Network system state monitoring method, device and server

Abstract

According to the network system state monitoring method and device and the server disclosed by the invention, the abnormal operation state information exceeding the set range and the abnormal collection time point are screened out by collecting the operation state information of the current server according to the set time interval and performing data analysis; acquiring the change condition of the same type of abnormal operation state information at the front and back adjacent acquisition time points and other types of operation state information values at the abnormal acquisition time points; then, according to the abnormal operation state information, other types of operation state information values at the same acquisition time point and the change condition of the same type of abnormal operation state information at adjacent acquisition time points, predicting abnormal behavior attributes; and finally, selecting a corresponding coping strategy from the coping strategy library according to the abnormal behavior attribute and the overload range of the abnormal operation state information, and executing the corresponding coping strategy. And stable operation of a network system and timely identification and response to various abnormal conditions of sudden operation states are effectively guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a network system status monitoring method, device and server. Background Art

[0002] In the daily management and maintenance of network systems, it is crucial to ensure their stable operation and efficient performance. However, with the continuous expansion of network scale and the increasing diversification of service needs, servers may face various sudden abnormal operating conditions, such as memory leaks, CPU overloads, network congestion, etc. Traditional monitoring systems mostly rely on setting fixed thresholds for single parameters for monitoring. However, since the operating status of the network system is a multi-dimensional complex system, the threshold monitoring of a single parameter is difficult to fully and accurately reflect the overall performance and abnormal conditions of the system. This method lacks in-depth analysis and accurate identification of different abnormal behaviors, often leading to problems such as delayed response and high false alarm rate. Summary of the invention

[0003] In view of the deficiencies in the prior art, the present invention provides a method for monitoring the status of a network system, comprising the following steps: S1, collecting the operation status information of the current server at a set time interval, and obtaining a structured collection data set after cleaning and aggregating the collected information, wherein the operation status information includes memory occupancy rate, CPU usage rate and network traffic value with a timestamp; S2, performing data analysis on the collected data set, screening out abnormal operation status information and abnormal collection time points that exceed a set range, obtaining changes in the same type of abnormal operation status information at adjacent collection time points, and other types of operation status information values ​​at abnormal collection time points; S3, predicting abnormal behavior attributes based on the abnormal operation status information, other types of operation status information values ​​at the same collection time point, and changes in the same type of abnormal operation status information at adjacent collection time points, and selecting and executing corresponding response strategies in the response strategy library based on the abnormal behavior attributes and the overload range of the abnormal operation status information.

[0004] Preferably, the response strategy includes sending a warning notification, executing a corresponding preset automation script, distributing server load, setting traffic restrictions and restarting the server.

[0005] Preferably, step S3 specifically includes: if the CPU usage rate at a collection time point exceeds the usage rate threshold, and the memory occupancy rate at the collection time point or an adjacent subsequent collection time point also exceeds the occupancy rate threshold, then query the change of the network traffic value at the collection time point and the subsequent collection time points, if the corresponding network traffic value gradually decreases, it is judged as a memory overflow, and the memory sorting component is called to find objects or resources with low usage frequency and release them; if the CPU usage rate and memory occupancy rate still exceed the corresponding threshold and the network traffic value still gradually decreases at multiple subsequent collection time points, then send a load distribution request to other task servers and restart the server.

[0006] Preferably, the step S3 specifically includes: If the CPU usage at a collection time point exceeds the usage threshold, and the memory usage at the collection time point or the adjacent subsequent collection time points gradually increases, query the changes in the network traffic value at the collection time point and the subsequent collection time points; If the corresponding network traffic value changes within the corresponding reasonable value range, the attribute information of multiple task processes that occupy the top of the current CPU usage rate is obtained, the priority authority of the corresponding task process is queried according to the attribute information, and the task process whose priority authority is lower than the set value is terminated; If the corresponding network traffic value increases by more than the first threshold, the external network access request at the corresponding collection time point is obtained, and the addresses of multiple access requests with the top upload network traffic values ​​and the required upload data type are obtained. If the address is not in the trust list, a flow limit is set for it.

[0007] Preferably, the step S3 specifically includes: If the CPU usage, memory occupancy and network traffic values ​​at the same collection time point all exceed the corresponding thresholds, it is determined whether the current collection time is in the set working period. If it is in the set working period, the attribute information of multiple task processes that occupy the top of the current CPU usage is queried, and the priority of the corresponding task process is queried according to the attribute information, and the task process whose priority is lower than the set value is terminated; if it is not in the set working period, a flow limit is set for subsequent access requests.

