Server running state monitoring method and system, storage medium and electronic equipment

Abstract

The invention belongs to the technical field of server operation supervision, and particularly relates to a server operation state monitoring method and system, a storage medium and electronic device.The system comprises a cloud management and control platform, an equipment performance detection module, a network performance detection module, an anomaly detection and evaluation module, an operation state comprehensive evaluation module and a background management end; the performance of the server is detected and analyzed through the equipment performance detection module, the network state of the server is detected and analyzed through the network performance detection module, and the server is subjected to anomaly analysis through the anomaly detection and evaluation module to obtain an anomaly detection value. The operation state comprehensive evaluation module comprehensively judges the operation state of the server based on analysis results of the equipment performance detection module, the network performance detection module and the anomaly detection evaluation module, the operation state of the server can be accurately evaluated, feedback and early warning can be conducted in time, therefore, a manager is reminded to take reasonable regulation and control measures in a targeted mode, and the intelligent degree is high.

Description

Technical Field

[0001] The present invention relates to the technical field of server operation supervision, and in particular to a server operation status monitoring method, system, storage medium, electronic equipment and method. Background Art

[0002] As the scale of the Internet continues to expand, in order to meet the needs of more network users, multiple servers are often set up in a network to coordinate and process the same service to improve system redundancy, and network devices are set up to manage the distribution of service requests to these servers. The health of the server represents its ability to process user terminal service requests and provide corresponding services. When the network devices are set up for the purpose of load balancing and distribute user terminal service requests to each server, they generally use the health of the server as a reference condition for distributing service requests.

[0003] With the rapid development and widespread application of 5G technology, its applications in industrial automation, Internet of Things and other fields are increasing. However, it is currently difficult to monitor servers effectively and in real time, and it is impossible to comprehensively evaluate the operating status of servers and provide timely feedback and warnings, which is not conducive to managers making targeted and reasonable control measures, and it is impossible to effectively ensure the safe, stable and efficient operation of servers. In view of the above technical defects, a solution is now proposed. Summary of the invention

[0004] The purpose of the present invention is to provide a server operation status monitoring method, system, storage medium and electronic device and method, which solves the problems that the prior art is difficult to monitor the server effectively and in real time, cannot comprehensively evaluate the server's operation status and provide timely feedback and warnings, cannot effectively ensure the safe, stable and efficient operation of the server, and has a low level of intelligence.

[0005] To achieve the above object, the present invention provides the following technical solutions: The server operation status monitoring method includes a cloud management and control platform, a device performance detection module, a network performance detection module, an anomaly detection and evaluation module, an operation status comprehensive evaluation module and a background management terminal; the device performance detection module detects and analyzes the performance of the server, obtains a performance detection value through analysis, and sends the performance detection value to the operation status comprehensive evaluation module via the cloud management and control platform; The network performance detection module detects and analyzes the network status of the server, obtains the network detection value through analysis, and sends the network detection value to the operation status comprehensive evaluation module through the cloud management and control platform; the anomaly detection and evaluation module performs an anomaly analysis on the server and obtains the anomaly detection value, and sends the anomaly detection value to the operation status comprehensive evaluation module through the cloud management and control platform; The operation status comprehensive evaluation module comprehensively judges the operation status of the server based on the performance detection value, network detection value and anomaly detection value, and generates an operation status excellent table signal or an operation status poor table signal, and sends the operation status excellent table signal or the operation status poor table signal to the background management end through the cloud management and control platform. When the background management end receives the operation status poor table signal, it will issue a corresponding warning.

[0006] Furthermore, the specific operation process of the equipment performance detection module includes: The CPU usage of the server and the percentage of memory occupied by processes or programs in the server are collected and marked as memory usage, the duration of the CPU usage exceeding a preset CPU usage threshold per unit time is marked as a CPU over-detection value, and the duration of the memory usage exceeding a preset memory usage threshold per unit time is marked as a memory over-detection value; The CPU over-detection value and the memory over-detection value are numerically calculated to obtain the performance detection value.

