Intelligent operation and maintenance method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention relates to an artificial intelligence technology, in particular to an intelligent operation and maintenance method and device, electronic equipment and a storage medium. Obtaining corresponding original logs from various types of servers; performing structured analysis on the original log to obtain a to-be-analyzed log; predicting whether the log to be analyzed has an abnormal risk or not through the trained abnormal prediction model, and obtaining a prediction result; when the prediction result shows that the abnormal risk exists, whether manual maintenance is needed or not is predicted through a maintenance judgment model according to the abnormal content in the prediction result; and if not, generating a target operation and maintenance strategy according to a preset operation and maintenance rule and the abnormal content, and controlling to execute the target operation and maintenance strategy. According to the embodiment of the invention, the predictability of operation and maintenance and the processing efficiency and accuracy of abnormal events are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to artificial intelligence technology, and in particular to an intelligent operation and maintenance method, device, electronic device and storage medium. Background Art

[0002] During the operation of the server, in order to ensure the stability and security of the information system, the server needs to be operated and maintained.

[0003] In the prior art, the operation and maintenance of a server usually requires an operation and maintenance administrator to perform maintenance operations on the system using various types of information generated based on the operation of the system.

[0004] However, manual operation and maintenance often lack the ability to predict potential system problems and are more likely to respond after the fact. At the same time, manual operation and maintenance operations for abnormal events often have long response times, low processing efficiency, and cannot guarantee accuracy. Summary of the invention

[0005] The present application provides an intelligent operation and maintenance method, device, electronic device and storage medium to improve the predictability of operation and maintenance, as well as the efficiency and accuracy of handling abnormal events.

[0006] In a first aspect, an embodiment of the present application provides an intelligent operation and maintenance method, the intelligent operation and maintenance method comprising:

[0007] Obtain the corresponding original logs from each type of server;

[0008] Perform structured analysis on the original log to obtain the log to be analyzed;

[0009] Use the trained anomaly prediction model to predict whether the log to be analyzed has an abnormal risk and obtain the prediction result;

[0010] When the prediction result indicates that there is an abnormal risk, the maintenance judgment model is used to predict whether manual maintenance is required based on the abnormal content in the prediction result;

[0011] If not, a target operation and maintenance strategy is generated according to the preset operation and maintenance rules and the abnormal content, and the execution of the target operation and maintenance strategy is controlled.

[0012] In a second aspect, an embodiment of the present application further provides an intelligent operation and maintenance device, the intelligent operation and maintenance device comprising:

[0013] The original log acquisition module is used to obtain the corresponding original logs from various types of servers;

[0014] The module for obtaining logs to be analyzed is used to perform structured analysis on the original logs to obtain the logs to be analyzed;

[0015] The prediction result acquisition module is used to predict whether the log to be analyzed has abnormal risks through the trained abnormal prediction model and obtain the prediction results;

[0016] A manual maintenance determination module is used to predict whether manual maintenance is required through a maintenance determination model based on the abnormal content in the prediction result when the prediction result indicates that there is an abnormal risk;

[0017] The target operation and maintenance strategy execution module is used to generate the target operation and maintenance strategy according to the preset operation and maintenance rules and abnormal content, and control the execution of the target operation and maintenance strategy.

[0018] In a third aspect, an embodiment of the present application further provides an electronic device, the electronic device comprising:

[0019] one or more processors;

[0020] A storage device for storing one or more programs;

[0021] When one or more programs are executed by one or more processors, the one or more processors implement any one of the intelligent operation and maintenance methods provided in the embodiments of the present application.

[0022] In a fourth aspect, an embodiment of the present application further provides a storage medium comprising computer executable instructions, which, when executed by a computer processor, are used to execute any one of the intelligent operation and maintenance methods provided in the embodiments of the present application.

[0023] The present application obtains the corresponding original logs from various types of servers; performs structured analysis on the original logs to obtain the logs to be analyzed. By performing structured analysis on the original logs, the logs to be analyzed can be standardized, the data quality of the logs to be analyzed can be improved, the misjudgment caused by non-standardized data can be avoided, and the accuracy of subsequent predictions can be improved; by training a good abnormal prediction model, it is predicted whether there is an abnormal risk in the log to be analyzed, and the prediction result can be obtained, so as to realize the prediction of potential problems of the server, so as to improve the predictability of subsequent operation and maintenance; when the prediction result is that there is an abnormal risk, according to the abnormal content in the prediction result, the maintenance judgment model is used to predict whether manual maintenance is required; if not, according to the preset operation and maintenance rules and abnormal content, a target operation and maintenance strategy is generated, and the execution of the target operation and maintenance strategy is controlled to automatically perform operation and maintenance, so as to improve the accuracy and efficiency of operation and maintenance. Therefore, through the technical solution of the present application, the problem that manual operation and maintenance often lacks the ability to predict potential problems of the system, and the processing efficiency is low and the accuracy cannot be guaranteed is solved, so as to achieve the effect of improving the predictability of operation and maintenance, as well as the processing efficiency and accuracy of abnormal events. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1This is a flow chart of an intelligent operation and maintenance method in Embodiment 1 of the present application;