[0008] The present invention also discloses a network system status monitoring device, comprising a data acquisition module, a data analysis module and a response module; wherein the data acquisition module is used to collect various operation status information of the current server at set time intervals, and obtain a structured collection data set after cleaning and aggregating the collected information, wherein the operation status information includes memory occupancy rate, CPU usage rate and network traffic value with timestamp; the data analysis module is used to perform data analysis on the collection data set, filter out abnormal operation status information and abnormal acquisition time points that exceed the set range, obtain the change of the same type of abnormal operation status information at the adjacent acquisition time points, and other types of operation status information values ​​at the abnormal acquisition time points; the response module is used to predict abnormal behavior attributes according to the abnormal operation status information, other types of operation status information values ​​at the same acquisition time points, and the change of the same type of abnormal operation status information at adjacent acquisition time points, and select and execute corresponding response strategies in the response strategy library according to the abnormal behavior attributes and the overload range of the abnormal operation status information.

[0009] Preferably, the response strategy includes sending a warning notification, executing a corresponding preset automation script, distributing server load, setting traffic restrictions and restarting the server.

[0010] Preferably, the response module is also configured to query the changes in network traffic values ​​at the collection time point and subsequent collection time points when the CPU usage rate at a collection time point exceeds the usage rate threshold and the memory usage rate at the collection time point or an adjacent subsequent collection time point also exceeds the usage rate threshold; if the corresponding network traffic value gradually decreases, it is judged as a memory overflow, and the memory sorting component is called to find objects or resources with lower usage frequency and release them; if the CPU usage rate and memory usage rate still exceed the corresponding threshold and the network traffic value still gradually decreases at multiple subsequent collection time points, a load distribution request is sent to other task servers and the server is restarted.

[0011] The present invention also discloses a server, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any of the aforementioned methods when executing the computer program.

[0012] The present invention also discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the aforementioned methods are implemented.

[0013] The network system status monitoring method, device and server disclosed in the present invention collect various operation status information of the current server at set time intervals, perform data analysis on the collected data set, screen out abnormal operation status information and abnormal collection time points beyond the set range, obtain the change of the same type of abnormal operation status information at the adjacent collection time points and other types of operation status information values ​​at the abnormal collection time points; then predict the abnormal behavior attributes according to the abnormal operation status information, other types of operation status information values ​​at the same collection time points, and the change of the same type of abnormal operation status information at adjacent collection time points, and finally select the corresponding response strategy from the response strategy library according to the abnormal behavior attributes and the overload range of the abnormal operation status information and execute it. It avoids the problems of response lag and high false alarm rate caused by the traditional threshold monitoring relying on a single parameter lacking accurate identification of different abnormal behaviors, thereby ensuring the stable operation of the network system and the timely identification and response to various sudden abnormal operation status situations.

[0014] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings described herein are used to provide further understanding of the present invention and constitute a part of this application. The illustrative embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0016] Figure 1 The present invention is a schematic diagram of the steps of a method for monitoring the status of a network system disclosed in an embodiment of the present invention.

[0017] Figure 2 This is a schematic diagram of a specific flow chart of step S3 disclosed in one embodiment of the present invention.

[0018] Figure 3 This is a schematic diagram of a specific flow chart of step S3 disclosed in another embodiment of the present invention.

[0019] Figure 4 The present invention is a schematic diagram of the structure of a network system status monitoring device disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiment of the present invention clearer, the technical solution of the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings of the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all of the embodiments. Based on the described embodiment of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] In the present invention, unless otherwise clearly specified and limited, the technical terms or scientific terms used herein shall have the common meanings understood by persons with ordinary skills in the field to which the present invention belongs. The words "first", "second" and similar words used in the patent application specification and claims of the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. Similarly, words such as "one" or "an" do not indicate a quantity limitation, but indicate the existence of at least one.

[0022] The present invention discloses a network system status monitoring method, such as Figure 1 As shown, the network system status monitoring method may specifically include the following steps.

[0023] Step S1, collecting the operation status information of the current server at a set time interval, and cleaning and aggregating the collected information to obtain a structured collection data set, wherein the operation status information includes memory occupancy, CPU usage and network traffic value with timestamp.