[0007] Furthermore, the specific operation process of the network performance detection module includes: A number of detection periods are set within a unit time, and the corresponding detection period is marked as a network abnormality period or a network normal period through network time-division detection evaluation and analysis. The number of network abnormality periods within a unit time is obtained and the ratio is calculated with the total number of detection periods to obtain the network abnormality value; The number of network anomaly periods within the interval between two adjacent groups of network normal periods is marked as a network anomaly detection value, and the number of network anomaly detection values ​​exceeding a preset network anomaly detection threshold is marked as a network anomaly high detection value. The network anomaly high detection value is ratioed to the network anomaly detection value, and the result is marked as a network anomaly amplitude. The network segment evaluation values ​​of all detection periods within a unit time are averaged to obtain a network detection evaluation value. The network detection value is obtained by numerically calculating the network anomaly detection value, the network anomaly amplitude and the network detection evaluation value.

[0008] Furthermore, the specific analysis process of network time-division detection, evaluation and analysis is as follows: The signal strength data, data transmission rate, network delay data and packet loss rate data of the server in the corresponding detection time period are collected, and the network segment evaluation value is obtained by numerically calculating the signal strength data, data transmission rate, network delay data and packet loss rate data. The network segment evaluation value is numerically compared with the preset network segment evaluation threshold value. If the network segment evaluation value exceeds the preset network segment evaluation threshold value, the corresponding detection time period is marked as a network abnormality period; if the network segment evaluation value does not exceed the preset network segment evaluation threshold value, the corresponding detection time period is marked as a network normal period.

[0009] Furthermore, the specific operation process of the anomaly detection evaluation module includes: Through real-time anomaly capture and analysis, it is determined whether the server is in an abnormal state. The total duration and the maximum duration of a single abnormal state per unit time are obtained and marked as the total abnormal time value. The ratio of the total abnormal time value to the duration per unit time is calculated to obtain the abnormal time amplitude. The operating power consumption value of the server per unit time is collected, and the intrusion attack risk detection value is retrieved from the cloud management and control platform. The anomaly detection value is obtained by numerically calculating the abnormal time amplitude, operating power consumption value and intrusion attack risk detection value.

[0010] Furthermore, the specific analysis process of real-time anomaly capture analysis is as follows: Real-time temperature data at several locations inside the server are collected, the real-time temperature data at all locations are averaged to obtain the operation temperature detection value, and the noise decibel value and vibration amplitude generated when the server is running are collected, the operation temperature detection value, the noise decibel value and the vibration amplitude are numerically calculated to obtain the operation initial inspection value, the operation initial inspection value is numerically compared with the preset operation initial inspection threshold value, if the operation initial inspection value exceeds the preset operation initial inspection threshold value, it is determined that the server is in an abnormal operation state.

[0011] Furthermore, the specific analysis process of the operation status comprehensive evaluation module is as follows: Obtain the performance detection value, network detection value and anomaly detection value, compare the performance detection value, network detection value and anomaly detection value with the preset performance detection threshold, preset network detection threshold and preset anomaly detection threshold respectively, and generate a running status bad table signal if the performance detection value, network detection value or anomaly detection value exceeds the corresponding preset threshold; If the performance detection value, network detection value and anomaly detection value do not exceed the corresponding preset thresholds, the performance detection value, network detection value and anomaly detection value are numerically calculated to obtain a comprehensive evaluation value of the operating status, and the comprehensive evaluation value of the operating status is numerically compared with the preset comprehensive evaluation threshold of the operating status. If the comprehensive evaluation value of the operating status exceeds the preset comprehensive evaluation threshold of the operating status, a poor operating status signal is generated; if the comprehensive evaluation value of the operating status does not exceed the preset comprehensive evaluation threshold of the operating status, a good operating status signal is generated.

[0012] Furthermore, the cloud management and control platform is communicated with the log scanning and analysis module. The log scanning and analysis module obtains all security log information of the server within a unit time, and judges whether there is an intrusion attack against the server within a unit time based on the security log information. If there is an intrusion attack against the server, the intrusion attack risk detection value is obtained through intrusion attack detection and analysis, and the intrusion attack risk detection value is sent to the cloud management and control platform for storage.

