Early warning method, device, equipment and readable storage medium

Abstract

The embodiments of the present invention provide an early warning method, device, equipment and readable storage medium. The method includes: obtaining the operation data corresponding to the node to be monitored in the business system; inputting the operation data into a trained early warning model to obtain the early warning result of the node to be monitored output by the early warning model; wherein the early warning result includes normal operation and abnormal operation; the early warning model is used to perform data prediction on the operation data to obtain the corresponding target operation data within a preset time period, and determine the early warning result of the node to be monitored within the preset time period according to the target operation data; the preset time period is a time period starting at the current time. The present invention can know in advance whether the node will have abnormal operation, avoid the problem in the related technology that only the current fault can be warned, and prevent the lag of fault warning.

Description

Technical Field

[0001] The present invention belongs to the field of data processing technology, and in particular relates to an early warning method, device, equipment and readable storage medium. Background Art

[0002] As the scale of enterprises expands and the number of businesses increases, the business-carrying systems become increasingly large and complex, requiring comprehensive operation monitoring of large-scale systems to avoid platform failures that are missed or not discovered in a timely manner.

[0003] In the related art, the commonly used monitoring alarm method obtains the current corresponding indicator data from various data sources, and then distributes the alarm by using built-in plug-ins or third-party components. However, the above solution can only warn of the current fault, resulting in the fault having already occurred during the warning, which makes the fault warning have a lag. Summary of the invention

[0004] The present invention provides an early warning method, device, equipment and readable storage medium to solve the problem that the related art can only provide early warning for the currently occurring fault and the scope of the early warning is small.

[0005] In a first aspect, the present invention provides an early warning method, the method comprising:

[0006] Obtain the operating data corresponding to the node to be monitored in the business system;

[0007] Inputting the operating data into a trained early warning model to obtain an early warning result of the node to be monitored output by the early warning model;

[0008] Among them, the early warning results include normal operation and abnormal operation; the early warning model is used to perform data prediction on the operation data to obtain the corresponding target operation data within a preset time period, and determine the early warning result of the monitored node within the preset time period based on the target operation data; the preset time period is a time period with the current time as the starting time.

[0009] In a second aspect, the present invention provides an early warning device, the device comprising:

[0010] The acquisition module is used to obtain the operating data corresponding to the node to be monitored in the business system;

[0011] An early warning module, used for inputting the operation data into a trained early warning model to obtain an early warning result of the node to be monitored output by the early warning model;

[0012] Among them, the early warning results include normal operation and abnormal operation; the early warning model is used to perform data prediction on the operation data to obtain the corresponding target operation data within a preset time period, and determine the early warning result of the monitored node within the preset time period based on the target operation data; the preset time period is a time period with the current time as the starting time.

[0013] In a third aspect, the present invention provides an electronic device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect when executing the program.

[0014] In a fourth aspect, the present invention provides a readable storage medium, which, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute the method described in the first aspect.

[0015] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0016] By obtaining the operating data corresponding to the node to be monitored in the business system; inputting the operating data into the trained early warning model, obtaining the early warning result of the node to be monitored output by the early warning model; wherein the early warning result includes normal operation and abnormal operation; the early warning model is used to predict the operating data to obtain the corresponding target operating data within a preset time period, and according to the target operating data, determine the early warning result of the node to be monitored within the preset time period; the preset time period is a time period starting at the current time. In this way, by obtaining the operating data of the node to be monitored in the business system and using the trained early warning model for analysis and prediction, it is possible to know in advance whether the node will have abnormal operation, avoid the problem in the related technology that only the current fault can be warned, and prevent the lag of fault warning. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 is a flow chart of an early warning method provided in an embodiment of the present application;

[0019] Figure 2 is a flow chart of another early warning method provided in an embodiment of the present application;

[0020] Figure 3 is a block diagram of an early warning device provided in an embodiment of the present application;

[0021] Figure 4 It is a structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] Before introducing the early warning method, device, equipment and storage medium provided by the present disclosure, the application scenarios involved in each embodiment of the present disclosure are first introduced. The present disclosure can be applied to the scenario of fault early warning of the business system, and the early warning method provided by the embodiment of the present disclosure can be applied to electronic devices, wherein the electronic device may include a handheld device, a vehicle-mounted device, a wearable device, a computing device or other processing device connected to a wireless modem, and various forms of user equipment (UE) (for example, a mobile phone), a mobile station (MS) and other devices.

