding business line is the financial management business line, the user's operation time is 12:54:11.01 on January 2, and the target system's response time is 12:54:11.65 on January 2.

[0023] Operational indicators are quantitative reflections of the target system's response to transaction events submitted by users. Operational indicators include transaction response time and / or the number of transactions processed per second.

[0024] Transaction response time refers to the time from when a user issues a transaction request to when the target system responds. Specifically, it can be the interval between the user's submission time and the target system's response time for the same transaction event in the log data.

[0025] For example, the log data records a payment settlement transaction event, the user's submission time is January 2, 12:53:13.05 seconds, and the target system's response time is January 2, 12:53:13.55 seconds. The transaction response time of this transaction event is 0.5 seconds. For another example, user B submits a product purchase transaction event, and the log data records the product purchase transaction event, and records that the corresponding business line is the financial management business line, the user's operation time is January 2, 12:54:11.01 seconds, and the target system's response time is January 2, 12:54:11.65 seconds. The transaction response time of this transaction time is 0.64 seconds.

[0026] The transaction response time can reflect how fast the target system processes transaction events, and thus reflect the target system's ability to handle transaction events. The stronger the target system's processing capability, the shorter the transaction response time; the weaker the target system's processing capability, the longer the transaction response time.

[0027] The number of transactions processed per second (TPS) is a performance indicator that expresses the processing capacity of the target system. During operation, the target system usually needs to serve multiple users and process multiple transaction events at the same time. The number of transactions processed per second by the target system can reflect the target system's ability to process transaction events. The calculation formula for the number of transactions processed per second is the total number of transactions divided by the total time.

[0028] For example, there are 1,200 successfully responded transaction events recorded in the operation log from January 2nd [12:53:00 to 12:54:00]. The total number of transactions is 1,200 and the total time is 60 seconds. Therefore, the number of transactions processed per second by the target system from January 2nd [12:53:00 to 12:54:00] is 20.

[0029] In some embodiments, the server collects log data of the target system through Filebeat (a lightweight log collector), and searches and monitors the log data through Kafka (a message publishing and subscription system) to generate an indicator data stream of the Topic category.

[0030] S200: Calculate the monitoring indicator corresponding to the first time period within the first time period closest to the current time of the target system based on the indicator data stream, and store the monitoring indicator corresponding to the first time period in a preset database.

[0031] The first time period is the time period closest to the current time of the target system. Each time period includes multiple time periods. The first time period may be the time period closest to the current time and in which an indicator data flow has been generated.

[0032] For example, if one day is a time period and one minute is a time period, and the current time of the target system is 12:15:00 on January 2, then the first time period is from 0:00 on January 2 to 24:00 on January 2, and the first time period is [12:14:00 to 12:15:00].

[0033] Optionally, a time period may be one day, one week, ten days, one month, etc., or other time lengths, and a time period may be 0.5 minutes, 1 minute, 2 minutes, 3 minutes, 5 minutes, etc., or other time lengths.

[0034] Since the target system is always running, the target system's indicator data stream is also generated in real time, and a corresponding indicator data stream is generated for each time period. The server can obtain the monitoring indicator corresponding to the first time period according to the indicator data stream of the first time period in the first time period, and store the monitoring indicator corresponding to the first time period in a preset database.

[0035] Optionally, the server obtains the indicator data stream of the target system in each time period in real time, and calculates the monitoring indicators corresponding to the time period using the indicator data stream of each time period in turn, and stores them in a preset database.

[0036] In some embodiments, the server performs streaming calculations on the indicator data stream to obtain monitoring indicators, for details, see the following steps included in S200.

[0037] S210: Selecting, from the indicator data streams, an indicator data stream of a first time period within the first time period that is closest to the current time of the target system.

[0038] S220: Perform streaming calculation on the indicator data stream of the first time period within the first time cycle to obtain an average value of all operating indicators in the indicator data stream of the first time period, where the average value is a monitoring indicator corresponding to the first time period.

[0039] Stream computing is a computing method for real-time analysis of large-scale flowing data. The core of stream computing is to process data in real time, rather than storing data first and then acquiring and analyzing it in batches like traditional batch computing. Stream computing can greatly improve the timeliness of computing.