[0013] Furthermore, the specific analysis process of intrusion attack detection analysis is as follows: The total number of intrusion attack behaviors against the server in a unit time is obtained and marked as the intrusion attack count value, and the occurrence time and end time of the corresponding intrusion attack behavior are collected, and the interval between the end time and the occurrence time is marked as the intrusion attack duration, the intrusion attack duration is numerically compared with the preset intrusion attack duration threshold, and the number of intrusion attack durations exceeding the preset intrusion attack duration threshold is ratio-calculated with the intrusion attack count value to obtain the intrusion attack high percentage value; The intrusion attack durations of all units of time are summed up to obtain the intrusion time value, the intrusion time value is ratioed to the total duration of the unit time to obtain the intrusion attack condition value, and the intrusion attack risk detection value is obtained by numerically calculating the intrusion attack high occupation value and the intrusion attack condition value.

[0014] Furthermore, the present invention also proposes a server-based operating status detection method, comprising the following steps: Step 1: The device performance detection module detects and analyzes the performance of the server and obtains the performance detection value through analysis; Step 2: The network performance detection module detects and analyzes the network status of the server and obtains a network detection value through analysis; Step 3: The anomaly detection and evaluation module performs an anomaly analysis on the server and obtains an anomaly detection value; Step 4: The operation status comprehensive evaluation module comprehensively judges the operation status of the server based on the performance detection value, the network detection value and the abnormal detection value, and generates an operation status good table signal or an operation status bad table signal; Step 5: The operation status comprehensive evaluation module sends an excellent operation status signal or a poor operation status signal to the background management end, and the background management end issues a corresponding warning when receiving the poor operation status signal.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. In the present invention, by analyzing the performance, network status and abnormal performance of the server, and comprehensively judging the operating status of the server based on the analysis results of the performance, network status and abnormal performance, the operating status of the server can be accurately evaluated and early warning feedback can be given in time, thereby reminding the management personnel to make targeted and reasonable control measures, which is conducive to ensuring the safe, stable and efficient operation of the server, and has a high degree of intelligence; 2. In the present invention, the log scanning and analysis module determines whether there is an intrusion attack against the server within a unit time based on the security log information. If there is an intrusion attack against the server, the intrusion attack detection and analysis is performed to accurately feedback the intrusion risk status of the server, and provide data support for the analysis process of the anomaly detection and evaluation module to ensure the accuracy of its analysis results. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with the accompanying drawings; Figure 1 This is a system block diagram of Embodiment 1 of the present invention; Figure 2 This is a system block diagram of Embodiment 2 of the present invention; Figure 3 This is a system block diagram of Embodiment 3 of the present invention; Figure 4 It is a schematic diagram of the structure of an electronic device according to Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] Embodiment 1 like Figure 1 As shown, a server operation status monitoring method, coefficient, storage medium and electronic device proposed in the present invention include a cloud management and control platform, a device performance detection module, a network performance detection module, an anomaly detection and evaluation module, an operation status comprehensive evaluation module and a background management terminal, and the cloud management and control platform is communicatively connected with the device performance detection module, the network performance detection module, the anomaly detection and evaluation module, the operation status comprehensive evaluation module and the background management terminal; Among them, the equipment performance detection module detects and analyzes the performance of the server, obtains the performance detection value through analysis, and sends the performance detection value to the operation status comprehensive evaluation module through the cloud management and control platform, which can reasonably analyze and feedback the operation performance of the server, and provide data support for the analysis process of the operation status comprehensive evaluation module to ensure the accuracy of its analysis results; the specific operation process of the equipment performance detection module is as follows: The CPU usage of the server and the percentage of memory occupied by processes or programs in the server are collected and marked as memory usage, the duration of the CPU usage exceeding a preset CPU usage threshold per unit time is marked as a CPU over-detection value, and the duration of the memory usage exceeding a preset memory usage threshold per unit time is marked as a memory over-detection value; The performance detection value is calculated by multiplying the CPU over-detection value and the memory over-detection value. The larger the performance detection value, the worse the current running performance of the server.