[0025] Figure 2 This is a flow chart of an intelligent operation and maintenance method in Embodiment 2 of the present application;

[0026] Figure 3 This is a flow chart of an intelligent operation and maintenance method in Embodiment 3 of the present application;

[0027] Figure 4 This is a structural diagram of an intelligent operation and maintenance device in Embodiment 4 of the present application;

[0028] Figure 5 It is a structural diagram of an electronic device in Embodiment 5 of the present application. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0030] It should be noted that the terms "first" and "second" etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] Embodiment 1

[0032] Figure 1 A flowchart of an intelligent operation and maintenance method provided in Example 1 of the present application. This embodiment is applicable to the situation where intelligent operation and maintenance of a server cluster is performed. The method can be executed by an intelligent operation and maintenance device, which can be implemented in software and / or hardware and specifically configured in the operation and maintenance equipment of the server cluster, for example, a computer in an operation and maintenance platform.

[0033] See also Figure 1 The intelligent operation and maintenance method shown in the figure specifically includes the following steps:

[0034] S110: Obtain corresponding original logs from each type of server.

[0035] Due to the different locations and functions of servers, the focus of their operation and maintenance is also different, so it is necessary to obtain the corresponding type of original logs according to the type of server. Specifically, data collection rules can be set in advance, and the corresponding original logs can be obtained from each type of server according to the pre-set data collection rules. Data collection rules are used to limit the types of original logs that need to be obtained from each type of server.

[0036] Exemplarily, the types of original logs may include at least one of basic logs, functional logs, and running component logs. Basic logs may be logs that include snapshot information of system resource loads generated when the server is running. For example, basic logs may include running logs of components such as the central processing unit (CPU), memory, disk, and network. Functional logs may be logs generated during the operation of related functions of functional servers. For example, functional logs may include access logs, transaction detail logs, and error logs generated by middleware servers. Running component logs may be component running log information that plays a key role in the normal operation of the system. For example, running component logs may be security audit logs.

[0037] The collection rules can be determined by professional technicians based on experience or analysis of historical data, and this application does not specifically limit this. For example, the collection rules can include the middleware server collecting basic logs and function logs.

[0038] S120: Perform structured analysis on the original log to obtain a log to be analyzed.

[0039] Structured parsing is used to parse the data type and value of each field in the original log, and extract key features to generate logs to be analyzed. The logs to be analyzed can be the logs that have been structured and normalized for the original logs, and are used to input into the subsequent anomaly prediction model to predict anomaly risks.

[0040] The arrangement of fields in different types of original logs may be different, the data types may also be different, and not all content in the original logs is useful for subsequent abnormal risk prediction. Therefore, it is necessary to perform structured analysis on the original logs, extract data that is useful for subsequent abnormal risk prediction, and unify the format to improve the data quality of the logs to be analyzed.

[0041] In an optional embodiment, the original log is structured parsed to obtain the log to be analyzed, including: deleting irrelevant information and supplementing the context of the original log to obtain the log to be analyzed; extracting key information from the log to be analyzed according to preset structured quantitative indicators, and determining structured quantitative indicators based on the key information to obtain the log to be analyzed.

[0042] Irrelevant information deletion can be to remove data in the original log that is irrelevant to the operation and maintenance analysis needs according to the data cleaning rules defined by the user. For example, irrelevant information deletion can be to remove the output information at startup and the output business information, etc. Context supplementation can be to complete the missing information related to the operation and maintenance analysis needs in the original log. Some original logs lack key information for subsequent structured quantitative indicators, so context supplementation is required. Exemplarily, the data type of context supplementation may include the time of event occurrence, event level, and event source, etc. The context supplementation method can be determined according to the type of data to be supplemented, and this application does not make specific limitations on this. For example, when the time of event occurrence is missing, the time of occurrence of the missing event can be determined through an interpolation algorithm to perform context supplementation.

[0043] The log to be analyzed may be a log after irrelevant information is deleted and context is supplemented from the original log, which is used to perform structured analysis to obtain the log to be analyzed. The preset structured quantitative index may be a preset quantitative index that needs to be structured analyzed, which is used to extract key information in the log to be analyzed and perform quantitative processing. The key information corresponding to the preset structured quantitative index is obtained in the log to be analyzed, and the obtained key information is quantitatively processed according to the quantitative rules in the preset structured quantitative index. The quantitative processing is used to convert the key information into multi-dimensional quantitative indicators that can be recognized and processed by a computer. Exemplarily, the quantitative processing may include processing methods such as standardization, normalization, and feature engineering, which can standardize the format of key information, improve the quality of structured quantitative indicators, and improve the efficiency and accuracy of subsequent processing. For example, the data format in the log to be analyzed may be as follows:

[0044] [Event time][Host name][Component][First-level indicator][Second-level indicator]...[N-level indicator]: [Indicator value 1][Indicator value 2]...[Indicator value N].