[0024] As the scale of enterprises expands and the number of businesses increases, the business-carrying systems become increasingly large and complex, requiring comprehensive operation monitoring of large-scale systems to avoid the situation where system platform failures are missed or not discovered in time. In related technologies, the commonly used monitoring and alarming method obtains the current corresponding indicator data from various data sources, and then distributes alarms by using built-in plug-ins or third-party components.

[0025] However, the above solution mainly relies on the indicator data obtained at the current moment to determine whether an alarm is needed, and only focuses on the problems that have already occurred. It cannot predict and analyze the future operating status of the system, and it is difficult to detect potential fault hazards in advance.

[0026] For example, in a large e-commerce business system, before a promotion event, the various indicators of the server may seem normal at the moment, but as the event begins, the sudden surge in traffic may cause the system to crash. This monitoring and alarm method based only on current data cannot warn of the upcoming high load pressure and possible failures in advance, and can only issue an alarm after the failure actually occurs, which often puts the company in a passive response situation, which may lead to adverse consequences such as business interruption and damaged user experience.

[0027] In addition, considering that many system failures actually have early signs and changing trends reflected in the operating data before they actually break out, it is difficult for conventional current data monitoring methods to capture these subtle changing trends. For example, in a database system, the query efficiency of some tables gradually decreases, which may be due to the gradual failure of indexes or the amount of data is about to exceed the storage limit, but when the current indicator data does not reach the failure threshold, no alarm will be triggered. Waiting until the amount of data exceeds the limit, the query is stuck in a large area or even an error is reported before the alarm is triggered, the best time for early intervention such as optimizing indexes and expanding storage in advance will be missed, increasing the difficulty and cost of subsequent fault repair.

[0028] Therefore, in order to solve the above problems, the present disclosure provides an early warning method, device, equipment and readable storage medium, which obtains the operating data corresponding to the node to be monitored in the business system; inputs the operating data into a trained early warning model to obtain the early warning result of the node to be monitored output by the early warning model; wherein the early warning result includes normal operation and abnormal operation; the early warning model is used to predict the operating data to obtain the corresponding target operating data within a preset time period, and according to the target operating data, determine the early warning result of the node to be monitored within the preset time period; the preset time period is a time period with the current time as the starting time. In this way, by obtaining the operating data of the node to be monitored in the business system and using the trained early warning model for analysis and prediction, it is possible to know in advance whether the node will have abnormal operation, avoid the problem in the related technology that only the current fault can be warned, and prevent the lag of fault warning.

[0029] The method provided in the embodiment of the present application is described in detail below through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0030] Figure 1 is a flow chart of an early warning method provided by an embodiment of the present application, such as Figure 1 As shown, the method may include the following steps.

[0031] In step S101, operation data corresponding to the node to be monitored in the business system is obtained.

[0032] Among them, the business system can refer to an information architecture or platform that can support, accommodate and run various business-related functions and processes. The business system can include basic hardware such as servers, storage devices, network devices, and can also include operating systems, database management systems, and various business applications. The nodes to be monitored can include servers, network devices, application instances, and other entities in the business system whose operating status needs to be paid attention to.

[0033] In some embodiments, a collection agent (collection component) can be first developed and deployed based on the OpenTelemetry framework (open source observability framework). The collection agent can use various tools and interfaces provided by OpenTelemetry to integrate different types of data such as metrics, traces, and logs. Therefore, in this step, the collection agent can be deployed to the node to be monitored to collect system operation data to obtain system logs, monitoring indicators, device status and other operation data.

[0034] Optionally, the developed collection agent can be deployed to these nodes. For example, in a distributed microservice architecture system, the agent can be deployed to the server where each microservice instance providing the service is located, as well as key infrastructure such as database servers and message queue servers, to ensure that the operation data at all levels of the system can be fully obtained.