[0024] The CPU usage can be obtained by reading the relevant information of the operating system. The memory usage can be obtained through the Java OperatingSystemMXBean class, including the usage of physical memory and virtual memory. By obtaining the total physical memory size of the system and the current free physical memory size, the used memory is calculated by the difference and converted into a percentage display. The network traffic collection can be obtained by calling the network interface monitoring tool of the operating system.

[0025] The collected CPU usage, memory occupancy, and network traffic values ​​are cleaned, and the running status information at each time point after the cleaning process is converted to form a row and column data structure containing multiple data fields, wherein each type of running status information is assigned to a corresponding data field and the data is bucketed and aggregated according to the time series to obtain structured original collected data, wherein the data fields include CPU usage, memory occupancy, timestamp, network traffic value, which may specifically include the following contents.

[0026] Step S11, according to the type of the collected running status information, find the corresponding preset reasonable value range of information, compare the collected running status information at each time point with the preset reasonable value range of information of the corresponding type, and remove the information that exceeds the reasonable value range as an information error point. The reasonable value range of information with an upper limit and a lower limit can be preset for each running status information, i.e., CPU usage, memory occupancy, and network traffic value.

[0027] Step S12, according to the preset filling rules and the running status information of the adjacent time points, the missing values ​​of one or more types of running status information in some time points are supplemented, and the collected running status information is deduplicated through the unique identity information or timestamp. For missing data, the mean value can be used for filling. Different missing value supplement methods can also be set for different types of running status information, which can be the mean filling of a set number of time points before and after, or the maximum or minimum filling, etc.

[0028] Step S13, converting the processed running status information at each time point to form a row-column data structure containing multiple data fields, wherein each type of running status information is assigned to a corresponding data field, querying the preset aggregation rules for each type of running status information, and using the corresponding preset aggregation rules to bucket and aggregate each type of running status information according to the time series to obtain structured original collected data.

[0029] Step S2, performing data analysis on the collected data set, screening out abnormal operation status information and abnormal collection time points that exceed a set range, obtaining changes in the same type of abnormal operation status information at adjacent collection time points, and other types of operation status information values ​​at abnormal collection time points.

[0030] In this embodiment, step S2 may specifically include the following contents.

[0031] Step S21, using a standard score statistical method, according to the matching threshold of each type of running status information, detects abnormal data in the statistical distribution of each type of running status information in the original collected data, and obtains the corresponding abnormal running status information and the corresponding collection time point. In this embodiment, the abnormal points in the statistical distribution of each type of running status information are detected by using the Z-Score statistical method.

[0032] Specifically, the average value of CPU usage data at each collection time point can be calculated. and standard deviation . Calculate the Z-Score value Z of the running status information of this type at each acquisition time point i , , where X iis the CPU usage rate at the ith collection time point; then the preset matching threshold of the operation status information is obtained, and the data at the collection time point corresponding to the Z-Score value exceeding the matching threshold is judged as abnormal data, and the corresponding abnormal operation status information and the corresponding collection time point are obtained. Among them, if the abnormal operation status information and the abnormal collection time point that exceed the set range are screened out, the change of the same type of abnormal operation status information at the adjacent collection time points and other types of operation status information values ​​at the abnormal collection time point are continued to be obtained.

[0033] Step S32, analyze the operating status information of each time point in the original collected data, and use the historical values ​​of each type of operating status to calculate the linear regression model that matches the respective type of operating status information through the least squares method; use the linear regression model to predict the operating status prediction value of the subsequent time period according to the historical values ​​of the corresponding type of operating status information, wherein each type of operating status information includes CPU usage, memory occupancy or network traffic value.

[0034] In this embodiment, a continuous target variable is predicted by using a linear regression model. The trend is determined by finding the linear relationship between the input variable and the output variable. In a linear regression model, the goal is to find the most suitable straight line to fit the given input data, so as to accurately predict the trend.

[0035] In this embodiment, the target variable y is set to have a linear relationship with the input feature x, that is, , we need to find the values ​​of β0 and β1 so that the model predicts Minimize the error between the predicted value and the actual value of y. The loss function used is the least squares method, which minimizes the sum of the squared errors between the predicted value and the true value: ; where n is the number of data points and y is the true value of the ith data point; the predicted value of the ith data point is: .

[0036] By minimizing the above loss function, we can directly solve the parameters of linear regression through the following formula: ; where β0 is the slope and β1 is the intercept.

[0037] Finally, a linear model is constructed to predict the trend of the corresponding type of operating status information at several future time points.

