A network server fault monitoring method and system

Abstract

The present invention discloses a fault monitoring method and system for a network server, which relates to the technical field of server monitoring and comprises: a server data acquisition module, a server selection module, a fault analysis module and a terminal interaction module; the server data acquisition module is used for performing MAC address deduplication operation on all servers in a target server group, and obtaining an environmental data set and an operating status data set of the target server group; the server selection module is used for calculating the operating load score of each server within a preset statistical time period T through a server load model, and screening, dividing and combining the target server group to obtain a combined test server group; the fault analysis module is used for analyzing the environmental data set and the operating status data set of the combined test server group to obtain a first fault judgment result and a second fault judgment result, and performing a final judgment based on the first fault judgment result and the second fault judgment result to obtain a server fault monitoring result.

Description

Technical Field

[0001] The present invention relates to the technical field of server monitoring, and in particular to a fault monitoring method and system for a network server. Background Art

[0002] In recent years, with the popularization of digital applications and the upgrading of artificial intelligence technology, network servers have shown a large-scale and intensive development trend. As the core supporting equipment of information technology architecture, network server data storage, processing and transmission tasks support the efficient operation of various online services and terminal applications. Therefore, the development of fault monitoring methods suitable for large-scale network servers is a promising research direction.

[0003] At present, the Chinese invention patent application with application number CN202310777079.8 discloses a server fault monitoring method and system, which includes: obtaining the target log status data of the server, wherein the target log status data is the log status data of the server at the current moment; judging whether the server is in an abnormal state at the current moment according to the target log status data; if it is judged that the server does not have an abnormal state at the current moment, the obtained log status data between the current moment and the previous moment is input into the fault warning model to obtain the fault prediction result of the server at the next moment output by the fault warning model, wherein the fault warning model is trained by sample log status data marked with different fault type labels; according to the fault prediction result, the server is warned. This application improves the efficiency of server fault monitoring and server cluster stability, but analyzes all server data when performing fault monitoring, which is not suitable for large-scale network server groups. Summary of the invention

[0004] The technical problem solved by the present invention is that the traditional method of performing real-time analysis on all server data during fault monitoring easily leads to high computational complexity and low fault monitoring efficiency when the detection target is a large-scale network server group.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] A network server fault monitoring system comprises: a server data acquisition module, a server selection module, a fault analysis module and a terminal interaction module;

[0007] The server data collection module includes a physical address specification unit, an environmental data collection unit, and an operation data collection unit, which are used to perform MAC address deduplication operations on all servers in the target server group to obtain a unique MAC address list of the target server group, obtain an environmental data set of the target server group through a sensor group, and obtain an operation status data set of the target server group through a server performance monitoring application;

[0008] The server selection module includes an operation load calculation unit and a screening and combination unit, which is used to calculate the operation load score of each server in the target server group within a preset statistical time period T through the server load model, and screen, divide and combine the target server group to obtain a combined test server group;

[0009] The fault analysis module includes an environmental data judgment unit and an operation data judgment unit, which are used to perform a threshold judgment on the environmental data set corresponding to the combined test server group to obtain a first fault judgment result, analyze the operation status data set of the combined test server group through a machine learning model to obtain a second fault judgment result, and make a final judgment based on the first fault judgment result and the second fault judgment result to obtain a server fault monitoring result;

[0010] The terminal interaction module is used to provide a display interface for users and receive user operation instructions, allowing users to set the parameters of the server data acquisition module, server selection module and fault analysis module, establish a fault monitoring log through the database, and store and update the output data of the server data acquisition module, server selection module and fault analysis module.

[0011] Preferably, the physical address standardization unit is used to perform MAC address deduplication operation on all servers in the target server group to obtain a unique MAC address list of the target server group;

[0012] The processing logic for performing MAC address deduplication operations on the target server group includes: scanning all servers in the target server group through a scanning script to obtain MAC address data, establishing a server MAC address list based on the MAC address data, looping through the server MAC address list through conditional judgment statement instructions to obtain duplicate MAC addresses, and renaming servers with duplicate MAC addresses in the target server group to obtain a unique MAC address list corresponding to the target server group.

[0013] Preferably, the environment data collection unit is used to collect the environment data set of the target server group through the sensor group;

[0014] The sensor group includes a temperature sensor, a humidity sensor and a current sensor, and the environmental data set includes server temperature data, server humidity data and server current data;

[0015] Temperature sensors are arranged on the top, middle and bottom layers of each cabinet of the target server group to collect server temperature data, current sensors are arranged on each output socket line on the power distribution unit PDU in the computer room of the target server group to collect server current data, and humidity sensors are arranged on each air outlet and return air outlet of the air circulation system in the server room to collect server humidity data.