[0045] The irrelevant information of the original log is deleted and the context is supplemented to obtain the log to be analyzed. By deleting irrelevant information, the information redundancy of the log to be analyzed is reduced, the interference of irrelevant information on subsequent predictions is reduced, and the accuracy of predictions is improved. The integrity of the log to be analyzed is guaranteed by context supplementation, and multi-dimensional data support is provided for subsequent predictions. According to the preset structured quantitative indicators, the key information in the log to be analyzed is extracted, and the structured quantitative indicators are determined based on the key information to obtain the log to be analyzed, so that the log to be analyzed is standardized, which is convenient for subsequent predictions and improves the efficiency and accuracy of predictions.

[0046] S130. Predict whether the log to be analyzed has an abnormal risk by using the trained abnormal prediction model, and obtain a prediction result.

[0047] The trained anomaly prediction model can be an anomaly prediction model with abnormal risk prediction capability obtained after supervised training with labeled sample data, and is used to predict whether there is an abnormal risk in the log to be analyzed. The anomaly prediction model can be a deep learning model. Exemplarily, the anomaly prediction model can be a deep learning network such as a long short-term memory network, a convolutional neural network, and a decision tree, and this application does not specifically limit this. The trained anomaly prediction model can be encapsulated, and the reasoning interface of the trained anomaly prediction model can be exported using the HTTP (Hypertext Transfer Protocol) / TCP (Transmission Control Protocol) protocol, and the trained anomaly prediction model can be used later through the reasoning interface.

[0048] The log to be analyzed is input into the trained anomaly prediction model, and the output is the prediction result. The prediction result may include the risk type and the abnormal content. The risk type may include the presence of abnormal risk and the absence of abnormal risk. The abnormal content may be the specific risk content corresponding to the risk type of the presence of abnormal risk.

[0049] S140: When the prediction result indicates that there is an abnormal risk, a maintenance determination model is used to predict whether manual maintenance is required based on the abnormal content in the prediction result.

[0050] The maintenance determination model may be a model for determining whether manual intervention is required based on the abnormal content. Exemplarily, the maintenance determination model may be an expert model that determines whether manual intervention is required based on the abnormal content through preset rules. Exemplarily, the maintenance determination model may also be a deep learning model, such as a large model, that automatically determines whether manual intervention is required based on the abnormal content after learning certain rules.

[0051] When the prediction result indicates that there is an abnormal risk, the abnormal content is input into the maintenance decision model to determine whether manual maintenance is required.

[0052] S150: If not, generate a target operation and maintenance strategy according to preset operation and maintenance rules and abnormal content, and control the execution of the target operation and maintenance strategy.

[0053] If not, that is, no manual maintenance is required, the automatic maintenance program is entered at this time. The preset operation and maintenance rules can be pre-set maintenance rules for abnormal events, which are used to generate target operation and maintenance strategies. The operation and maintenance rules can be set by professional technicians according to relevant operation and maintenance guidance books, regulations and relevant information of historical operation and maintenance events, etc., and this application does not make specific limitations on this. The target operation and maintenance strategy can be a specific method of operation and maintenance, which may include operation and maintenance objects and operation content. After generating the target operation and maintenance strategy, the execution device is controlled to execute the target operation and maintenance strategy to achieve automatic operation and maintenance.

[0054] If yes, that is, manual maintenance is required, the abnormal content in the prediction result can be sent to the corresponding operation and maintenance personnel to prompt the operation and maintenance personnel to perform manual operation and maintenance.

[0055] In the server operation and maintenance scenario, the operation and maintenance administrator usually uses various information generated based on the system operation to monitor the system, troubleshoot, manage resources, and maintain security. These operation and maintenance operations are crucial to ensuring the stability and security of information systems, but they also have many shortcomings. Manual operation and maintenance operations often require a lot of repetitive work, especially in monitoring and troubleshooting, and are inefficient; when problems occur in the system, manual intervention often takes more time, which may lead to longer response and resolution time; due to human factors such as fatigue and negligence, manual operation and maintenance may have operational errors, increasing system risks; as the scale of the system expands, the difficulty and complexity of manual operation and maintenance will increase dramatically, making it difficult to expand effectively; manual operation and maintenance often lack the ability to predict potential problems in the system, and are more of a post-event response, with poor results.

[0056] In summary, with the rapid development of information technology, the complexity of system operation and maintenance is increasing. Traditional operation and maintenance methods rely on manual monitoring and analysis of system logs. This method is inefficient, prone to missing important information, and difficult to adapt to large-scale and dynamic system environments.