[0035] Specifically, the collected data includes but is not limited to system logs, monitoring indicators, device status, etc. Among them, the system log covers operation information and error information recorded when the application is running. For example, the detailed error log recorded when a certain interface call fails in the application can help locate whether it is caused by code logic problems or external dependency failures. Monitoring indicators involve the use of various resources, such as the server's CPU (Central Processing Unit) utilization, memory usage, disk I / O (input and output) read and write speed, network bandwidth usage, etc. Through these quantitative indicators, it can be intuitively judged whether the system is currently in a high load state. The device status includes some operating parameters of the hardware device itself, such as the server's temperature, fan speed (compared to the server with relevant sensors), port traffic and connection status of the network device, etc., to ensure the stable operation of the system from the hardware level.

[0036] In some embodiments, node data corresponding to the node to be monitored in the business system can be obtained, and the node data includes at least one of system logs, monitoring indicators, and equipment status; the node data is preprocessed to obtain the preprocessed operation data, and the preprocessing includes removing outliers and / or filling missing values.

[0037] In step S102, the operation data is input into the trained early warning model to obtain the early warning result of the node to be monitored output by the early warning model.

[0038] Among them, the early warning result includes normal operation and abnormal operation; the early warning model is used to perform data prediction on the operation data to obtain the corresponding target operation data within a preset time period, and determine the early warning result of the monitored node within the preset time period based on the target operation data; the preset time period is a time period with the current time as the starting time.

[0039] In this step, the operation data obtained is various information used to reflect the operation status of the node, such as the system logs, monitoring indicators (such as the CPU usage rate of the server, memory usage, etc.) and device status as described above. When the operation data is obtained, the operation data can first be used as input information and input into the trained early warning model. After receiving the operation data, the early warning model will undergo internal calculations and analysis, and finally output the early warning results for the node to be monitored.

[0040] For example, the early warning model has the ability to predict the input operation data. It can use the rules and patterns it has learned to estimate future situations. Specifically, it predicts the target operation data corresponding to the preset time period. This preset time period is a period of time extending from the current time as the starting time, for example, it can be the next 1 hour, 1 day or 1 week, etc. The specific duration will be set according to actual business needs and system characteristics.

[0041] In other words, the early warning model can analyze the situation reflected by the forecast data. For example, if the forecast data shows that all indicators are within a reasonable range, system resource usage is stable, and equipment is in good condition, then it is judged to be "operating normally"; on the contrary, if the forecast data shows that certain indicators are about to exceed normal limits, there may be problems such as resource exhaustion, risk of equipment failure, or business process jams, then it will be judged as "operating abnormally."

[0042] For example, based on the currently input operating data such as the server memory usage rate, the early warning model predicts that in the next two hours, as the business volume increases, the memory usage rate will continue to rise until it reaches saturation, thereby affecting the normal operation of the system. At this time, it will output an "abnormal operation" early warning result.

[0043] In some embodiments, it is also possible to first obtain sample operation data corresponding to the node to be monitored in the business system and sample results corresponding to the sample operation data; train the preset early warning model based on the sample operation data and the sample results corresponding to the sample operation data to obtain the trained early warning model.

[0044] The above technical solution is adopted to obtain the operation data corresponding to the node to be monitored in the business system; input the operation data into the trained early warning model to obtain the early warning result of the node to be monitored output by the early warning model; wherein the early warning result includes normal operation and abnormal operation; the early warning model is used to predict the operation data to obtain the corresponding target operation data within the preset time period, and determine the early warning result of the node to be monitored within the preset time period according to the target operation data; the preset time period is a time period starting at the current time. In this way, by obtaining the operation data of the node to be monitored in the business system and using the trained early warning model for analysis and prediction, it is possible to know in advance whether the node will have abnormal operation, avoid the problem in the related technology that only the current fault can be warned, and prevent the lag of fault warning.

[0045] In some embodiments, the system early warning model may include a linear regression sub-model, a decision classification sub-model, and a time series sub-model. Therefore, the following method can be used to input the operating data into the trained early warning model to obtain the early warning result of the node to be monitored output by the early warning model.

[0046] First, the operation data can be input into the time series sub-model to obtain the target operation data corresponding to the preset time period output by the time series sub-model.

[0047] The time series sub-model may include an STM time series model.