[0016] Preferably, the operation data acquisition unit is used to obtain the operation status data set of the target server group through the server performance monitoring application;

[0017] The operation status data set includes the target server group's CPU utilization, cache utilization, memory occupancy, average disk utilization, disk I / O time, bandwidth utilization, number of network connections, inbound traffic rate, outbound traffic rate, request queue length, number of process resubmissions per unit time, number of input processes per unit time, MAC address data, IP address data, network interface data, VLAN ID data, and routing table data;

[0018] The server performance monitoring application includes an operating system command tool and a third-party monitoring application.

[0019] Preferably, the operation load calculation unit is used to calculate the operation load score of each server in the target server group through the server load model;

[0020] The target server group is screened to obtain key servers. Based on the preset statistical time period T, the running status data set is calculated to obtain the average CPU utilization, average memory occupancy, average disk utilization, average bandwidth utilization, total inbound traffic, total outbound traffic and total number of input processes within the statistical time period T. The average CPU utilization, average memory occupancy, average disk utilization, average bandwidth utilization, total inbound traffic, total outbound traffic and total number of input processes are calculated through the server load model to obtain the running load score of each server in the target server group. The calculation expression is:

[0021] RCS=γ1ACR+γ2AMR+γ3ADR+γ4ABR+γ5lg(TIT+TOT)+γ6lgTNP

[0022] Among them, ACR represents the average CPU utilization, γ1 represents the CPU utilization weight, AMR represents the average memory usage, γ2 represents the memory usage weight, ADR represents the average disk utilization, γ3 represents the disk utilization weight, ABR represents the average bandwidth usage, γ4 represents the bandwidth usage weight, lg represents the logarithmic function with base 10, TIT represents the total inbound traffic, TOT represents the total outbound traffic, γ5 represents the throughput traffic weight, TNP represents the total number of input processes, and γ6 represents the input process number weight.

[0023] Preferably, the screening and combining unit is used to screen and divide the target server group to obtain a combined test server group, and the processing logic for screening and dividing the target server group includes:

[0024] Based on the operation load scores of the target server group, the server score sequence is obtained by sorting in descending order, the target server group is screened once to obtain key servers and non-key servers based on the preset first division ratio K% and the operation load score sequence, and the non-key servers are screened twice to obtain edge non-key servers and adjacent non-key servers;

[0025] Based on the preset second division ratio L%, edge non-key servers are randomly selected to obtain test non-key servers, and the key servers and the test non-key servers are combined to obtain a combined test server group.

[0026] Preferably, the processing logic of the primary screening includes: selecting the top C% of servers in the server score sequence as key servers, and selecting the servers other than the key servers in the target servers as non-key servers;

[0027] The processing logic of the secondary screening includes: comparing the network interface data of the key server and the non-key server, if the network interface of the non-key server is not shared or adjacent to the network interfaces of all key servers, judging that the non-key server is an edge non-key server; if the network interface of the non-key server is shared or adjacent to the network interfaces of all key servers, judging that the non-key server is a neighboring non-key server.

[0028] Preferably, the environmental data judgment unit is used to perform a threshold judgment on the environmental data set corresponding to the combined test server group to obtain a first fault judgment result, and the processing logic for performing the threshold judgment includes:

[0029] Based on a preset first time window, the environmental data set corresponding to the combined test server group is sampled to obtain temperature sampling data, humidity sampling data and current sampling data;

[0030] Based on the temperature sampling data, the time window average temperature value and the time window temperature growth rate of each server in the combined test server group are calculated. When the time window average temperature value is greater than or equal to the preset temperature fault threshold or when the time window temperature growth rate is greater than or equal to the preset temperature growth rate fault threshold, the first fault judgment result is outputted that the corresponding server has a fault, otherwise the first fault judgment result is outputted that the corresponding server does not have a fault;

[0031] Based on the humidity sampling data, the time window average humidity value of each server in the combined test server group is calculated. When the time window average humidity value is greater than or equal to the preset humidity fault threshold, the first fault judgment result is outputted that the corresponding server has a fault, otherwise the first fault judgment result is outputted that the corresponding server does not have a fault;

[0032] The time window average current value and the time window current standard deviation of each server in the combined test server group are calculated based on the current sampling data. The time window current standard deviation value is divided by the time window average current value to obtain the time window current variation coefficient. When the time window average current value is greater than or equal to the preset average current fault threshold or when the time window current variation coefficient is greater than or equal to the preset fault current variation coefficient fault threshold, the first fault judgment result is output that the corresponding server has a fault. Otherwise, the first fault judgment result is output that the corresponding server does not have a fault.