[0040] The indicator data stream of each time period includes multiple operating indicators. The monitoring indicators corresponding to the time period can be obtained by calculating the average value of these operating indicators. Therefore, the indicator data stream of the first time period in the first time period is stream-calculated to obtain the average value of all operating indicators in the indicator data stream of the first time period, which is used as the monitoring indicator corresponding to the first time period. In addition, the stream calculation can be calculated in a timely manner during the process of generating the indicator data stream, effectively improving the real-time nature of the monitoring indicators and realizing a more timely reflection of the operating status of the target system.

[0041] In some embodiments, the operating indicator is the transaction response time of the target system, and the monitoring indicator corresponding to each time period is the average value of all transaction response times in the time period, that is, the average transaction response time of the target system in each time period.

[0042] In some embodiments, the operating indicator data is the number of transactions processed per second by the target system, and the monitoring indicator corresponding to each time period is the average number of transactions processed per second in the time period, that is, the average number of transactions processed per second by the target system in each time period.

[0043] In some embodiments, the operation index data includes the transaction response time of the target system and the number of transactions processed per second. The server can perform streaming calculations on the index data stream, calculate the average transaction response time of the target system in the first time period within the first time period based on the index data stream, and calculate the average number of transactions processed per second by the target system in the first time period within the first time period based on the index data stream, thereby multiplying the average transaction response time of the target system in the first time period within the first time period by the average number of transactions processed per second to obtain the monitoring index corresponding to the first time period within the first time period.

[0044] S300: Obtain from the preset database a monitoring indicator corresponding to a first time period in a second time period adjacent to the first time period, and calculate an absolute value of a change rate between monitoring indicators corresponding to the first time period in the first time period and the first time period in the second time period.

[0045] The second time period is a time period that has ended and is adjacent to the first time period. For example, if one day is a time period, and the current time of the target system is 12:15 on January 2, then the first time period is from 0:00 on January 2 to 24:00 on January 2, where the first time period is [12:14 to 12:15], then the first time period in the first time period is [12:14 to 12:15] on January 2, the second time period is from 0:00 on January 1 to 24:00 on January 1, and the first time period in the second time period is [12:14 to 12:15] on January 1.

[0046] The server can understand the changing trend of the target system operation status by calculating the absolute value of the rate of change between the monitoring indicator corresponding to the first time period within the first time period and the monitoring indicator corresponding to the first time period within the second time period. The absolute value of the rate of change is equal to the difference between the monitoring indicator corresponding to the first time period within the first time period and the monitoring indicator corresponding to the first time period within the second time period, divided by the absolute value of the rate of change obtained by the monitoring indicator corresponding to the first time period within the second time period.

[0047] For example, the operating indicator is the transaction response time of the target system. The monitoring indicator corresponding to the first time period in the first time period is 0.75 seconds, and the monitoring indicator corresponding to the first time period in the second time period is 0.5 seconds. The difference between the two is 0.25 seconds, and the absolute value of the rate of change between the monitoring indicator corresponding to the first time period in the first time period and the monitoring indicator corresponding to the first time period in the second time period is 50%.

[0048] Among them, when the operating indicator is the transaction response time of the target system, if the change rate of the monitoring indicator corresponding to the first time period within the first time period is positive compared with the monitoring indicator corresponding to the first time period within the second time period, it indicates that the time for the target system to respond to transaction transactions in the first time period within the first time period is increased, that is, the speed at which the target system responds to transaction transactions is slowed down, and the ability to process transaction transactions is reduced; if the change rate of the monitoring indicator corresponding to the first time period within the first time period is negative compared with the monitoring indicator corresponding to the first time period within the second time period, it indicates that the time for the target system to respond to transaction transactions in the first time period within the first time period is reduced, that is, the speed at which the target system responds to transaction transactions is accelerated, and the ability to process transaction transactions is improved.