[0048] Optionally, before inputting the operation data into the time series sub-model, the operation data can be cleaned to remove data points with obvious errors, duplications or missing data in the data set. For example, due to a temporary network failure, the CPU usage rate collected at a certain moment is an unreasonable maximum value (far exceeding the upper limit during normal operation). Such abnormal data points need to be identified and deleted or corrected.

[0049] For example, the operation data can be first reviewed to determine the completeness, accuracy, and consistency of the operation data. For the operation data, it is necessary to check whether each data record contains all the necessary information. Then the outliers in the operation data can be identified. If the outliers are caused by data collection errors, equipment failures, etc., and the number of these outliers is small and has little impact on the overall data distribution, then these outliers can be deleted directly. For example, due to a short network failure, the wrong CPU usage data collected at a certain moment can be deleted. If it contains certain useful information, or deleting outliers will have a greater impact on the integrity of the data and the analysis results, then you can try to correct the outliers. One method is to replace the outliers with the average or median of adjacent data points. For example, for an abnormal data point in a time series, it can be replaced with the average of the two data points before and after it.

[0050] Optionally, after the operation data is cleaned, the cleaned operation data can be input into the STM time series model, and the STM time series model can output the corresponding target operation data within the preset time period according to the input data and its own structure and parameters. For example, the preset time period is set to the next 24 hours, and a predicted CPU usage, memory usage and other monitoring indicator data are output every 1 hour.

[0051] Then, the target operation data may be input into the linear regression sub-model to obtain data influencing parameters corresponding to each type of the target operation data output by the linear regression sub-model.

[0052] The data impact parameter represents the degree of impact of different types of the target operating data on the operation of the node to be monitored.

[0053] It should be noted that the linear regression sub-model can establish different types of data (independent variables) in the target operating data and the operating status of the monitored nodes (dependent variables, which can be understood here as the overall operating condition of the node or the possibility of abnormalities. The linear relationship between the independent variable and the dependent variable can also be represented by specific parameters, and the appropriate coefficients can be found through the training model, that is, the data influencing parameters) to describe the strength and direction of this association.

[0054] Optionally, after the linear regression sub-model analyzes and calculates the input target operation data, the output data impact parameters corresponding to each type of target operation data characterize the degree of impact of different types of target operation data on the operation of the monitored node. Specifically, the absolute values ​​of these parameters reflect the strength of the impact.

[0055] For example, the linear regression sub-model can be used to obtain the influence parameter β1=0.5 corresponding to the CPU usage of a node to be monitored, and the influence parameter β2=0.5 corresponding to the memory usage. It can be concluded that under the same conditions, the memory usage has a relatively greater impact on the operation of the node. When the memory usage changes, it will cause a greater change in the node's operating state than the same magnitude of change in the CPU usage. Moreover, the positive and negative signs of the parameters can also indicate the direction of the impact. For example, if a parameter is a positive value, it means that as the value of the target operation data of this type increases, the node operation changes in a certain direction (such as the possibility of anomalies increases, etc.); if it is a negative value, it means that as the value of the data increases, the node operation changes in the opposite direction.

[0056] In this way, by using the data influence parameters output by the linear regression sub-model, we can clarify the relative importance and impact direction of different types of target operation data on the operation of the monitored nodes, and then comprehensively consider these factors in subsequent judgments on early warning results and other links, so as to more accurately discover potential operational abnormalities in advance.

[0057] Next, the data influencing parameters corresponding to each type of the target operation data and the target operation data can be input into the decision classification sub-model to obtain the classification result output by the decision classification sub-model and the probability value corresponding to the classification result; and based on the classification result and the probability value corresponding to the classification result, determine the early warning result of the node to be monitored.

[0058] Optionally, when the data influencing parameters corresponding to each type of the target operation data and the target operation data are input into the decision classification sub-model, the decision classification sub-model can construct classification rules based on some classification algorithms, such as decision tree algorithms, support vector machine algorithms or neural network algorithms, to obtain classification results and probability values ​​corresponding to the classification results. For example, for the decision tree algorithm, conditional judgments can be made at each node of the tree according to the data influencing parameters and the values ​​of the target operation data, and the input data can be gradually divided into corresponding leaf node categories along different branch paths. For example, if the influencing parameter corresponding to the CPU usage rate is high and its predicted target operation data shows that the usage rate is about to exceed a certain threshold, and the memory occupancy rate also presents a similar high-risk situation, after layers of judgments of the decision tree, the input data may eventually be classified into the category of "abnormal operation".