[0033] Preferably, the operation data judgment unit is used to analyze the operation status data set of the combined test server group through a machine learning model to obtain a second fault judgment result;

[0034] The second fault judgment result includes whether a fault exists or not;

[0035] The machine learning model includes a local feature extraction layer, a global feature extraction layer, an average pooling layer and a fully connected layer;

[0036] The logic of analyzing the running status data set of the combined test server group through the machine learning model includes: sampling the running status data set of the combined test server group through a preset second time window, and vectorizing the CPU utilization, cache utilization, memory occupancy, average disk utilization, disk I / O time, bandwidth utilization, number of network connections, inbound traffic rate, outbound traffic rate, request queue length, number of process resubmissions per unit time, and number of input processes per unit time of each server in the combined test server group to obtain a time series feature vector set;

[0037] The local feature extraction layer introduces a convolutional neural network module, which uses a one-dimensional convolution kernel to perform a sliding dot product calculation with a step size of S on the time series feature vector set to obtain an intermediate feature vector, and then uses the ReLu activation function to perform a nonlinear transformation on the intermediate feature vector. The maximum pooling calculation is then performed on the intermediate feature vector after the nonlinear transformation to obtain a local feature output vector.

[0038] The global feature extraction layer introduces the Transformer module, adds position coding to each vector in the local feature output vector, performs linear transformation on the local feature output vector with position coding through the multi-head attention weight matrix to obtain the attention query vector, attention key vector and attention value vector, calculates the attention score based on the attention query vector and the attention key vector, calculates the multi-head attention output value based on the attention score and the attention value vector, performs double-layer linear transformation and nonlinear activation processing on the multi-head attention output value through the forward propagation neural network to obtain the deep feature vector, performs residual connection and layer normalization processing on the deep feature vector to obtain the global feature output vector;

[0039] The average pooling layer obtains the average pooling feature vector by averaging the corresponding dimensions of the global feature output vector, aggregates the average pooling feature vector to obtain the average pooling output feature, performs weighted calculation on the average pooling output feature through the preset weight matrix and bias term in the fully connected layer to obtain the deep feature, and performs probability calculation on the deep feature through the Softmax activation function to obtain the second fault judgment result;

[0040] The logic of performing a final judgment based on the first fault judgment result and the second fault judgment result to obtain the server fault monitoring result includes:

[0041] If and only if both the first fault judgment result and the second fault judgment result are that no fault exists, the server fault monitoring result is output as no fault exists, otherwise the server fault monitoring result is output as that a fault exists.

[0042] A method for monitoring a fault of a network server comprises: step S1, obtaining an environmental data set of a target server group through a sensor group, obtaining an operating status data set of the target server group through a server performance monitoring application, performing a MAC address deduplication operation on all servers in the target server group to obtain a unique MAC address list of the target server group;

[0043] Step S2, calculating the operating load score of each server in the target server group within a preset statistical time period T through the server load model, and screening, dividing and combining the target server group to obtain a combined test server group;

[0044] Step S3, perform threshold judgment on the environmental data set corresponding to the combined test server group to obtain a first fault judgment result, analyze the operating status data set of the combined test server group through a machine learning model to obtain a second fault judgment result, and make a final judgment based on the first fault judgment result and the second fault judgment result to obtain a server fault monitoring result.

[0045] The beneficial effects of the present invention are as follows: first, the MAC address deduplication operation is performed on the target server group to make the server address unique, which is conducive to the clear corresponding server in the subsequent data processing, and only the physical address is renumbered without affecting other data. When the server load model is calculated, it does not use all the data types in the running status data set, but simplifies the data types. In terms of hardware resources, CPU utilization, memory occupancy and disk utilization can reflect the average cache utilization and the frequency of disk I / O operations. In terms of network resources, bandwidth utilization, inbound traffic rate and outbound traffic rate can reflect the number of network connections, request queue length and total number of process resubmissions. It is conducive to reducing the complexity of calculation and improving the screening speed. Sorting and screening based on the running load score and further subdividing the non-key servers in combination with the network interface data, removing the adjacent non-key servers and randomly selecting the non-key servers for testing, which is conducive to highlighting the monitoring priority of the key servers while taking into account the non-key servers, so that the combined test server group can fully reflect the characteristics of the entire target server group, and improve the effectiveness and versatility of the fault monitoring method. Sampling calculations are performed through the preset first time window and second time window, which improves timeliness and calculation speed. The features of the operating status data set are deeply extracted through the convolutional neural network module and the Transformer module, which is conducive to making full use of the operating status data set composed of various data and improving the accuracy of fault detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A basic framework diagram of a network server fault monitoring system provided by an embodiment of the present invention;

[0047] Figure 2 A basic flow chart of a method for fault monitoring of a network server provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, but not all of the embodiments.