[0038] Step S3, predicting abnormal behavior attributes based on the abnormal operation status information, other types of operation status information values ​​at the same collection time point, and changes in the same type of abnormal operation status information at adjacent collection time points, and selecting and executing corresponding response strategies in the response strategy library based on the abnormal behavior attributes and the overload range of the abnormal operation status information. The response strategies may include sending warning notifications, executing corresponding preset automation scripts, distributing server loads, setting traffic restrictions, and restarting servers.

[0039] In this embodiment, if Figure 2 As shown, step S3 may specifically include the following contents.

[0040] Step S101, if the CPU usage at a collection time point exceeds the usage threshold, and the memory usage at the collection time point or an adjacent subsequent collection time point also exceeds the usage threshold, query the network traffic value change at the collection time point and the subsequent collection time points.

[0041] Step S102: If the corresponding network traffic value gradually decreases, it is determined to be a memory overflow, and a memory arrangement component is called to find objects or resources with a lower usage frequency and release them.

[0042] Step S103: If the CPU usage and memory occupancy still exceed the corresponding thresholds and the network traffic value still gradually decreases during the subsequent multiple collection time points, a load distribution request is sent to other task servers and then the server is restarted.

[0043] In this embodiment, if Figure 3 As shown, step S3 may also be specifically as follows.

[0044] Step S201, if the CPU usage at a collection time point exceeds the usage threshold, and the memory occupancy at the collection time point or an adjacent subsequent collection time point gradually increases, query the change of the network traffic value at the collection time point and the subsequent collection time points.

[0045] Step S202, if the corresponding network traffic value changes within the corresponding reasonable value range, obtain the attribute information of multiple task processes that occupy the top of the current CPU usage, query the priority of the corresponding task process based on the attribute information, and terminate the task process whose priority is lower than the set value.

[0046] Step S203, if the corresponding network traffic value increases by more than the first threshold, obtain the external network access request at the corresponding collection time point, obtain the addresses of multiple access requests with the top upload network traffic values ​​and the required upload data type, and if the address is not in the trust list, set a flow limit for it.

[0047] In this embodiment, step S3 may also include: if the CPU usage rate, memory occupancy rate and network traffic value at the same collection time point all exceed the corresponding threshold value, then determine whether the current collection time is in the set working period; if it is in the set working period, query the attribute information of multiple task processes that occupy the top of the current CPU usage rate, query the priority of the corresponding task process according to the attribute information, and terminate the task process whose priority is lower than the set value; if it is not in the set working period, set a flow limit for subsequent access requests.

[0048] In this embodiment, the operation status information of each time point in the original collected data can also be analyzed, and the historical values ​​of each type of operation status can be used to calculate the linear regression model matching the respective types of operation status information by the least square method; the linear regression model is used to predict the operation status prediction value of the subsequent time period according to the historical values ​​of the corresponding type of operation status information, wherein each type of operation status information includes CPU usage, memory occupancy or network traffic value. Specifically, the continuous target variable is predicted by using the linear regression model. And the trend is judged by finding the linear relationship between the input variable and the output variable.

[0049] Taking the CPU usage rate as an example, the system load can be effectively reduced and the system operation can be ensured to be stable by properly configuring the server load distribution strategy. Specifically, according to the CPU usage rate collected at each historical time point, the preset trend judgment model is adjusted, and the adjusted trend judgment model is used to predict the CPU predicted usage rate at subsequent time points. If the CPU predicted usage rate is greater than the first threshold, other task servers that can accept load distribution are queried.

[0050] Determine whether the time point when the CPU predicted usage rate is greater than the first threshold is within the set working period. If it is not within the set working period, no load distribution is performed and a current limiting setting is performed on the access request made at the subsequent corresponding time point. If it is within the set working period, query other task servers that can accept load distribution. If it is not within the set working period, no load distribution is performed, and a current limiting setting is performed on the access request made between the subsequent corresponding time points and a monitoring task is added, and the monitoring task is configured to obtain the access request permission that triggers the current limiting operation.

[0051] If the access request permission is higher than the set value, the current limiting operation is closed, and when the CPU usage of the current server being accessed exceeds the second threshold, the current CPU usage and load prediction table of the remaining task servers are queried, and the task server whose current CPU usage and the CPU prediction usage in the subsequent set time period are both lower than the first threshold is used as the target server. The load distribution ratio is determined based on the average value of the current CPU usage of each target server and the CPU prediction usage in the subsequent set time period, and the traffic is distributed to different target servers according to the load distribution ratio.