[0059] The classification results output by the decision classification sub-model can include two categories: "normal operation" and "abnormal operation". The probability value corresponding to the classification result can represent the confidence of the model in obtaining the classification result. For example, if the model outputs the classification result of "abnormal operation" and the corresponding probability value is 0.8, it means that the model is 80% sure that the monitored node will have abnormal operation within the preset time period; if the probability value is 0.3, it means that although the model judges it as "abnormal operation", its credibility is relatively low and there may be more uncertain factors.

[0060] Then, the warning result of the node to be monitored can be determined according to the classification result output by the decision classification sub-model and the corresponding probability value.

[0061] Specifically, if the classification result is "normal operation" and the corresponding probability value is high (for example, exceeding a certain set threshold, such as 0.7), it can be determined that the monitored node is likely to be operating normally within the preset time period, and the corresponding warning result is "normal operation". On the contrary, if the classification result is "abnormal operation" and the probability value also reaches a certain credibility standard (an appropriate threshold can also be set, such as 0.6), the warning result is "abnormal operation", prompting relevant personnel to take measures in advance to deal with possible problems.

[0062] By adopting the above technical solution, by inputting the operation data into the time series sub-model, linear regression sub-model and decision classification sub-model process in sequence, multiple links such as time series prediction, quantification of influencing factors and classification decision-making can be integrated, and the operation data of the business system can be comprehensively and deeply analyzed from multiple dimensions. Different types of operation data are first captured through the time series sub-model to understand their changing patterns over time, and then the linear regression sub-model is used to analyze the correlation between each data and system operation, and finally these factors are comprehensively considered in the decision classification sub-model for classification judgment. This multi-dimensional comprehensive analysis method avoids the one-sidedness that may be caused by single-dimensional analysis, and can more accurately and comprehensively reflect the actual operation status and potential risks of the system.

[0063] In some embodiments, when the warning result is an operational abnormality, a prompt message may be output and the node to be monitored may be controlled to perform a warning operation.

[0064] The prompt information is used to prompt the user that the node to be monitored is in an abnormal operation state within a preset time period; and the early warning operation is used to control the node to be monitored to be in a normal operation state.

[0065] Optionally, the prompt information is output to inform the user that the node to be monitored will be in an abnormal operation state in the next preset time period. For example, in an office automation system of an enterprise, if a file server node is predicted to be abnormal, then the relevant operation and maintenance personnel need to know this situation in time so that they can prepare corresponding solutions in advance and start to troubleshoot possible problems, such as checking whether there are hidden dangers of server hardware failure and whether the software configuration is reasonable.

[0066] The prompt information can be presented in a variety of forms. Specifically, an alarm pop-up window can be popped up on the operation interface of the monitoring system. The content of the pop-up window can state "XX node is expected to have an operation abnormality in the next A hours, please pay attention and deal with it in time." At the same time, similar prompt content can also be sent to relevant responsible personnel through emails, text messages, etc. to ensure that they can receive notifications in time. Moreover, the prompt information may also be accompanied by some basic abnormality-related information, such as some key indicator data currently predicted (such as high CPU usage, memory usage is about to be saturated, etc.), which is convenient for the person receiving the prompt information to quickly and preliminarily judge the general direction of the problem.

[0067] The early warning operation can be used to control the monitored node to return to a normal operating state, or at least alleviate the development trend of the abnormal situation, avoid the actual occurrence of the fault or reduce the impact of the fault.

[0068] Specifically, if the early warning model determines that the risk of abnormal operation is caused by excessive memory usage on the server, the early warning operation can automatically trigger the dynamic allocation of memory resources. For example, for some server environments that support virtualization technology, the system can automatically adjust the memory size allocated to the virtual machine where the node to be monitored is located, and appropriately increase the memory quota to meet the upcoming business needs, alleviate the memory shortage, and enable the node to continue to operate stably.