[0049] Example 1, reference Figure 1, as an embodiment of the present invention, provides a network server fault monitoring system, including: a server data acquisition module, a server selection module, a fault analysis module and a terminal interaction module;

[0050] The server data collection module includes a physical address specification unit, an environmental data collection unit, and an operation data collection unit, which are used to perform MAC address deduplication operations on all servers in the target server group to obtain a unique MAC address list of the target server group, obtain an environmental data set of the target server group through a sensor group, and obtain an operation status data set of the target server group through a server performance monitoring application;

[0051] The server selection module includes an operation load calculation unit and a screening and combination unit, which are used to calculate the operation load score of each server in the target server group within a preset statistical time period T through the server load model, and screen, divide and combine the target server group to obtain a combined test server group;

[0052] The fault analysis module includes an environmental data judgment unit and an operation data judgment unit, which are used to perform a threshold judgment on the environmental data set corresponding to the combined test server group to obtain a first fault judgment result, analyze the operation status data set of the combined test server group through a machine learning model to obtain a second fault judgment result, and make a final judgment based on the first fault judgment result and the second fault judgment result to obtain a server fault monitoring result;

[0053] The terminal interaction module is used to provide a display interface for users and receive user operation instructions, allowing users to set the parameters of the server data acquisition module, server selection module and fault analysis module, establish a fault monitoring log through the database, and store and update the output data of the server data acquisition module, server selection module and fault analysis module.

[0054] In this embodiment, the physical address standardization unit is used to perform MAC address deduplication operation on all servers in the target server group to obtain a unique MAC address list of the target server group;

[0055] The processing logic for performing MAC address deduplication operations on the target server group includes: scanning all servers in the target server group through a scanning script to obtain MAC address data, establishing a server MAC address list based on the MAC address data, looping through the server MAC address list through conditional judgment statement instructions to obtain duplicate MAC addresses, and renaming servers with duplicate MAC addresses in the target server group to obtain a unique MAC address list corresponding to the target server group.

[0056] Among them, the MAC physical address of the server is a unique number, but in complex server configurations, MAC physical address duplication is a common problem. Performing MAC address deduplication on the target server group only renumbers the physical address without affecting other data, which is conducive to clear corresponding servers when processing data later. )

[0057] In this embodiment, the environment data collection unit is used to collect the environment data set of the target server group through the sensor group;

[0058] The sensor group includes a temperature sensor, a humidity sensor and a current sensor, and the environmental data set includes server temperature data, server humidity data and server current data;

[0059] Temperature sensors are arranged on the top, middle and bottom layers of each cabinet of the target server group to collect server temperature data, current sensors are arranged on each output socket line on the power distribution unit PDU in the computer room of the target server group to collect server current data, and humidity sensors are arranged on each air outlet and return air outlet of the air circulation system in the server room to collect server humidity data.

[0060] In this embodiment, the operation data acquisition unit is used to obtain the operation status data set of the target server group through the server performance monitoring application;

[0061] The operation status data set includes the target server group's CPU utilization, cache utilization, memory occupancy, average disk utilization, disk I / O time, bandwidth utilization, number of network connections, inbound traffic rate, outbound traffic rate, request queue length, number of process resubmissions per unit time, number of input processes per unit time, MAC address data, IP address data, network interface data, VLAN ID data, and routing table data;

[0062] The server performance monitoring application includes an operating system command tool and a third-party monitoring application.

[0063] In this embodiment, the operation load calculation unit is used to calculate the operation load score of each server in the target server group through the server load model;

[0064] The target server group is screened to obtain key servers. Based on the preset statistical time period T, the running status data set is calculated to obtain the average CPU utilization, average memory occupancy, average disk utilization, average bandwidth utilization, total inbound traffic, total outbound traffic and total number of input processes within the statistical time period T. The average CPU utilization, average memory occupancy, average disk utilization, average bandwidth utilization, total inbound traffic, total outbound traffic and total number of input processes are calculated through the server load model to obtain the running load score of each server in the target server group. The calculation expression is:

[0065] RCS=γ1ACR+γ2AMR+γ3ADR+γ4ABR+γ5lg(TIT+TOT)+γ6lgTNP

[0066] Among them, ACR represents the average CPU utilization, γ1 represents the CPU utilization weight, AMR represents the average memory usage, γ2 represents the memory usage weight, ADR represents the average disk utilization, γ3 represents the disk utilization weight, ABR represents the average bandwidth usage, γ4 represents the bandwidth usage weight, lg represents the logarithmic function with base 10, TIT represents the total inbound traffic, TOT represents the total outbound traffic, γ5 represents the throughput traffic weight, TNP represents the total number of input processes, and γ6 represents the input process number weight.