[0057] The technical solution of this embodiment obtains the corresponding original log from each type of server; performs structured analysis on the original log to obtain the log to be analyzed. By performing structured analysis on the original log, the log to be analyzed can be standardized, the data quality of the log to be analyzed can be improved, the misjudgment caused by non-standard data can be avoided, and the accuracy of subsequent prediction can be improved; by training a good abnormal prediction model, it is predicted whether there is an abnormal risk in the log to be analyzed, and the prediction result can be obtained, so as to realize the prediction of potential problems of the server to improve the predictability of subsequent operation and maintenance; when the prediction result is that there is an abnormal risk, according to the abnormal content in the prediction result, the maintenance judgment model is used to predict whether manual maintenance is required; if not, according to the preset operation and maintenance rules and abnormal content, a target operation and maintenance strategy is generated, and the execution of the target operation and maintenance strategy is controlled to automatically perform operation and maintenance, thereby improving the accuracy and efficiency of operation and maintenance. Therefore, through the technical solution of this application, the problem that manual operation and maintenance often lacks the ability to predict potential problems of the system, and the processing efficiency is low and the accuracy cannot be guaranteed is solved, and the predictability of operation and maintenance, as well as the efficiency and accuracy of abnormal event processing are improved.

[0058] Embodiment 2

[0059] Figure 2 This is a flow chart of an intelligent operation and maintenance method provided in Example 2 of the present application. The technical solution of this embodiment is further refined on the basis of the above technical solution.

[0060] Furthermore, “using the trained anomaly prediction model to predict whether the log to be analyzed has an abnormal risk, including” is refined into: “according to the server type corresponding to the log to be analyzed, determining the target anomaly prediction model from the trained candidate anomaly prediction models; using the target anomaly prediction model to predict whether the log to be analyzed has an abnormal risk” to predict whether the log to be analyzed has an abnormal risk.

[0061] See also Figure 2 An intelligent operation and maintenance method shown includes:

[0062] S210: Obtain corresponding original logs from each type of server.

[0063] S220: Perform structured analysis on the original log to obtain a log to be analyzed.

[0064] S230: Determine a target anomaly prediction model from the trained candidate anomaly prediction models according to the server type corresponding to the log to be analyzed.

[0065] In the actual operation and maintenance process, different types of servers have different operation and maintenance requirements. Therefore, the log information that needs to be paid attention to is different, and the influencing factors and operation and maintenance goals that need to be considered when encountering failures are also different, and the corresponding operation and maintenance actions that need to be taken are different. For example, for resource-based servers that need to monitor resources, the operation and maintenance personnel will mainly focus on their resource fluctuations, and take corresponding expansion or reduction operations when resource usage is too high or too low. For another example, for middleware servers that need to monitor transaction status, the operation and maintenance personnel will pay more attention to indicators such as transaction success rate and time consumption. Therefore, for different server types, it is necessary to train different candidate anomaly prediction models to meet the needs of different operation and maintenance scenarios.

[0066] The candidate anomaly prediction model may be anomaly prediction models corresponding to different server types, and is used to predict anomaly risks according to the logs to be analyzed of the corresponding server types. According to the server type corresponding to the logs to be analyzed, the candidate anomaly prediction model of the server of this type is determined from the trained candidate anomaly prediction models as the target anomaly prediction model.

[0067] In an optional embodiment, the trained candidate anomaly prediction models are obtained by the following training method: based on different types of servers, historical logs are obtained respectively; the log content of the historical logs is structured and parsed, and the corresponding abnormal content is marked to obtain a sample data set; based on the sample data set, the corresponding anomaly prediction model is trained for each type of server to obtain each trained candidate anomaly prediction model.

[0068] Historical logs can be related logs within a historical period of time when manual operation and maintenance are performed. Perform structured analysis on the historical logs, and mark the corresponding abnormal content to obtain a sample data set. Through structured analysis, irrelevant information in the historical logs is removed and key information is completed, and structured quantitative indicators are determined to improve the quality of data in the sample data set. According to historical operation and maintenance operations, the abnormal content in the historical logs is marked to obtain a labeled sample data set. The sample data set can be divided into a training set and a validation set. The division ratio can be determined by professional technicians based on experiments or experience, and this application does not make specific restrictions on this. For example, the ratio of training set to validation set can be 8:2.

[0069] Since different types of servers have different concerns, operation and maintenance actions and goals, we train corresponding anomaly prediction models for each type of server.

[0070] Historical logs are usually time series data, which is characterized by the influence of time sequence between data. For the prediction and classification of such data, the Long Short-Term Memory Network (LSTM) algorithm model, a variant of the Recurrent Neural Network (RNN) model, can be used as the initial candidate anomaly prediction model.