[0019] The network performance detection module detects and analyzes the network status of the server, obtains the network detection value through analysis, and sends the network detection value to the operation status comprehensive evaluation module through the cloud management and control platform. It can reasonably analyze and accurately feedback the network performance of the server, and provide data support for the analysis process of the operation status comprehensive evaluation module to ensure the accuracy of its analysis results; the specific operation process of the network performance detection module includes: Several detection periods are set within a unit of time, and the corresponding detection periods are marked as network abnormality periods or network normal periods through network detection, evaluation and analysis in different time periods. Specifically, the signal strength data, data transmission rate (i.e., the average of the uplink rate and the downlink rate), network delay data and packet loss rate data of the server in the corresponding detection period are collected; By formula The signal strength data WS, data transmission rate WP, network delay data WK and packet loss rate data WR are numerically calculated to obtain the network segment evaluation value WF; The larger the value of the network segment evaluation WF is, the worse the network performance of the server is during the corresponding detection period; Compare the network segment evaluation value with the preset network segment evaluation threshold. If the network segment evaluation value exceeds the preset network segment evaluation threshold, it indicates that the network performance of the server during the corresponding detection period is poor, and the corresponding detection period is marked as a network abnormality period; if the network segment evaluation value does not exceed the preset network segment evaluation threshold, it indicates that the network performance of the server during the corresponding detection period is good, and the corresponding detection period is marked as a network normal period; The number of network anomaly periods within a unit time is obtained and the ratio thereof is calculated with the total number of detection periods to obtain a network anomaly number detection value; and the number of network anomaly periods within the interval between two adjacent groups of network non-anomaly periods is marked as a network anomaly sustained detection value, and the number of network anomaly sustained detection values ​​exceeding a preset network anomaly sustained detection threshold is marked as a network anomaly high sustained value, the network anomaly high sustained value is calculated by ratio with the network anomaly sustained detection value, and the result is marked as a network anomaly sustained amplitude, and the network segment evaluation values ​​of all detection periods within a unit time are averaged to obtain a network inspection evaluation value; The network detection value XF is obtained by numerically calculating the network abnormality detection value HW, the network abnormality amplitude value HP and the network detection evaluation value HN through the formula XF=HN*(HW+HP); the larger the value of the network detection value XF is, the worse the network performance of the server is.

[0020] The anomaly detection and evaluation module performs an anomaly analysis on the server and obtains anomaly detection values, and sends the anomaly detection values ​​to the operation status comprehensive evaluation module through the cloud management and control platform. It can reasonably analyze and assist in feedback of the abnormal risk status of the server, and provide data support for the analysis process of the operation status comprehensive evaluation module, further ensuring the accuracy of its analysis results; the specific operation process of the anomaly detection and evaluation module is as follows: Through real-time abnormality capture and analysis, it is determined whether the server is in an abnormal operation state. Specifically, the real-time temperature data at several locations inside the server are collected, and the real-time temperature data at all locations are averaged to obtain the temperature detection value, and the noise decibel value and vibration amplitude generated when the server is running are collected; The transportation temperature detection value is calculated by ratio with the transportation temperature detection threshold to obtain the transportation temperature detection ratio; Calculate the ratio of the noise decibel value to the noise decibel threshold to obtain a noise decibel ratio; Calculate the ratio of the vibration amplitude to the vibration amplitude threshold to obtain the vibration amplitude ratio; The operation initial inspection value is obtained by summing up the operating temperature detection ratio, noise decibel ratio and vibration amplitude ratio and taking the average value; Moreover, the larger the value of the initial operation check value is, the greater the possibility that the operation of the server at the corresponding moment is abnormal; the initial operation check value is compared with the preset initial operation check threshold value, and if the initial operation check value exceeds the preset initial operation check threshold value, it indicates that the operation of the server at the corresponding moment is likely to be abnormal, and the server is judged to be in an abnormal operation state; The total time and the maximum duration of a single time that the server is in the abnormal table state per unit time are obtained and marked as the total abnormal table time value, and the ratio of the total abnormal table time value to the unit time is calculated to obtain the abnormal table time amplitude, and the operating power consumption value of the server per unit time is collected (that is, the ratio of the deviation value of the energy consumption data of the server during operation per unit time compared with its preset standard energy consumption data to the preset standard energy consumption data), and the intrusion attack risk detection value is retrieved from the cloud management and control platform; By formula The abnormal amplitude FM, the operating power consumption value FD and the intrusion attack risk detection value WX are numerically calculated to obtain the abnormal detection value XK; the larger the value of the abnormal detection value XK is, the more abnormal the operation of the server is, and the greater the abnormal risk is.