[0069] When it is predicted that an application server node may be abnormal due to the high traffic load that is about to be faced, the early warning operation can automatically guide part of the request traffic to other server nodes with relatively light loads, and distribute the pressure through the load balancing mechanism. For example, in a distributed Web application system, the intelligent scheduling function of the load balancer can be used to reallocate some HTTP requests originally sent to the node to be monitored to other servers with more idle resources in the cluster, ensuring that the overall business processing capacity is not affected, so that the node that may have abnormalities can maintain a relatively normal operating state.

[0070] For some non-core functional services, if the node where they are located is predicted to have abnormal operation, in order to ensure the normal operation of the core business, the early warning operation can automatically downgrade these non-core services. For example, in an e-commerce platform, if an abnormal warning appears in the node where the product recommendation service is located, the system can temporarily reduce the accuracy of the recommendation service or reduce the number of recommended products, freeing up some resources for core functions such as ordering and payment, ensuring that users can successfully complete the shopping process and avoiding the entire system crash due to resource competition.

[0071] Optionally, the early warning result includes the fault type, so the fault operation data corresponding to the fault type can be determined based on the fault type and the preset correspondence, and then the monitored node can be controlled to perform the early warning operation corresponding to the fault operation data to control the monitored node to be in a normal operating state.

[0072] The preset corresponding relationship includes the corresponding relationship between the fault operation data and the corresponding fault type.

[0073] In a possible implementation, the node to be monitored may be controlled to perform the warning operation corresponding to the fault operation data in the following manner:

[0074] Method 1: Control the task corresponding to the node to be monitored to be in a suspended state.

[0075] Method 2: Expand the capacity of the storage device corresponding to the task of the node to be monitored.

[0076] Method three: Control the task corresponding to the node to be monitored to restart.

[0077] By adopting the above technical solution, when the warning result is an operation abnormality, prompt information can be output in time to let relevant personnel know the situation, and at the same time, the monitored nodes can be controlled to execute the warning operation for automatic response, which can form a guarantee mechanism combining manual and automatic, minimize the possibility of system failure and reduce the negative impact caused by the failure, and ensure the stable operation of the business system.

[0078] Figure 2 is a flow chart of an early warning method provided by an embodiment of the present application, such as Figure 2 As shown, the method may include the following steps.

[0079] In step S201, node data corresponding to the node to be monitored in the business system is obtained.

[0080] The node data includes at least one of system logs, monitoring indicators, and device status.

[0081] In step S202, the node data is preprocessed to obtain the preprocessed operation data.

[0082] The preprocessing includes removing outliers and / or filling missing values.

[0083] In step S203, the operation data is input into the trained early warning model to obtain the early warning result of the node to be monitored output by the early warning model.

[0084] In step S204, when the warning result is an operation abnormality, a prompt message is output.

[0085] The prompt information is used to prompt the user that the node to be monitored is in an abnormal operation state within a preset time period.

[0086] In step S205, the node to be monitored is controlled to perform an early warning operation.

[0087] The early warning operation is used to control the node to be monitored to be in a normal operating state.

[0088] By adopting the above technical solution, it is possible to obtain the operating data of the nodes to be monitored in the business system and use the trained early warning model for analysis and prediction, so as to know in advance whether the nodes will have abnormal operation. When the early warning result is an abnormal operation, prompt information is output in time to let relevant personnel know the situation. At the same time, the nodes to be monitored are controlled to execute early warning operations for automatic response, which can form a guarantee mechanism combining manual and automatic, minimize the possibility of system failures and reduce the negative impact of failures, and ensure the stable operation of the business system.

[0089] Figure 3 is a block diagram of an early warning device provided in an embodiment of the present application, such as Figure 3 As shown, the device 300 includes:

[0090] The acquisition module 301 is used to acquire the operation data corresponding to the node to be monitored in the business system;

[0091] An early warning module 302 is used to input the operation data into a trained early warning model to obtain an early warning result of the node to be monitored output by the early warning model;

[0092] Among them, the early warning result includes normal operation and abnormal operation; the early warning model is used to perform data prediction on the operation data to obtain the corresponding target operation data within a preset time period, and determine the early warning result of the monitored node within the preset time period based on the target operation data; the preset time period is a time period with the current time as the starting time.