[0049] When the operating indicator is the number of transactions processed per second by the target system, if the rate of change of the monitoring indicator corresponding to the first time period within the first time period is negative compared with the monitoring indicator corresponding to the first time period within the second time period, it indicates that the number of transaction transactions processed by the target system in the first time period within the first time period is less than that in the first time period within the second time period, that is, the speed at which the target system responds to transaction transactions slows down, and the ability to process transaction transactions decreases; if the rate of change of the monitoring indicator corresponding to the first time period within the first time period is positive compared with the monitoring indicator corresponding to the first time period within the second time period, it indicates that the number of transaction transactions processed by the target system in the first time period within the first time period is more than that in the first time period within the second time period, that is, the speed at which the target system responds to transaction transactions increases, and the ability to process transaction transactions improves.

[0050] Since the number of users served by the target system is different in different time periods, the number of transactions processed by the target system and the time to respond to transaction transactions in each time period will also be different. Therefore, by comparing and calculating the monitoring indicators corresponding to the same time periods in the first time period and the second time period, the operating trend of the target system in the first time period in the first time period can be more accurately displayed compared with the past, avoiding errors in the changing trend of the target system's operating conditions due to changes in other factors such as the number of users, resulting in errors in fault warnings, thereby effectively improving the reliability of fault warnings.

[0051] S400: When the absolute value of the change rate meets the warning condition, output warning information.

[0052] When the absolute value of the change rate between the monitoring indicator corresponding to the first time period in the first time period and the monitoring indicator corresponding to the first time period in the second time period meets the warning condition, it indicates that the operation status of the target system has changed significantly and the stability of the target system is poor. If it is not handled, a failure may occur. Therefore, the server outputs warning information to promptly issue a failure warning to the target system, and notifies business personnel to conduct investigation and processing before the failure occurs, effectively preventing the occurrence of failures and effectively improving the reliability and stability of the target system operation.

[0053] In some embodiments, the server determines whether the absolute value of the change rate between the monitoring indicators corresponding to the first time period within the first time period and the second time period meets the warning condition. When the absolute value of the change rate between the monitoring indicators corresponding to the first time period within the first time period and the second time period meets the warning condition, a warning information is sent to the target terminal in a preset warning method. The preset warning method includes a telephone call, a text message reminder, or an email reminder.

[0054] In some embodiments, the server determines through a threshold whether the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period of the second time period meets the warning condition, for details, refer to the following steps included in S400.

[0055] S410: Determine whether the absolute value of the change rate between the monitoring indicators corresponding to the first time period within the first time period and the second time period is greater than a first threshold.

[0056] If the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the second time period is greater than the first threshold, execute S420: output warning information.

[0057] When the absolute value of the rate of change between the monitoring indicator corresponding to the first time period within the first time period and the monitoring indicator corresponding to the first time period within the second time period is greater than the first threshold, the operation status of the target system in the first time period within the first time period changes significantly compared to the first time period within the second time period, indicating that the operation of the target system is not stable. The server then outputs an early warning message to prompt timely processing and troubleshooting.

[0058] In some embodiments, the server determines whether the target system meets the warning condition through the monitoring indicators corresponding to the first time period and the second time period.

[0059] S430: Acquire, from the preset database, a monitoring indicator corresponding to a second time period within the first time period.

[0060] S440: Calculate the absolute value of the change rate between the monitoring indicators corresponding to the first time period and the second time period within the first time period, where the second time period is a time period adjacent to the first time period.

[0061] The second time period is a time period adjacent to the first time period in the first time period, specifically a time period before the first time period. For example, if one day is a time period, one minute is a time period, the first time period is from 0:00 on January 2 to 24:00 on January 2, and the first time period in the first time period is [12:14 to 12:15] on January 2, then the second time period in the first time period is [12:13 to 12:14] on January 2.

[0062] Since the server obtains the indicator data stream of each time period in real time, uses the indicator data stream to calculate the monitoring indicators corresponding to each time period, and stores the obtained monitoring indicators corresponding to each time period in the target database, the server can obtain the monitoring indicators corresponding to the second time period within the first time period from the preset database, and calculate the absolute value of the rate of change between the monitoring indicators corresponding to the first time period within the first time period and the monitoring indicators corresponding to the second time period.