[0067] Among them, the server load model does not use all the data types in the running status data set when calculating, but simplifies the data types. In terms of hardware resources, CPU utilization, memory occupancy and disk utilization can reflect the average cache utilization and the frequency of disk I / O operations. In terms of network resources, bandwidth utilization, inbound traffic rate and outbound traffic rate can reflect the number of network connections, request queue length and total number of process resubmissions. It is conducive to reducing calculation complexity and improving screening speed.

[0068] In this embodiment, the screening and combining unit is used to screen and divide the target server group to obtain a combined test server group. The processing logic for screening and dividing the target server group includes:

[0069] Based on the operation load scores of the target server group, the server score sequence is obtained by sorting in descending order, the target server group is screened once to obtain key servers and non-key servers based on the preset first division ratio K% and the operation load score sequence, and the non-key servers are screened twice to obtain edge non-key servers and adjacent non-key servers;

[0070] Based on the preset second division ratio L%, edge non-key servers are randomly selected to obtain test non-key servers, and the key servers and the test non-key servers are combined to obtain a combined test server group.

[0071] Among them, sorting and screening are carried out based on the running load scores and the non-key servers are further subdivided in combination with the network interface data. The adjacent non-key servers are removed and the test non-key servers are randomly selected. This is beneficial to highlight the monitoring priority of key servers while taking non-key servers into consideration. The combined test server group can fully reflect the characteristics of the entire target server group, thereby improving the effectiveness and versatility of the fault monitoring method.

[0072] In this embodiment, the processing logic of the one-time screening includes: selecting the top C% servers in the server score sequence as key servers, and selecting the servers other than the key servers in the target servers as non-key servers;

[0073] The processing logic of the secondary screening includes: comparing the network interface data of the key server and the non-key server, if the network interface of the non-key server is not shared or adjacent to the network interfaces of all key servers, judging that the non-key server is an edge non-key server; if the network interface of the non-key server is shared or adjacent to the network interfaces of all key servers, judging that the non-key server is a neighboring non-key server.

[0074] In this embodiment, the environment data judgment unit is used to perform a threshold judgment on the environment data set corresponding to the combined test server group to obtain a first fault judgment result. The processing logic for performing the threshold judgment includes:

[0075] Based on a preset first time window, the environmental data set corresponding to the combined test server group is sampled to obtain temperature sampling data, humidity sampling data and current sampling data;

[0076] Based on the temperature sampling data, the time window average temperature value and the time window temperature growth rate of each server in the combined test server group are calculated. When the time window average temperature value is greater than or equal to the preset temperature fault threshold or when the time window temperature growth rate is greater than or equal to the preset temperature growth rate fault threshold, the first fault judgment result is outputted that the corresponding server has a fault, otherwise the first fault judgment result is outputted that the corresponding server does not have a fault;

[0077] Based on the humidity sampling data, the time window average humidity value of each server in the combined test server group is calculated. When the time window average humidity value is greater than or equal to the preset humidity fault threshold, the first fault judgment result is outputted that the corresponding server has a fault, otherwise the first fault judgment result is outputted that the corresponding server does not have a fault;

[0078] The time window average current value and the time window current standard deviation of each server in the combined test server group are calculated based on the current sampling data. The time window current standard deviation value is divided by the time window average current value to obtain the time window current variation coefficient. When the time window average current value is greater than or equal to the preset average current fault threshold or when the time window current variation coefficient is greater than or equal to the preset fault current variation coefficient fault threshold, the first fault judgment result is output that the corresponding server has a fault. Otherwise, the first fault judgment result is output that the corresponding server does not have a fault.