[0071] In the structure of the LSTM model, the training set data of various types of servers can be input into the corresponding initial LSTM model for training. The input sequence is in the form of [index 1(t), index 2(t)...index N(t)], [index 1(t+1), index 2(t+1)...index N(t+1)]...[index 1(t+N), index 2(t+N)...index N(t+N)]. The model parameters obtained by training this sequence are the anomaly prediction models in the current operation and maintenance environment. The trained anomaly prediction models are verified based on the corresponding verification set, and the trained candidate anomaly prediction models are obtained after the verification.

[0072] By obtaining historical logs based on different types of servers, performing structured analysis on the log contents of historical logs and marking the corresponding abnormal contents to obtain sample data sets, training corresponding anomaly prediction models for each type of server based on the sample data sets to obtain trained candidate anomaly prediction models, and training corresponding anomaly prediction models for different types of servers, the accuracy of risk prediction for different types of servers can be effectively improved.

[0073] S240. Predict whether the log to be analyzed has an abnormal risk by using the target abnormality prediction model.

[0074] The log to be analyzed is input into the target anomaly prediction model to obtain the prediction result of abnormal risk.

[0075] S250: When the prediction result indicates that there is an abnormal risk, the maintenance determination model is used to predict whether manual maintenance is required based on the abnormal content in the prediction result.

[0076] S260: If not, generate a target operation and maintenance strategy according to preset operation and maintenance rules and abnormal content, and control the execution of the target operation and maintenance strategy.

[0077] The technical solution of this embodiment determines the target anomaly prediction model from the trained candidate anomaly prediction models according to the server type corresponding to the log to be analyzed; predicts whether the log to be analyzed has an abnormal risk through the target anomaly prediction model, and by training the corresponding candidate anomaly prediction models for different server types, the target anomaly prediction model can make predictions for the corresponding server types, thereby improving the accuracy of predicting whether the log to be analyzed has an abnormal risk.

[0078] Embodiment 3

[0079] Figure 3 This is a flow chart of an intelligent operation and maintenance method provided in Example 3 of the present application. The technical solution of this embodiment is further refined on the basis of the above technical solution.

[0080] Furthermore, "generate a target operation and maintenance strategy based on preset operation and maintenance rules and abnormal content, and control the execution of the target operation and maintenance strategy" is refined as: "obtain the relevant context of the abnormal content, and send the abnormal content and the relevant context of the abnormal content to the operation and maintenance strategy generation model; the operation and maintenance strategy generation model determines the target operation and maintenance rules from the preset operation and maintenance rules according to the abnormal content, and generates the target operation and maintenance strategy based on the target operation and maintenance rules and relevant context; control the execution module corresponding to the target operation and maintenance strategy to execute the target operation and maintenance strategy" to automatically implement the target operation and maintenance strategy.

[0081] See also Figure 3 An intelligent operation and maintenance method shown includes:

[0082] S310: Obtain corresponding original logs from each type of server.

[0083] S320: Perform structured analysis on the original log to obtain the log to be analyzed.

[0084] S330. Predict whether the log to be analyzed has an abnormal risk by using the trained abnormal prediction model, and obtain a prediction result.

[0085] S340: When the prediction result indicates that there is an abnormal risk, the maintenance determination model is used to predict whether manual maintenance is required based on the abnormal content in the prediction result.

[0086] S350: If not, obtain the relevant context of the abnormal content, and send the abnormal content and the relevant context to the operation and maintenance strategy generation model.

[0087] The relevant context may be relevant information for operating and maintaining the server corresponding to the abnormal content, and is used to generate a target operation and maintenance strategy. Exemplarily, the relevant context may include information such as the server address, configuration, current system load, and running process, which is not specifically limited in this application. The relevant context may be obtained through the original log corresponding to the abnormal content, and the abnormal content may be obtained through the output of the abnormal prediction model.

[0088] The operation and maintenance strategy generation model is used to determine the operation and maintenance strategy based on the operation and maintenance actions corresponding to the abnormal content in the pre-maintained rule base. Exemplarily, the operation and maintenance strategy generation model can be a deep learning network. For example, the operation and maintenance strategy generation model can be a large model or a decision tree. The abnormal content and the relevant context of the abnormal content are sent to the operation and maintenance strategy generation model so that the operation and maintenance strategy generation model generates a target operation and maintenance strategy.

[0089] S360, an operation and maintenance strategy generation model determines a target operation and maintenance rule from preset operation and maintenance rules according to the abnormal content, and generates a target operation and maintenance strategy according to the target operation and maintenance rule and related context.