[0063] S450: Determine whether the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the first time period in the second time period is greater than the first threshold, and determine whether the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the second time period is greater than the second threshold.

[0064] If the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the first time period in the second time period is greater than the first threshold, and the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the second time period is greater than the second threshold, execute S420: output warning information.

[0065] When the absolute value of the change rate between the monitoring indicator corresponding to the first time period and the monitoring indicator corresponding to the second time period is greater than the first threshold, it indicates that the operation of the target system in the first time period has changed significantly compared with the second time period, indicating that the operation of the target system may not be stable. Moreover, since the second time period is adjacent to the first time period, if the absolute value of the change rate between the monitoring indicator corresponding to the first time period and the monitoring indicator corresponding to the second time period exceeds the second threshold, it indicates that the ability of the target system to process transaction events has changed significantly in a relatively short period of time, further reflecting that the operation of the target system is unstable. The server then outputs an early warning message to prompt timely processing and troubleshooting.

[0066] In some embodiments, the server may also output the warning analysis results of the target system for each time period, as shown in the following steps.

[0067] S500: Acquire monitoring indicators corresponding to all time periods within a target time period from the preset database, and divide the target time period into a plurality of regional time periods according to a preset time scale, each regional time period including a plurality of time periods.

[0068] The preset database stores the monitoring indicators corresponding to all time periods in each time cycle, and the server can obtain the monitoring indicators corresponding to the time periods in any time cycle from the preset database. The target time cycle can be any time cycle that has ended or is in progress. The server divides the preset time cycle into multiple regional time periods according to the preset time scale, and each regional time period includes multiple time periods. For example, with 1 day as a time cycle, 1 hour as a regional time period, and 1 minute as a time period, the target time cycle is from 0:00 on January 1 to 24:00 on January 1, [12:14 to 12:15] on January 1 as a time period, and [12:00 to 13:00] on January 1 as a regional time period, and the regional time includes 60 time periods. It should be understood that when the target time cycle is the time cycle in which the current time of the target system is located, the server obtains the monitoring indicators corresponding to all the time periods that have ended in the target time cycle from the preset database.

[0069] S510: Obtain monitoring indicators for each regional period according to monitoring indicators corresponding to the time periods included in each regional period, and output early warning analysis results for the target time period according to the monitoring indicators for each regional period.

[0070] The average value of the monitoring indicators corresponding to the time period included in each regional period is calculated to obtain the monitoring indicators corresponding to each regional period. The monitoring indicators of each regional period within the target time period are compared and analyzed, and the changing trend of the target system within the target time period can be quantified, thereby outputting the early warning analysis results.

[0071] S520: Obtain historical warning analysis results corresponding to multiple historical time periods, and calculate the warning probability of each regional time period according to each of the historical warning analysis results.

[0072] The historical time period is the time period that has ended. The server can analyze the monitoring indicators and the output of warning information for each historical time period and output the warning analysis results for each historical time period. Since the warning analysis results for each historical time period include the output of warning information in each regional time period, the server can calculate the warning probability of outputting warning information in each regional time period based on the warning analysis results.

[0073] S530: Generate a corrected warning threshold corresponding to each area period based on the warning probability of each area period.

[0074] Since the number of users accessing and using the target system in each regional time period is different, the number of users served simultaneously by the target system in different regional time periods is also different, and the number of transactions received is also different. Therefore, the probability of failure and warning probability of the target system in different regional time periods are different. Therefore, based on the warning probability of each regional time period, a corrected warning threshold corresponding to each regional time period can be generated, thereby further improving the accuracy of fault monitoring of the target system.

[0075] In one embodiment of the present invention, the correction warning threshold is generated according to the following steps:

[0076] If the warning probability is greater than a preset reference probability (e.g., 50%), an increase value of the first threshold is calculated (e.g., increase value = first threshold * (warning probability - preset reference probability)), and the first threshold is added with the calculated increase value to obtain the corrected warning threshold;

[0077] If the warning probability is equal to a preset reference probability (for example, 50%), the first threshold is used as the correction warning threshold;

[0078] If the warning probability is less than the preset reference probability (e.g., 50%), the reduction value of the first threshold is calculated (e.g., reduction value = first threshold * (preset reference probability - warning probability)), and the calculated reduction value is subtracted from the first threshold to obtain the corrected warning threshold.