[0079] In this embodiment, the operation data judgment unit is used to analyze the operation status data set of the combined test server group through a machine learning model to obtain a second fault judgment result;

[0080] The second fault judgment result includes whether a fault exists or not;

[0081] The machine learning model includes a local feature extraction layer, a global feature extraction layer, an average pooling layer and a fully connected layer;

[0082] The logic of analyzing the running status data set of the combined test server group through the machine learning model includes: sampling the running status data set of the combined test server group through a preset second time window, and vectorizing the CPU utilization, cache utilization, memory occupancy, average disk utilization, disk I / O time, bandwidth utilization, number of network connections, inbound traffic rate, outbound traffic rate, request queue length, number of process resubmissions per unit time, and number of input processes per unit time of each server in the combined test server group to obtain a time series feature vector set;

[0083] The local feature extraction layer introduces a convolutional neural network module, which uses a one-dimensional convolution kernel to perform a sliding dot product calculation with a step size of S on the time series feature vector set to obtain an intermediate feature vector, and then uses the ReLu activation function to perform a nonlinear transformation on the intermediate feature vector. The maximum pooling calculation is then performed on the intermediate feature vector after the nonlinear transformation to obtain a local feature output vector.

[0084] The global feature extraction layer introduces the Transformer module, adds position coding to each vector in the local feature output vector, performs linear transformation on the local feature output vector with position coding through the multi-head attention weight matrix to obtain the attention query vector, attention key vector and attention value vector, calculates the attention score based on the attention query vector and the attention key vector, calculates the multi-head attention output value based on the attention score and the attention value vector, performs double-layer linear transformation and nonlinear activation processing on the multi-head attention output value through the forward propagation neural network to obtain the deep feature vector, performs residual connection and layer normalization processing on the deep feature vector to obtain the global feature output vector;

[0085] The average pooling layer obtains the average pooling feature vector by averaging the corresponding dimensions of the global feature output vector, aggregates the average pooling feature vector to obtain the average pooling output feature, performs weighted calculation on the average pooling output feature through the preset weight matrix and bias term in the fully connected layer to obtain the deep feature, and performs probability calculation on the deep feature through the Softmax activation function to obtain the second fault judgment result;

[0086] The logic of performing a final judgment based on the first fault judgment result and the second fault judgment result to obtain the server fault monitoring result includes:

[0087] If and only if both the first fault judgment result and the second fault judgment result are that no fault exists, the server fault monitoring result is output as no fault exists, otherwise the server fault monitoring result is output as that a fault exists.

[0088] Among them, sampling calculation is performed through the preset first time window and second time window, which improves timeliness and calculation speed. The features of the operating status data set are deeply extracted through the convolutional neural network module and the Transformer module, which is conducive to making full use of the operating status data set composed of various data and improving the accuracy of fault detection.

[0089] Example 2, reference Figure 2 , provides a fault monitoring method for a network server, comprising:

[0090] Step S1, obtaining an environmental data set of a target server group through a sensor group, obtaining an operating status data set of the target server group through a server performance monitoring application, and performing a MAC address deduplication operation on all servers in the target server group to obtain a unique MAC address list of the target server group;

[0091] Step S2, calculating the operating load score of each server in the target server group within a preset statistical time period T through the server load model, and screening, dividing and combining the target server group to obtain a combined test server group;

[0092] Step S3, perform threshold judgment on the environmental data set corresponding to the combined test server group to obtain a first fault judgment result, analyze the operating status data set of the combined test server group through a machine learning model to obtain a second fault judgment result, and make a final judgment based on the first fault judgment result and the second fault judgment result to obtain a server fault monitoring result.

[0093] It should be understood by those skilled in the art that the embodiments of the present invention may provide methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or K computer-usable storage media containing computer-usable program codes. Among them, the storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, disk or optical disk. These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 processes or K processes and / or boxes Figure 1 The functions specified in boxes or K boxes.

[0094] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network server fault monitoring system, characterized in that: include: Server data collection module, server selection module, fault analysis module and terminal interaction module; The server data collection module includes a physical address specification unit, an environmental data collection unit, and an operation data collection unit, which are used to perform MAC address deduplication operations on all servers in the target server group to obtain a unique MAC address list of the target server group, obtain an environmental data set of the target server group through a sensor group, and obtain an operation status data set of the target server group through a server performance monitoring application; The server selection module includes an operation load calculation unit and a screening and combination unit, which are used to calculate the operation load score of each server in the target server group within a preset statistical time period T through the server load model, and screen, divide and combine the target server group to obtain a combined test server group; The fault analysis module includes an environmental data judgment unit and an operation data judgment unit, which are used to perform a threshold judgment on the environmental data set corresponding to the combined test server group to obtain a first fault judgment result, analyze the operation status data set of the combined test server group through a machine learning model to obtain a second fault judgment result, and make a final judgment based on the first fault judgment result and the second fault judgment result to obtain a server fault monitoring result; The terminal interaction module is used to provide a display interface for users and receive user operation instructions, allowing users to set the parameters of the server data acquisition module, server selection module and fault analysis module, establish a fault monitoring log through the database, and store and update the output data of the server data acquisition module, server selection module and fault analysis module.