[0021] The operation status comprehensive evaluation module comprehensively judges the operation status of the server based on the performance detection value XP, the network detection value XF and the abnormal detection value XK, and generates an operation status excellent table signal or an operation status poor table signal, and sends the operation status excellent table signal or the operation status poor table signal to the background management end through the cloud management and control platform. When the background management end receives the operation status poor table signal, it will issue a corresponding warning, which can accurately evaluate the operation status of the server and feedback the warning in time, so as to remind the management personnel to make targeted and reasonable control measures, which is conducive to ensuring the safe, stable and efficient operation of the server, and has a high degree of intelligence; the specific analysis process of the operation status comprehensive evaluation module is as follows: The performance detection value XP, the network detection value XF and the anomaly detection value XK are obtained, and the performance detection value XP, the network detection value XF and the anomaly detection value XK are numerically compared with the preset performance detection threshold, the preset network detection threshold and the preset anomaly detection threshold, respectively. If the performance detection value XP, the network detection value XF or the anomaly detection value XK exceeds the corresponding preset threshold, it indicates that the overall operation status of the server is poor, and a poor operation status signal is generated; If the performance detection value XP, the network detection value XF and the abnormal detection value XK do not exceed the corresponding preset thresholds, the performance detection value XP, the network detection value XF and the abnormal detection value XK are weighted to obtain the operation status comprehensive evaluation value TX. The larger the value of the operation status comprehensive evaluation value TX is, the worse the operation status of the server is. In a specific embodiment, the weight ratio of the performance detection value XP is recorded as q1, the weight ratio of the network detection value XF is recorded as q2, and the weight ratio of the abnormality detection value XK is recorded as q3. The comprehensive evaluation value TX of the operating status is calculated by the formula TX=q1*XP+q2*XF+q3*XK, where T1=q1+q2+q3, and 0<q1<q2<q3.

[0022] The operating status comprehensive evaluation value TX is numerically compared with the preset operating status comprehensive evaluation threshold. If the operating status comprehensive evaluation value TX exceeds the preset operating status comprehensive evaluation threshold, it indicates that the operating status of the server is poor on the whole, and a poor operating status signal is generated; if the operating status comprehensive evaluation value TX does not exceed the preset operating status comprehensive evaluation threshold, it indicates that the operating status of the server is good on the whole, and a good operating status signal is generated.

[0023] Embodiment 2 like Figure 2As shown, the difference between this embodiment and embodiment 1 is that the cloud management and control platform is connected to the log scanning and analysis module in communication, and the log scanning and analysis module obtains all security log information of the server within a unit time, and judges whether there is an intrusion attack against the server within a unit time based on the security log information. If there is an intrusion attack against the server, the intrusion attack risk detection value is obtained through intrusion attack detection analysis, and the intrusion attack risk detection value is sent to the cloud management and control platform for storage, which can not only accurately feedback the intrusion risk status of the server, but also provide data support for the analysis process of the anomaly detection and evaluation module; the specific analysis process of the intrusion attack detection analysis is as follows: The total number of intrusion attack behaviors against the server in a unit time is obtained and marked as the intrusion attack count value, and the occurrence time and end time of the corresponding intrusion attack behavior are collected, and the interval between the end time and the occurrence time is marked as the intrusion attack duration, the intrusion attack duration is numerically compared with the preset intrusion attack duration threshold, and the number of intrusion attack durations exceeding the preset intrusion attack duration threshold is ratio-calculated with the intrusion attack count value to obtain the intrusion attack high percentage value; The intrusion attack durations of all units of time are summed up to obtain the intrusion time value, the intrusion time value is ratioed to the total duration of the unit time to obtain the intrusion attack condition value, and the intrusion attack high percentage value is multiplied by the intrusion attack condition value to obtain the intrusion attack risk check value; the larger the intrusion attack risk check value, the greater the risk of intrusion attack on the server.