[0079] In some embodiments, by determining the correction warning threshold corresponding to the regional period in which the time period is located, it is determined whether the absolute value of the change rate meets the warning condition. For details, refer to the following steps included in S400.

[0080] S460: Determine whether the absolute value of the change rate between the monitoring indicators corresponding to the first time period within the first time period and the second time period is greater than the correction warning threshold corresponding to the regional period in which the first time period is located.

[0081] If yes, execute S420: output the warning information.

[0082] The present application obtains the monitoring indicators corresponding to each time period based on the indicator data stream of the target system to quantify the operation status of each time period of the target system, and then calculates the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the first time period in the second time period to reflect the changing trend of the operation status of the target system. When the absolute value of the change rate meets the early warning condition, it indicates that the operation status of the target system is not stable. The server outputs early warning information to timely issue fault warnings when the operation status of the target system is not stable, effectively reducing the possibility of failure of the target system and effectively improving the stability and reliability of the operation of the target system.

[0083] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0084] In one embodiment, a monitoring device for a system is provided, and the monitoring device corresponds one-to-one with the monitoring method for the system in the above embodiment. Figure 3 As shown, the monitoring device includes an acquisition module 101, a calculation module 102 and an early warning module 103, and each functional module is described in detail as follows:

[0085] The acquisition module 101 is used to acquire the log data of the target system about the user transaction in real time, extract the operation index of the target system from the log data, and obtain the index data stream;

[0086] A calculation module 102 is used to calculate the monitoring indicator corresponding to the first time period in the first time period closest to the current time of the target system based on the indicator data stream, store the monitoring indicator corresponding to the first time period in a preset database, and obtain the monitoring indicator corresponding to the first time period in the second time period adjacent to the first time period from the preset database, and calculate the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the first time period in the second time period;

[0087] The warning module 103 is used to output warning information when the absolute value of the change rate meets the warning condition.

[0088] In one embodiment, the calculation module 102 is further configured to:

[0089] Acquire a monitoring indicator corresponding to a second time period within the first time period from the preset database;

[0090] The absolute value of the rate of change between the monitoring indicators corresponding to the first time period and the second time period within the first time period is calculated, and the second time period is a time period adjacent to the first time period.

[0091] In one embodiment, the warning module 103 outputs warning information when the absolute value of the change rate meets the warning condition, for:

[0092] Determine whether the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the first time period in the second time period is greater than a first threshold, and determine whether the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the second time period is greater than a second threshold;

[0093] If the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the first time period in the second time period is greater than the first threshold, and the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the second time period is greater than the second threshold, an early warning message is output.

[0094] In one embodiment, the calculation module 102 is further configured to:

[0095] Acquire monitoring indicators corresponding to all time periods within a target time period from the preset database, and divide the target time period into a plurality of regional time periods according to a preset time scale, each regional time period including a plurality of time periods;

[0096] Obtaining monitoring indicators for each regional period according to monitoring indicators corresponding to the time periods included in each regional period, and outputting early warning analysis results for the target time period according to the monitoring indicators for each regional period;

[0097] Obtain historical warning analysis results corresponding to multiple historical time periods, and calculate the warning probability for each area period according to each of the historical warning analysis results;

[0098] A corrected warning threshold corresponding to each area period is generated based on the warning probability of each area period.

[0099] In one embodiment, the warning module 103 outputs warning information when the absolute value of the change rate meets the warning condition, and is also used to:

[0100] Determine whether the absolute value of the change rate between the monitoring indicators corresponding to the first time period within the first time period and the second time period is greater than the correction warning threshold corresponding to the area period where the first time period is located;

[0101] If so, output the warning information.

[0102] In one embodiment, when calculating the monitoring indicator corresponding to the first time period in the first time period closest to the current time of the target system based on the indicator data stream, the calculation module 102 is used to:

[0103] Selecting, from the indicator data stream, an indicator data stream of a first time period within the first time period closest to the current time of the target system;

[0104] Perform stream computing on the indicator data stream of the first time period within the first time cycle to obtain an average value of all operating indicators in the indicator data stream of the first time period, where the average value is a monitoring indicator corresponding to the first time period.