[0090] The preset operation and maintenance rules may be relevant rules for operation and maintenance, and may be obtained through relevant rule files. The target operation and maintenance rules may be rules in the preset operation and maintenance rules for handling abnormal content. The preset operation and maintenance rules may be maintained through a dedicated rule library. The operation and maintenance strategy generation model determines the corresponding operation and maintenance rules for handling abnormal content based on the preset operation and maintenance rules as the target operation and maintenance rules. The target operation and maintenance strategy may include specific operation and maintenance steps and operation and maintenance objects for handling abnormal content. Specifically, based on the target operation and maintenance rules and related contexts, a specific strategy for handling abnormal content, i.e., the target operation and maintenance strategy, may be determined.

[0091] S370. Control the execution module corresponding to the target operation and maintenance strategy to execute the target operation and maintenance strategy.

[0092] The execution module can be a module that executes the target operation and maintenance strategy, and is used to perform operation and maintenance processing on abnormal content. There can be multiple execution modules. After the target operation and maintenance strategy is determined, the target operation and maintenance strategy can be added to the execution queue, and the idle execution modules are controlled to sequentially obtain the target operation and maintenance strategy in the execution queue and execute it, so as to realize automatic operation and maintenance of abnormal content.

[0093] In an optional embodiment, after controlling the execution module corresponding to the target operation and maintenance strategy to execute the target operation and maintenance strategy, it also includes: obtaining the execution result after the execution module executes the target operation and maintenance strategy; and feeding back the execution result to the operation and maintenance strategy generation model.

[0094] The execution result may be the change of the relevant target indicator after the target operation and maintenance strategy is executed on the operation and maintenance object. For example, if the target operation and maintenance strategy is capacity expansion, the execution result may be whether the capacity is expanded. Optionally, the target operation and maintenance strategy may include an operation and maintenance target, and the operation and maintenance target may include specific target indicator data. After executing the target operation and maintenance strategy, the execution result may be obtained based on the target indicator data.

[0095] Feedback the execution results to the operation and maintenance strategy generation model, and the operation and maintenance strategy generation model can be incrementally trained based on the execution results to improve the accuracy of the operation and maintenance strategy generation model. An execution report can be generated based on the execution results and target indicator data. Feedback the execution report to the operation and maintenance strategy generation model so that the operation and maintenance strategy generation model can be incrementally trained for the indicators corresponding to the target indicator data based on the target operation and maintenance strategy and operation and maintenance results.

[0096] By obtaining the execution results of the execution module after executing the target operation and maintenance strategy, and feeding back the execution results to the operation and maintenance strategy generation model, the operation and maintenance strategy generation model can be incrementally trained. The feedback-based learning method can continuously optimize the operation and maintenance strategy generation model, improve the accuracy of the target operation and maintenance strategy, and improve the effectiveness and intelligence of operation and maintenance.

[0097] The technical solution of this embodiment obtains the relevant context of the abnormal content, and sends the abnormal content and the relevant context of the abnormal content to the operation and maintenance strategy generation model; the operation and maintenance strategy generation model determines the target operation and maintenance rules from the preset operation and maintenance rules according to the abnormal content, and generates the target operation and maintenance strategy according to the target operation and maintenance rules and the relevant context, and accurately determines the target operation and maintenance strategy through the operation and maintenance strategy generation model; the execution module corresponding to the target operation and maintenance strategy is controlled to execute the target operation and maintenance strategy, which can automatically determine and execute the target operation and maintenance strategy, realize automatic operation and maintenance, reduce the workload of manual operation and maintenance, reduce the labor cost of operation and maintenance, and improve the efficiency and accuracy of operation and maintenance.

[0098] Embodiment 4

[0099] Figure 4 The figure shows a schematic diagram of the structure of an intelligent operation and maintenance device provided in the fourth embodiment of the present application. This embodiment can be applied to the case of intelligent operation and maintenance of a server cluster, and is configured in the operation and maintenance equipment of the server cluster. The specific structure of the intelligent operation and maintenance device is as follows:

[0100] The original log acquisition module 410 is used to acquire the corresponding original logs from each type of server;

[0101] The log acquisition module 420 is used to perform structured analysis on the original log to obtain the log to be analyzed;

[0102] The prediction result acquisition module 430 is used to predict whether the log to be analyzed has an abnormal risk through the trained abnormal prediction model, and obtain the prediction result;

[0103] A manual maintenance determination module 440 is used to predict whether manual maintenance is required through a maintenance determination model according to the abnormal content in the prediction result when the prediction result indicates that there is an abnormal risk;

[0104] The target operation and maintenance strategy execution module 450 is used to generate a target operation and maintenance strategy according to preset operation and maintenance rules and abnormal content, and control the execution of the target operation and maintenance strategy.