[0024] Embodiment 3 like Figure 3 As shown, the difference between this embodiment and embodiment 1 and embodiment 2 is that the present invention proposes a server-based operation status detection method, comprising the following steps: Step 1: The device performance detection module detects and analyzes the performance of the server and obtains the performance detection value through analysis; Step 2: The network performance detection module detects and analyzes the network status of the server and obtains a network detection value through analysis; Step 3: The anomaly detection and evaluation module performs an anomaly analysis on the server and obtains an anomaly detection value; Step 4: The operation status comprehensive evaluation module comprehensively judges the operation status of the server based on the performance detection value, the network detection value and the abnormal detection value, and generates an operation status good table signal or an operation status bad table signal; Step 5: The operation status comprehensive evaluation module sends an excellent operation status signal or a poor operation status signal to the background management end, and the background management end issues a corresponding warning when receiving the poor operation status signal.

[0025] The working principle of the present invention is as follows: when in use, the performance of the server is detected and analyzed by the equipment performance detection module, and the performance detection value is obtained through analysis; the network performance detection module detects and analyzes the network status of the server, and the network detection value is obtained through analysis; the anomaly detection and evaluation module performs an anomaly analysis on the server and obtains an anomaly detection value, which can provide data support for the analysis process of the operation status comprehensive evaluation module to ensure the accuracy of its analysis results; the operation status comprehensive evaluation module comprehensively judges the operation status of the server based on the performance detection value, the network detection value and the anomaly detection value, and enables the background management end to issue a corresponding early warning when generating an operation status poor table signal, which can accurately evaluate the operation status of the server and provide timely feedback of the early warning, thereby reminding the management personnel to make targeted and reasonable control measures, which is conducive to ensuring the safe, stable and efficient operation of the server with a high degree of intelligence.

[0026] Embodiment 4 The embodiment of the present invention further provides an electronic device, such as Figure 4 As shown, it includes a processor 301, a communication interface 302, a memory 303 and a communication bus 304, wherein the processor 301, the communication interface 302, and the memory 303 communicate with each other through the communication bus 304. Memory 303, used for storing computer programs; The processor 301 is used to execute the program stored in the memory 303 to implement the following steps: Detect and analyze the performance of the server and obtain the performance detection value through analysis; Detect and analyze the network status of the server, and obtain the network detection value through analysis; Perform anomaly analysis on the server and obtain anomaly detection values; The process of obtaining anomaly detection values ​​is as follows: Through real-time anomaly capture and analysis, it is determined whether the server is in an abnormal state. The total duration and the maximum duration of a single abnormal state per unit time are obtained and marked as the total abnormal time value. The total abnormal time value is calculated by ratio with the duration per unit time to obtain the abnormal time amplitude. The running power consumption value of the server per unit time is collected, and the intrusion attack risk detection value is retrieved from the cloud management and control platform. The abnormal detection value is obtained by numerically calculating the abnormal time amplitude, running power consumption value and intrusion attack risk detection value. Among them, real-time temperature data at several locations inside the server are collected, and the real-time temperature data at all locations are averaged to obtain the operation temperature detection value, and the noise decibel value and vibration amplitude generated when the server is running are collected, and the operation temperature detection value, the noise decibel value and the vibration amplitude are numerically calculated to obtain the operation initial inspection value, and the operation initial inspection value is numerically compared with the preset operation initial inspection threshold value. If the operation initial inspection value exceeds the preset operation initial inspection threshold value, it is determined that the server is in an abnormal operation state; Comprehensively judge the operation status of the server based on the performance detection value, network detection value and abnormal detection value, and generate a good operation status signal or a bad operation status signal, and issue a corresponding warning according to the bad operation status signal; The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0027] The communication interface is used for communication between the above electronic device and other devices.

[0028] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0029] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0030] In another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, any of the above-mentioned server operation status monitoring methods is implemented.

[0031] In another embodiment of the present invention, a computer program product including instructions is provided. When the computer program product is executed on a computer, the computer executes any one of the server operation status monitoring methods in the above embodiments.

[0032] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0033] The above formulas are all dimensionless and numerical calculations. The formula is a formula obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formula are set by technicians in this field according to actual conditions. The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the contents of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that technicians in the relevant technical field can understand and use the present invention well. The present invention is only limited by the claims and their full scope and equivalents.