[0093] Optionally, the system early warning model includes a linear regression sub-model, a decision classification sub-model, and a time series sub-model; the early warning module 302 includes:

[0094] A first determination submodule is used to input the operation data into the time series submodel to obtain the target operation data corresponding to the preset time period output by the time series submodel;

[0095] A second determination submodule is used to input the target operation data into the linear regression submodel to obtain a data impact parameter corresponding to each type of the target operation data output by the linear regression submodel, wherein the data impact parameter represents the degree of impact of different types of the target operation data on the operation of the node to be monitored;

[0096] The third determination submodule is used to input the data influencing parameters corresponding to each type of the target operation data and the target operation data into the decision classification submodel to obtain the classification result output by the decision classification submodel and the probability value corresponding to the classification result; and determine the early warning result of the node to be monitored based on the classification result and the probability value corresponding to the classification result.

[0097] Optionally, the device further comprises:

[0098] An output module is used to output a prompt message when the warning result is abnormal operation, and the prompt message is used to prompt the user that the node to be monitored is in an abnormal operation state within a preset time period;

[0099] The execution module is used to control the node to be monitored to execute an early warning operation, and the early warning operation is used to control the node to be monitored to be in a normal operating state.

[0100] Optionally, the early warning result includes a fault type; the execution module is used to determine the fault operation data corresponding to the fault type based on the fault type and a preset correspondence, wherein the preset correspondence includes a correspondence between the fault operation data and the corresponding fault type; and control the node to be monitored to execute the early warning operation corresponding to the fault operation data to control the node to be monitored to be in a normal operating state.

[0101] Optionally, controlling the node to be monitored to perform the early warning operation corresponding to the fault operation data includes at least one of the following steps:

[0102] Control the task corresponding to the node to be monitored to be in a suspended state;

[0103] Expanding the storage device of the task corresponding to the node to be monitored;

[0104] Control the task corresponding to the node to be monitored to restart.

[0105] Optionally, the acquisition module 301 includes:

[0106] An acquisition submodule is used to acquire node data corresponding to the node to be monitored in the business system, where the node data includes at least one of a system log, a monitoring indicator, and a device status;

[0107] The preprocessing submodule is used to preprocess the node data to obtain the preprocessed running data, and the preprocessing includes removing outliers and / or filling missing values.

[0108] Optionally, the device further comprises:

[0109] The sample acquisition module is used to obtain the sample operation data corresponding to the node to be monitored in the business system, and the sample results corresponding to the sample operation data;

[0110] The training module is used to train the preset early warning model according to the sample operation data and the sample results corresponding to the sample operation data to obtain the trained early warning model.

[0111] The above-mentioned device is used to obtain the operating data corresponding to the node to be monitored in the business system; the operating data is input into the trained early warning model to obtain the early warning result of the node to be monitored output by the early warning model; wherein the early warning result includes normal operation and abnormal operation; the early warning model is used to predict the operating data to obtain the corresponding target operating data within a preset time period, and determine the early warning result of the node to be monitored within the preset time period according to the target operating data; the preset time period is a time period starting at the current time. In this way, by obtaining the operating data of the node to be monitored in the business system and using the trained early warning model for analysis and prediction, it is possible to know in advance whether the node will have abnormal operation, avoid the problem in the related technology that only the current fault can be warned, and prevent the lag of fault warning.

[0112] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0113] The present invention also provides an electronic device, see Figure 4 , including: a processor 401, a memory 402, and a computer program 4021 stored in the memory and executable on the processor, wherein the processor implements the early warning device of the aforementioned embodiment when executing the program.

[0114] The present invention also provides a readable storage medium, when the instructions in the storage medium are executed by the processor of the electronic device, the electronic device can execute the early warning device of the aforementioned embodiment.

[0115] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0116] It should be noted that the various information and data obtained in the embodiments of the present invention are all obtained with the authorization of the information / data holder.

[0117] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming voice. It should be understood that various programming voices can be utilized to realize the content of the present invention described herein, and the description of the above specific voices is for the purpose of disclosing the best mode of the present invention.