[0105] In one embodiment, when calculating the monitoring indicator corresponding to the first time period in the first time period closest to the current time of the target system based on the indicator data stream, the calculation module 102 is used to:

[0106] Calculate the average transaction response time of the target system in the first time period within the first time period based on the indicator data stream;

[0107] Calculate the average number of transactions processed per second by the target system in the first time period within the first time period based on the indicator data stream;

[0108] The average transaction response time of the target system in the first time period within the first time period is multiplied by the average number of transactions processed per second to obtain a monitoring indicator corresponding to the first time period within the first time period.

[0109] The present invention provides a system monitoring device, which obtains log data about user transactions of a target system in real time through a service end, extracts operating indicators of the target system from the log data, obtains an indicator data stream, and calculates monitoring indicators corresponding to a first time period within a first time period closest to the current time of the target system based on the indicator data stream, stores the monitoring indicators corresponding to the first time period in a preset database, obtains monitoring indicators corresponding to a first time period in a second time period adjacent to the first time period from the preset database, calculates the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the first time period in the second time period, and outputs warning information when the absolute value of the change rate meets the warning condition. The present application obtains the monitoring indicators corresponding to each time period based on the indicator data stream of the target system to quantify the operation status of each time period of the target system, and then calculates the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the first time period in the second time period to reflect the changing trend of the operation status of the target system. When the absolute value of the change rate meets the early warning condition, it indicates that the operation status of the target system is not stable. The server outputs early warning information to timely issue fault warnings when the operation status of the target system is not stable, effectively reducing the possibility of failure of the target system and effectively improving the stability and reliability of the operation of the target system.

[0110] For the specific definition of the system monitoring device, please refer to the definition of the system monitoring method above, which will not be repeated here. Each module in the above-mentioned system monitoring device can be implemented in whole or in part by software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0111] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile and / or volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external client through a network connection. When the computer program is executed by the processor, it realizes the functions or steps on the service side of a system monitoring method.

[0112] In one embodiment, a computer device is provided. The computer device may be a client, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external server through a network connection. When the computer program is executed by the processor, it implements the functions or steps of the client side of a system monitoring method.

[0113] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0114] Acquire log data about user transactions of the target system in real time, extract operation indicators of the target system from the log data, and obtain an indicator data stream;

[0115] Calculate the monitoring indicator corresponding to a first time period within a first time period closest to the current time of the target system based on the indicator data stream, and store the monitoring indicator corresponding to the first time period in a preset database;

[0116] Acquire from the preset database a monitoring indicator corresponding to a first time period in a second time period adjacent to the first time period, and calculate an absolute value of a change rate between the monitoring indicators corresponding to the first time period in the first time period and the first time period in the second time period;

[0117] When the absolute value of the change rate meets the warning condition, the warning information is output.

[0118] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0119] Acquire log data about user transactions of the target system in real time, extract operation indicators of the target system from the log data, and obtain an indicator data stream;

[0120] Calculate the monitoring indicator corresponding to a first time period within a first time period closest to the current time of the target system based on the indicator data stream, and store the monitoring indicator corresponding to the first time period in a preset database;

[0121] Acquire from the preset database a monitoring indicator corresponding to a first time period in a second time period adjacent to the first time period, and calculate an absolute value of a change rate between the monitoring indicators corresponding to the first time period in the first time period and the first time period in the second time period;

[0122] When the absolute value of the change rate meets the warning condition, the warning information is output.

[0123] It should be noted that the above functions or steps that can be implemented by the computer-readable storage medium or computer device can refer to the relevant description on the server side in the aforementioned method embodiment. In order to avoid repetition, they will not be described one by one here.

[0124] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0125] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0126] It should be noted that if software tools or components other than those of our company appear in the embodiments of the present application, they are only used for illustrative purposes and do not represent actual use.