Claims

1. A method for monitoring server operation status, characterized in that: The steps include: Detect and analyze the performance of the server and obtain the performance detection value through analysis; Detect and analyze the network status of the server, and obtain the network detection value through analysis; Perform anomaly analysis on the server and obtain anomaly detection values; The process of obtaining anomaly detection values ​​is as follows: Through real-time anomaly capture and analysis, it is determined whether the server is in an abnormal state. The total duration and the maximum duration of a single abnormal state per unit time are obtained and marked as the total abnormal time value. The total abnormal time value is calculated by ratio with the duration per unit time to obtain the abnormal time amplitude. The running power consumption value of the server per unit time is collected, and the intrusion attack risk detection value is retrieved from the cloud management and control platform. The abnormal detection value is obtained by numerically calculating the abnormal time amplitude, running power consumption value and intrusion attack risk detection value. Among them, real-time temperature data at several locations inside the server are collected, and the real-time temperature data at all locations are averaged to obtain the operation temperature detection value, and the noise decibel value and vibration amplitude generated when the server is running are collected, and the operation temperature detection value, the noise decibel value and the vibration amplitude are numerically calculated to obtain the operation initial inspection value, and the operation initial inspection value is numerically compared with the preset operation initial inspection threshold value. If the operation initial inspection value exceeds the preset operation initial inspection threshold value, it is determined that the server is in an abnormal operation state; The server's operating status is comprehensively judged based on performance detection values, network detection values, and anomaly detection values, and an excellent operating status signal or a poor operating status signal is generated, and corresponding warnings are issued based on the poor operating status signal.

2. The server operation status monitoring method according to claim 1, characterized in that: The specific operation process of the equipment performance detection module includes: The CPU usage of the server and the percentage of memory occupied by processes or programs in the server are collected and marked as memory usage, the duration of the CPU usage exceeding a preset CPU usage threshold per unit time is marked as a CPU over-detection value, and the duration of the memory usage exceeding a preset memory usage threshold per unit time is marked as a memory over-detection value; The CPU over-detection value and the memory over-detection value are numerically calculated to obtain the performance detection value.

3. The server operation status monitoring method according to claim 1, characterized in that: The specific operation process of the network performance detection module includes: A number of detection periods are set within a unit time, and the corresponding detection period is marked as a network abnormality period or a network normal period through network time-division detection evaluation and analysis. The number of network abnormality periods within a unit time is obtained and the ratio is calculated with the total number of detection periods to obtain the network abnormality value; The number of network anomaly periods within the interval between two adjacent groups of network normal periods is marked as a network anomaly detection value, and the number of network anomaly detection values ​​exceeding a preset network anomaly detection threshold is marked as a network anomaly high detection value. The network anomaly high detection value is ratioed to the network anomaly detection value, and the result is marked as a network anomaly amplitude. The network segment evaluation values ​​of all detection periods within a unit time are averaged to obtain a network detection evaluation value. The network detection value is obtained by numerically calculating the network anomaly detection value, the network anomaly amplitude and the network detection evaluation value.

4. The server operation status monitoring method according to claim 3, characterized in that: The specific analysis process of network time-division detection, evaluation and analysis is as follows: The signal strength data, data transmission rate, network delay data and packet loss rate data of the server in the corresponding detection period are collected, and the network segment evaluation value is obtained by numerically calculating the signal strength data, data transmission rate, network delay data and packet loss rate data, and the network segment evaluation value is numerically compared with the preset network segment evaluation threshold value. If the network segment evaluation value exceeds the preset network segment evaluation threshold value, the corresponding detection period is marked as a network abnormality period; If the network segment evaluation value does not exceed the preset network segment evaluation threshold, the corresponding detection period will be marked as a network normal period.