[0105] The technical solution of this embodiment obtains the corresponding original log from each type of server; performs structured analysis on the original log to obtain the log to be analyzed. By performing structured analysis on the original log, the log to be analyzed can be standardized, the data quality of the log to be analyzed can be improved, the misjudgment caused by non-standard data can be avoided, and the accuracy of subsequent prediction can be improved; by training a good abnormal prediction model, it is predicted whether there is an abnormal risk in the log to be analyzed, and the prediction result can be obtained, so as to realize the prediction of potential problems of the server to improve the predictability of subsequent operation and maintenance; when the prediction result is that there is an abnormal risk, according to the abnormal content in the prediction result, the maintenance judgment model is used to predict whether manual maintenance is required; if not, according to the preset operation and maintenance rules and abnormal content, a target operation and maintenance strategy is generated, and the execution of the target operation and maintenance strategy is controlled to automatically perform operation and maintenance, thereby improving the accuracy and efficiency of operation and maintenance. Therefore, through the technical solution of this application, the problem that manual operation and maintenance often lacks the ability to predict potential problems of the system, and the processing efficiency is low and the accuracy cannot be guaranteed is solved, and the predictability of operation and maintenance, as well as the efficiency and accuracy of abnormal event processing are improved.

[0106] Optionally, the prediction result acquisition module 430 includes:

[0107] A target anomaly prediction model determination unit, used to determine a target anomaly prediction model from the trained candidate anomaly prediction models according to the server type corresponding to the log to be analyzed;

[0108] The abnormal risk prediction unit is used to predict whether the log to be analyzed has abnormal risk through the target abnormal prediction model.

[0109] Optionally, the intelligent operation and maintenance device also includes:

[0110] The historical log acquisition module is used to obtain historical logs based on different types of servers;

[0111] The sample data set acquisition module is used to perform structured analysis on the log content of the historical logs and mark the corresponding abnormal content to obtain the sample data set;

[0112] The candidate anomaly prediction model training module is used to train corresponding anomaly prediction models for each type of server based on the sample data set to obtain each trained candidate anomaly prediction model.

[0113] Optionally, the target operation and maintenance strategy execution module 450 includes:

[0114] A relevant context acquisition unit, used to acquire the relevant context of the abnormal content, and send the abnormal content and the relevant context of the abnormal content to the operation and maintenance strategy generation model;

[0115] A target operation and maintenance strategy generation unit is used for generating an operation and maintenance strategy model, determining a target operation and maintenance rule from preset operation and maintenance rules according to the abnormal content, and generating a target operation and maintenance strategy according to the target operation and maintenance rule and related context;

[0116] The target operation and maintenance strategy execution unit is used to control the execution module corresponding to the target operation and maintenance strategy to execute the target operation and maintenance strategy.

[0117] Optionally, the target operation and maintenance strategy execution module 450 further includes:

[0118] An execution result acquisition unit, used to acquire the execution result after the execution module executes the target operation and maintenance strategy;

[0119] The execution result feedback unit is used to feed back the execution result to the operation and maintenance strategy generation model.

[0120] Optionally, the module 420 for obtaining the logs to be analyzed includes:

[0121] The to-be-parsed log determination unit is used to delete irrelevant information and supplement context of the original log to obtain the to-be-parsed log;

[0122] The structured quantitative index determination unit is used to extract key information in the log to be analyzed according to preset structured quantitative indexes, and determine the structured quantitative index according to the key information to obtain the log to be analyzed.

[0123] The intelligent operation and maintenance device provided in the embodiments of the present application can execute the intelligent operation and maintenance method provided in any embodiment of the present application, and has the corresponding functional modules and beneficial effects for executing the intelligent operation and maintenance method.

[0124] According to an embodiment of the present invention, the present invention also provides an electronic device, a readable storage medium and a computer program product.

[0125] Embodiment 5

[0126] Figure 5 A schematic diagram of the structure of an electronic device provided in Embodiment 5 of the present application is shown in FIG. Figure 5 As shown, the electronic device includes a processor 510, a memory 520, an input device 530 and an output device 540; the number of the processor 510 in the electronic device can be one or more. Figure 5 A processor 510 is taken as an example; the processor 510, the memory 520, the input device 530 and the output device 540 in the electronic device can be connected via a bus or other means. Figure 5 The example of connecting through bus is taken in the following.

[0127] The memory 520, as a computer-readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the intelligent operation and maintenance method in the embodiment of the present application (for example, the original log acquisition module 410, the log acquisition module 420 to be analyzed, the prediction result acquisition module 430, the manual maintenance determination module 440 and the target operation and maintenance strategy execution module 450). The processor 510 executes various functional applications and data processing of the electronic device by running the software programs, instructions and modules stored in the memory 520, that is, realizing the above-mentioned intelligent operation and maintenance method.

[0128] The memory 520 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory 520 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 520 may further include a memory remotely arranged relative to the processor 510, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0129] The input device 530 may be used to receive input character information and generate key signal input related to user settings and function control of the electronic device. The output device 540 may include a display device such as a display screen.