2. A network server fault monitoring system as claimed in claim 1, characterized in that: The physical address specification unit is used to perform MAC address deduplication operation on all servers in the target server group to obtain a unique MAC address list of the target server group; The processing logic for performing MAC address deduplication operations on the target server group includes: scanning all servers in the target server group through a scanning script to obtain MAC address data, establishing a server MAC address list based on the MAC address data, looping through the server MAC address list through conditional judgment statement instructions to obtain duplicate MAC addresses, and renaming servers with duplicate MAC addresses in the target server group to obtain a unique MAC address list corresponding to the target server group.

3. A network server fault monitoring system as claimed in claim 1, characterized in that: The environment data collection unit is used to collect the environment data set of the target server group through the sensor group; The sensor group includes a temperature sensor, a humidity sensor and a current sensor, and the environmental data set includes server temperature data, server humidity data and server current data; Temperature sensors are arranged on the top, middle and bottom layers of each cabinet of the target server group to collect server temperature data, current sensors are arranged on each output socket line on the power distribution unit PDU in the computer room of the target server group to collect server current data, and humidity sensors are arranged on each air outlet and return air outlet of the air circulation system in the server room to collect server humidity data.

4. A network server fault monitoring system as claimed in claim 1, characterized in that: The operation data acquisition unit is used to obtain the operation status data set of the target server group through the server performance monitoring application; The operation status data set includes the target server group's CPU utilization, cache utilization, memory occupancy, average disk utilization, disk I / O time, bandwidth utilization, number of network connections, inbound traffic rate, outbound traffic rate, request queue length, number of process resubmissions per unit time, number of input processes per unit time, MAC address data, IP address data, network interface data, VLAN ID data, and routing table data; The server performance monitoring application includes an operating system command tool and a third-party monitoring application.

5. A network server fault monitoring system as claimed in claim 1, characterized in that: The operation load calculation unit is used to calculate the operation load score of each server in the target server group through the server load model; The target server group is screened to obtain key servers. Based on the preset statistical time period T, the running status data set is calculated to obtain the average CPU utilization, average memory occupancy, average disk utilization, average bandwidth utilization, total inbound traffic, total outbound traffic and total number of input processes within the statistical time period T. The average CPU utilization, average memory occupancy, average disk utilization, average bandwidth utilization, total inbound traffic, total outbound traffic and total number of input processes are calculated through the server load model to obtain the running load score of each server in the target server group. The calculation expression is: RCS=γ1ACR+γ2AMR+γ3ADR+γ4ABR+γ5lg(TIT+TOT)+γ6lgTNP Among them, ACR represents the average CPU utilization, γ1 represents the CPU utilization weight, AMR represents the average memory usage, γ2 represents the memory usage weight, ADR represents the average disk utilization, γ3 represents the disk utilization weight, ABR represents the average bandwidth usage, γ4 represents the bandwidth usage weight, lg represents the logarithmic function with base 10, TIT represents the total inbound traffic, TOT represents the total outbound traffic, γ5 represents the throughput traffic weight, TNP represents the total number of input processes, and γ6 represents the input process number weight.

6. A network server fault monitoring system as claimed in claim 1, characterized in that: The screening and combining unit is used to screen and divide the target server group to obtain a combined test server group. The processing logic for screening and dividing the target server group includes: Based on the operation load scores of the target server group, the server score sequence is obtained by sorting in descending order, the target server group is screened once to obtain key servers and non-key servers based on the preset first division ratio K% and the operation load score sequence, and the non-key servers are screened twice to obtain edge non-key servers and adjacent non-key servers; Based on the preset second division ratio L%, edge non-key servers are randomly selected to obtain test non-key servers, and the key servers and the test non-key servers are combined to obtain a combined test server group.

7. A network server fault monitoring system as claimed in claim 6, characterized in that: The processing logic of the primary screening includes: selecting the top C% servers from the server score sequence as key servers, and selecting the servers other than the key servers from the target servers as non-key servers; The processing logic of the secondary screening includes: comparing the network interface data of the key server and the non-key server, if the network interface of the non-key server is not shared or adjacent to the network interfaces of all key servers, judging that the non-key server is an edge non-key server; if the network interface of the non-key server is shared or adjacent to the network interfaces of all key servers, judging that the non-key server is a neighboring non-key server.