[0118] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0119] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, the various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed invention requires more features than the features explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0120] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0121] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components in the sorting device according to the present invention. The present invention may also be implemented as a device or apparatus program for executing part or all of the methods described herein. Such a program for implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0122] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

[0123] The user information (including but not limited to the user's device information, user personal information, etc.) and related data involved in the present invention are all information authorized by the user or by all parties.

[0124] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0125] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0126] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. An early warning method, characterized in that: The method comprises: Obtain the operating data corresponding to the node to be monitored in the business system; Inputting the operating data into a trained early warning model to obtain an early warning result of the node to be monitored output by the early warning model; Among them, the early warning results include normal operation and abnormal operation; the early warning model is used to perform data prediction on the operation data to obtain the corresponding target operation data within a preset time period, and determine the early warning result of the monitored node within the preset time period based on the target operation data; the preset time period is a time period with the current time as the starting time.

2. The method according to claim 1, characterized in that: The system early warning model includes a linear regression sub-model, a decision classification sub-model, and a time series sub-model; the operation data is input into the trained early warning model to obtain the early warning result of the node to be monitored output by the early warning model, including: Inputting the operation data into the time series sub-model to obtain the target operation data output by the time series sub-model corresponding to the preset time period; Input the target operation data into the linear regression sub-model to obtain a data impact parameter corresponding to each type of the target operation data output by the linear regression sub-model, wherein the data impact parameter represents the degree of impact of different types of the target operation data on the operation of the node to be monitored; The data influencing parameters corresponding to the target operation data of each type and the target operation data are input into the decision classification sub-model to obtain the classification result output by the decision classification sub-model and the probability value corresponding to the classification result; and the early warning result of the node to be monitored is determined based on the classification result and the probability value corresponding to the classification result.

3. The method according to claim 1, characterized in that The method further comprises: When the warning result is abnormal operation, output a prompt message, wherein the prompt message is used to prompt the user that the node to be monitored is in an abnormal operation state within a preset time period; The node to be monitored is controlled to perform an early warning operation, wherein the early warning operation is used to control the node to be monitored to be in a normal operating state.

4. The method according to claim 3, characterized in that The early warning result includes a fault type; and the controlling the node to be monitored to perform an early warning operation corresponding to the early warning result includes: Determine the fault operation data corresponding to the fault type according to the fault type and the preset corresponding relationship, wherein the preset corresponding relationship includes the corresponding relationship between the fault operation data and the corresponding fault type; The node to be monitored is controlled to execute the early warning operation corresponding to the fault operation data, so as to control the node to be monitored to be in a normal operation state.

5. The method according to claim 4, characterized in that The controlling the node to be monitored to perform the early warning operation corresponding to the fault operation data comprises at least one of the following steps: Control the task corresponding to the node to be monitored to be in a suspended state; Expanding the storage device of the task corresponding to the node to be monitored; Control the task corresponding to the node to be monitored to restart.

6. The method according to claim 1, characterized in that The obtaining of the operation data corresponding to the node to be monitored in the business system includes: Obtain node data corresponding to the node to be monitored in the business system, wherein the node data includes at least one of a system log, a monitoring indicator, and a device status; The node data is preprocessed to obtain the preprocessed operation data, wherein the preprocessing includes removing outliers and / or filling missing values.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: Obtaining sample operation data corresponding to the node to be monitored in the business system, and sample results corresponding to the sample operation data; The preset early warning model is trained according to the sample operation data and the sample results corresponding to the sample operation data to obtain the trained early warning model.

8. An early warning device, characterized in that: The device comprises: The acquisition module is used to obtain the operating data corresponding to the node to be monitored in the business system; An early warning module, used for inputting the operation data into a trained early warning model to obtain an early warning result of the node to be monitored output by the early warning model; Among them, the early warning results include normal operation and abnormal operation; the early warning model is used to perform data prediction on the operation data to obtain the corresponding target operation data within a preset time period, and determine the early warning result of the monitored node within the preset time period based on the target operation data; the preset time period is a time period with the current time as the starting time.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 7 when executing the program.

10. A readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any one of the methods described in claims 1-7.

Images