[0130] Embodiment 6

[0131] Embodiment 6 of the present application also provides a storage medium containing computer executable instructions, which are used to execute an intelligent operation and maintenance method when executed by a computer processor. The method includes: obtaining corresponding original logs from various types of servers; performing structured analysis on the original logs to obtain logs to be analyzed; predicting whether there is an abnormal risk in the log to be analyzed through a trained abnormal prediction model to obtain a prediction result; when the prediction result is that there is an abnormal risk, predicting whether manual maintenance is required through a maintenance judgment model based on the abnormal content in the prediction result; if not, generating a target operation and maintenance strategy based on preset operation and maintenance rules and abnormal content, and controlling the execution of the target operation and maintenance strategy.

[0132] Of course, the storage medium containing computer executable instructions provided in the embodiment of the present application, whose computer executable instructions are not limited to the method operations described above, can also execute related operations in the intelligent operation and maintenance method provided in any embodiment of the present application.

[0133] Through the above description of the implementation method, the technicians in the relevant field can clearly understand that the present application can be implemented with the help of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application can be essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for an electronic device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0134] It is worth noting that in the embodiment of the above-mentioned intelligent operation and maintenance device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application.

[0135] Note that the above are only preferred embodiments of the present application and the technical principles used. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present application. Therefore, although the present application is described in more detail through the above embodiments, the present application is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the appended claims.

Claims

1. An intelligent operation and maintenance method, characterized in that: include: Obtain the corresponding original logs from each type of server; Performing structured analysis on the original log to obtain a log to be analyzed; Using the trained anomaly prediction model, predict whether the log to be analyzed has an abnormal risk, and obtain a prediction result; When the prediction result indicates that there is an abnormal risk, a maintenance determination model is used to predict whether manual maintenance is required based on the abnormal content in the prediction result; If not, a target operation and maintenance strategy is generated according to the preset operation and maintenance rules and the abnormal content, and the execution of the target operation and maintenance strategy is controlled.

2. The method according to claim 1, characterized in that The trained anomaly prediction model is used to predict whether the log to be analyzed has an abnormal risk, including: Determine a target anomaly prediction model from the trained candidate anomaly prediction models according to the server type corresponding to the log to be analyzed; The target anomaly prediction model is used to predict whether the log to be analyzed has an abnormality risk.

3. The method according to claim 1, characterized in that The trained candidate anomaly prediction model is obtained by the following training method: Obtain historical logs based on different types of servers; Performing structured analysis on the log content of the historical logs and marking the corresponding abnormal content to obtain a sample data set; Based on the sample data set, a corresponding anomaly prediction model is trained for each type of server to obtain each trained candidate anomaly prediction model.

4. The method according to claim 1, characterized in that The generating a target operation and maintenance strategy according to the preset operation and maintenance rules and the abnormal content, and controlling the execution of the target operation and maintenance strategy, includes: Acquire the relevant context of the abnormal content, and send the abnormal content and the relevant context of the abnormal content to the operation and maintenance strategy generation model; The operation and maintenance strategy generation model determines a target operation and maintenance rule from the preset operation and maintenance rules according to the abnormal content, and generates a target operation and maintenance strategy according to the target operation and maintenance rule and the relevant context; Control the execution module corresponding to the target operation and maintenance strategy to execute the target operation and maintenance strategy.

5. The method according to claim 4, characterized in that After the execution module corresponding to the control target operation and maintenance strategy executes the target operation and maintenance strategy, the method further includes: Obtaining the execution result of the execution module after executing the target operation and maintenance strategy; The execution result is fed back to the operation and maintenance strategy generation model.

6. The method according to claim 1, characterized in that The structural analysis of the original log to obtain the log to be analyzed includes: Removing irrelevant information and supplementing context from the original log to obtain a log to be parsed; According to preset structured quantitative indicators, key information in the log to be analyzed is extracted, and structured quantitative indicators are determined according to the key information to obtain the log to be analyzed.

7. An intelligent operation and maintenance device, characterized in that: include: The original log acquisition module is used to obtain the corresponding original logs from various types of servers; The module for obtaining the log to be analyzed is used to perform structured analysis on the original log to obtain the log to be analyzed; A prediction result acquisition module is used to predict whether the log to be analyzed has an abnormal risk through a trained abnormal prediction model, and obtain a prediction result; A manual maintenance determination module is used to predict whether manual maintenance is required through a maintenance determination model according to the abnormal content in the prediction result when the prediction result indicates that there is an abnormal risk; The target operation and maintenance strategy execution module is used to generate a target operation and maintenance strategy according to the preset operation and maintenance rules and the abnormal content, and control the execution of the target operation and maintenance strategy.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the intelligent operation and maintenance method as described in any one of claims 1-6 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the intelligent operation and maintenance method as described in any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the intelligent operation and maintenance method according to any one of claims 1 to 6.

Images