5. The server operation status monitoring method according to claim 1, characterized in that: The specific analysis process of the operation status comprehensive evaluation module is as follows: Obtain the performance detection value, network detection value and anomaly detection value, compare the performance detection value, network detection value and anomaly detection value with the preset performance detection threshold, preset network detection threshold and preset anomaly detection threshold respectively, and generate a running status bad table signal if the performance detection value, network detection value or anomaly detection value exceeds the corresponding preset threshold; If the performance detection value, network detection value and anomaly detection value do not exceed the corresponding preset threshold value, the performance detection value, network detection value and anomaly detection value are numerically calculated to obtain a comprehensive evaluation value of the operation status, and the comprehensive evaluation value of the operation status is numerically compared with the preset comprehensive evaluation threshold of the operation status. If the comprehensive evaluation value of the operation status exceeds the preset comprehensive evaluation threshold of the operation status, a poor operation status signal is generated; If the comprehensive evaluation value of the operating status does not exceed the preset comprehensive evaluation threshold of the operating status, an operating status excellent meter signal is generated.

6. The server operation status monitoring method according to claim 5, characterized in that: The cloud management and control platform is communicated with the log scanning and analysis module. The log scanning and analysis module obtains all security log information of the server within a unit time, and judges whether there is an intrusion attack against the server within a unit time based on the security log information. If there is an intrusion attack against the server, the intrusion attack risk detection value is obtained through intrusion attack detection and analysis, and the intrusion attack risk detection value is sent to the cloud management and control platform for storage.

7. The server operation status monitoring method according to claim 6, characterized in that: The specific analysis process of intrusion attack detection analysis is as follows: The total number of intrusion attack behaviors against the server in a unit time is obtained and marked as the intrusion attack count value, and the occurrence time and end time of the corresponding intrusion attack behavior are collected, and the interval between the end time and the occurrence time is marked as the intrusion attack duration, the intrusion attack duration is numerically compared with the preset intrusion attack duration threshold, and the number of intrusion attack durations exceeding the preset intrusion attack duration threshold is ratio-calculated with the intrusion attack count value to obtain the intrusion attack high percentage value; The intrusion attack durations of all units of time are summed up to obtain the intrusion time value, the intrusion time value is ratioed to the total duration of the unit time to obtain the intrusion attack condition value, and the intrusion attack risk detection value is obtained by numerically calculating the intrusion attack high occupation value and the intrusion attack condition value.

8. The server-based operation status detection system is characterized by: include: Equipment performance detection module: The equipment performance detection module detects and analyzes the performance of the server, obtains the performance detection value through analysis, and sends the performance detection value to the operation status comprehensive evaluation module through the cloud management and control platform; The network performance detection module detects and analyzes the network status of the server, obtains the network detection value through analysis, and sends the network detection value to the operation status comprehensive evaluation module through the cloud management and control platform; Anomaly detection and evaluation module: The anomaly detection and evaluation module performs anomaly analysis on the server and obtains anomaly detection values, and sends the anomaly detection values ​​to the operation status comprehensive evaluation module via the cloud management and control platform; The process of obtaining anomaly detection values ​​is as follows: Through real-time anomaly capture and analysis, it is determined whether the server is in an abnormal state. The total duration and the maximum duration of a single abnormal state per unit time are obtained and marked as the total abnormal time value. The total abnormal time value is calculated by ratio with the duration per unit time to obtain the abnormal time amplitude. The running power consumption value of the server per unit time is collected, and the intrusion attack risk detection value is retrieved from the cloud management and control platform. The abnormal detection value is obtained by numerically calculating the abnormal time amplitude, running power consumption value and intrusion attack risk detection value. Among them, real-time temperature data at several locations inside the server are collected, and the real-time temperature data at all locations are averaged to obtain the operation temperature detection value, and the noise decibel value and vibration amplitude generated when the server is running are collected, and the operation temperature detection value, the noise decibel value and the vibration amplitude are numerically calculated to obtain the operation initial inspection value, and the operation initial inspection value is numerically compared with the preset operation initial inspection threshold value. If the operation initial inspection value exceeds the preset operation initial inspection threshold value, it is determined that the server is in an abnormal operation state; The operation status comprehensive evaluation module comprehensively judges the operation status of the server based on the performance detection value, network detection value and anomaly detection value, and generates an operation status excellent table signal or an operation status poor table signal, and sends the operation status excellent table signal or the operation status poor table signal to the background management end through the cloud management and control platform. When the background management end receives the operation status poor table signal, it will issue a corresponding warning.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method steps described in claims 1-8 when executing the program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in claims 1-8 are implemented.

Images