[0127] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A system monitoring method, characterized in that: The method comprises: Acquire log data about user transactions of the target system in real time, extract operation indicators of the target system from the log data, and obtain an indicator data stream; Calculate the monitoring index corresponding to a first time period within a first time period closest to the current time of the target system based on the index data stream, and store the monitoring index corresponding to the first time period in a preset database; Acquire from the preset database a monitoring indicator corresponding to a first time period in a second time period adjacent to the first time period, and calculate an absolute value of a change rate between the monitoring indicators corresponding to the first time period in the first time period and the first time period in the second time period; When the absolute value of the change rate meets the warning condition, the warning information is output.

2. The method according to claim 1, characterized in that The method further comprises: Acquire a monitoring indicator corresponding to a second time period within the first time period from the preset database; The absolute value of the rate of change between the monitoring indicators corresponding to the first time period and the second time period within the first time period is calculated, and the second time period is a time period adjacent to the first time period.

3. The method according to claim 2, characterized in that When the absolute value of the change rate meets the warning condition, outputting warning information includes: Determine whether the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the first time period in the second time period is greater than a first threshold, and determine whether the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the second time period is greater than a second threshold; If the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the first time period in the second time period is greater than the first threshold, and the absolute value of the change rate between the monitoring indicators corresponding to the first time period in the first time period and the second time period is greater than the second threshold, an early warning message is output.

4. The method according to claim 1, characterized in that The method further comprises: Acquire monitoring indicators corresponding to all time periods within a target time period from the preset database, and divide the target time period into a plurality of regional time periods according to a preset time scale, each regional time period including a plurality of time periods; The monitoring indicators of each regional time period are obtained according to the monitoring indicators corresponding to the time periods included in each regional time period, and the early warning analysis results of the target time period are output according to the monitoring indicators of each regional time period.

5. The method according to claim 4, characterized in that The method further comprises: Obtain historical warning analysis results corresponding to multiple historical time periods, and calculate the warning probability for each area period according to each of the historical warning analysis results; Generate a corrected warning threshold corresponding to each area period based on the warning probability of each area period; When the absolute value of the change rate meets the warning condition, outputting warning information includes: Determine whether the absolute value of the change rate between the monitoring indicators corresponding to the first time period within the first time period and the second time period is greater than the correction warning threshold corresponding to the area period where the first time period is located; If so, output the warning information.

6. The method according to claim 1, characterized in that The calculating, based on the indicator data stream, a monitoring indicator corresponding to a first time period in a first time period closest to the current time of the target system includes: Selecting, from the indicator data stream, an indicator data stream of a first time period within the first time period closest to the current time of the target system; Perform stream computing on the indicator data stream of the first time period within the first time cycle to obtain an average value of all operating indicators in the indicator data stream of the first time period, where the average value is a monitoring indicator corresponding to the first time period.

7. The method according to claim 1, characterized in that The operation indicators include transaction response time and the number of transactions processed per second by the target system; The calculating, based on the indicator data stream, a monitoring indicator corresponding to a first time period in a first time period closest to the current time of the target system includes: Calculate the average transaction response time of the target system in the first time period within the first time period based on the indicator data stream; Calculate the average number of transactions processed per second by the target system in the first time period within the first time period based on the indicator data stream; The average transaction response time of the target system in the first time period within the first time period is multiplied by the average number of transactions processed per second to obtain a monitoring indicator corresponding to the first time period within the first time period.

8. A system monitoring device, characterized in that: include: An acquisition module is used to acquire log data about user transactions of a target system in real time, extract operation indicators of the target system from the log data, and obtain an indicator data stream; a calculation module, configured to calculate, based on the indicator data stream, a monitoring indicator corresponding to a first time period in a first time period closest to the current time of the target system, store the monitoring indicator corresponding to the first time period in a preset database, and obtain from the preset database a monitoring indicator corresponding to a first time period in a second time period adjacent to the first time period, and calculate an absolute value of a change rate between the monitoring indicators corresponding to the first time period in the first time period and the first time period in the second time period; The early warning module is used to output early warning information when the absolute value of the change rate meets the early warning condition.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the system monitoring method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the system monitoring method according to any one of claims 1 to 7 is implemented.

Images