8. A network server fault monitoring system as claimed in claim 1, characterized in that: The environment data judgment unit is used to perform a threshold judgment on the environment data set corresponding to the combined test server group to obtain a first fault judgment result, and the processing logic for performing the threshold judgment includes: Based on a preset first time window, the environmental data set corresponding to the combined test server group is sampled to obtain temperature sampling data, humidity sampling data and current sampling data; Based on the temperature sampling data, the time window average temperature value and the time window temperature growth rate of each server in the combined test server group are calculated. When the time window average temperature value is greater than or equal to the preset temperature fault threshold or when the time window temperature growth rate is greater than or equal to the preset temperature growth rate fault threshold, the first fault judgment result is outputted that the corresponding server has a fault, otherwise the first fault judgment result is outputted that the corresponding server does not have a fault; Based on the humidity sampling data, the time window average humidity value of each server in the combined test server group is calculated. When the time window average humidity value is greater than or equal to the preset humidity fault threshold, the first fault judgment result is outputted that the corresponding server has a fault, otherwise the first fault judgment result is outputted that the corresponding server does not have a fault; The time window average current value and the time window current standard deviation of each server in the combined test server group are calculated based on the current sampling data. The time window current standard deviation value is divided by the time window average current value to obtain the time window current variation coefficient. When the time window average current value is greater than or equal to the preset average current fault threshold or when the time window current variation coefficient is greater than or equal to the preset fault current variation coefficient fault threshold, the first fault judgment result is output that the corresponding server has a fault. Otherwise, the first fault judgment result is output that the corresponding server does not have a fault.

9. A network server fault monitoring system as claimed in claim 1, characterized in that: The operation data judgment unit is used to analyze the operation status data set of the combined test server group through a machine learning model to obtain a second fault judgment result; The second fault judgment result includes whether a fault exists or not; The machine learning model includes a local feature extraction layer, a global feature extraction layer, an average pooling layer and a fully connected layer; The logic of analyzing the running status data set of the combined test server group through the machine learning model includes: sampling the running status data set of the combined test server group through a preset second time window, and vectorizing the CPU utilization, cache utilization, memory occupancy, average disk utilization, disk I / O time, bandwidth utilization, number of network connections, inbound traffic rate, outbound traffic rate, request queue length, number of process resubmissions per unit time, and number of input processes per unit time of each server in the combined test server group to obtain a time series feature vector set; The local feature extraction layer introduces a convolutional neural network module, which uses a one-dimensional convolution kernel to perform a sliding dot product calculation with a step size of S on the time series feature vector set to obtain an intermediate feature vector, and then uses the ReLu activation function to perform a nonlinear transformation on the intermediate feature vector. The maximum pooling calculation is then performed on the intermediate feature vector after the nonlinear transformation to obtain a local feature output vector. The global feature extraction layer introduces the Transformer module, adds position coding to each vector in the local feature output vector, performs linear transformation on the local feature output vector with position coding through the multi-head attention weight matrix to obtain the attention query vector, attention key vector and attention value vector, calculates the attention score based on the attention query vector and the attention key vector, calculates the multi-head attention output value based on the attention score and the attention value vector, performs double-layer linear transformation and nonlinear activation processing on the multi-head attention output value through the forward propagation neural network to obtain the deep feature vector, performs residual connection and layer normalization processing on the deep feature vector to obtain the global feature output vector; The average pooling layer obtains the average pooling feature vector by averaging the corresponding dimensions of the global feature output vector, aggregates the average pooling feature vector to obtain the average pooling output feature, performs weighted calculation on the average pooling output feature through the preset weight matrix and bias term in the fully connected layer to obtain the deep feature, and performs probability calculation on the deep feature through the Softmax activation function to obtain the second fault judgment result; The logic of performing a final judgment based on the first fault judgment result and the second fault judgment result to obtain the server fault monitoring result includes: If and only if both the first fault judgment result and the second fault judgment result are that no fault exists, the server fault monitoring result is output as no fault exists, otherwise the server fault monitoring result is output as that a fault exists.

10. A method for monitoring a fault of a network server, characterized in that: include: Step S1, obtaining an environmental data set of a target server group through a sensor group, obtaining an operating status data set of the target server group through a server performance monitoring application, and performing a MAC address deduplication operation on all servers in the target server group to obtain a unique MAC address list of the target server group; Step S2, calculating the operating load score of each server in the target server group within a preset statistical time period T through the server load model, and screening, dividing and combining the target server group to obtain a combined test server group; Step S3, perform threshold judgment on the environmental data set corresponding to the combined test server group to obtain a first fault judgment result, analyze the operating status data set of the combined test server group through a machine learning model to obtain a second fault judgment result, and make a final judgment based on the first fault judgment result and the second fault judgment result to obtain a server fault monitoring result.

Images