[0052] In this embodiment, the load prediction table of each task server can also be queried, and the load prediction table records the CPU prediction usage rate of each server in the subsequent set time period, and the load distribution ratio is determined according to the different CPU prediction usage rates of each task server at the corresponding time, and the load distribution task reservation is sent to the corresponding task server; the task server updates its load prediction table after receiving the load distribution task reservation. Among them, this step can specifically include the following content.

[0053] The load prediction table of each task server is queried, and the load prediction table records the CPU prediction usage rate of the server in a subsequent set time period, wherein the CPU prediction usage rate is composed of the task prediction usage rate of the server and the received load distribution task prediction usage rate.

[0054] Obtain the duration of the load to be distributed and the predicted CPU usage of each task server at each time point in the duration, and take the maximum value of the predicted CPU usage at each time point in the duration as the predicted CPU usage of the server in this time period.

[0055] The load distribution ratio is determined based on the CPU predicted usage rate of each task server in this time period, and a load distribution task reservation is generated and sent to the corresponding task server; after receiving the load distribution task reservation, each task server generates the corresponding load distribution task predicted usage rate and adds it to the load prediction table. After reaching the corresponding time point, the corresponding number of access requests are distributed to each task server according to the load distribution ratio.

[0056] In this embodiment, the network system status monitoring method may also include the following contents: collecting operation feedback information of the device operating system after executing the response strategy, comparing the operation feedback information with the operation status information before the response strategy is executed, judging the optimization status of each status indicator and calculating the current execution strategy effect value, and sorting the effectiveness of each response strategy in the response strategy library according to the execution strategy effect value.

[0057] In this embodiment, the monitoring method for stable operation of the system may also include updating the response strategy according to the effectiveness of the execution strategy effect. The strategy update is to adjust the future decision of the system based on the reward value. In reinforcement learning, this process can use Q-learning strategy optimization algorithm or other strategy optimization algorithms. The system continuously optimizes its action strategy by comparing the effects of different strategies, so that the system can take better decisions in similar situations in the future.

[0058] The specific Q-learning algorithm aims to optimize decision-making through continuous interaction and learning environment feedback. The quality Q(s,a) of each state-action pair (s,a) is learned by updating the Q value, that is, the expected benefit of choosing an action in a specific state. The specific algorithm is as follows: ; where Q value represents the long-term benefit estimate of taking action a in the current state s. Initially, all Q(s,a) can be set to any value, usually set to 0, indicating no experience; then gradually learned and updated through the training process. If Q(s,a) is high, it means that taking action a is a good choice in state s. The learning rate α controls the degree of influence of new information on the old Q value, and the value is between 0 and 1. It is preset. If the α value is too large, the system will be highly sensitive to new experience; if the α value is too small, the system will update the Q value very slowly. Typical values ​​are 0.1, 0.01, etc. Larger values ​​mean that the system updates quickly to adapt to new changes, while smaller values ​​make the system more robust and will not cause policy instability due to accidental events. Instant reward R, the instant feedback reward obtained after taking action a in state s. The instant reward is pre-defined by the system and reflects the quality of the action effect. For example, in a monitoring system, if the action taken successfully reduces CPU usage or network traffic, the reward R can be a positive value; if the action increases the system load, the reward R is a negative value. Rewards directly affect the adjustment of strategies. Positive rewards encourage the same actions, while negative rewards prompt the system to explore other possible actions. The discount factor γ determines the importance the system places on future rewards, and this value can be preset between 0 and 1. Typical values ​​of γ are usually 0.9, 0.95, etc., indicating that the system attaches more importance to long-term benefits, but still considers recent rewards. maxa′Q(s′,a′) indicates the maximum Q value that can be obtained by the optimal action selected by the system in the new state s′ after the system transfers to the new state s′ after executing action a. By finding the Q values ​​of all possible actions in state s′, the maximum value is taken. This step indicates that the system will choose the optimal strategy in the future.

[0059] In a specific embodiment, the policy update process can be divided into the following steps: Step S301, initialize the Q value; initialize a Q value for each state s and each action a, usually set to 0, indicating that the expected benefits of each action are unknown at the beginning, that is, .

[0060] Step S302: Select an action to explore and exploit. In state s, the system selects action a according to the current Q value. This step is usually implemented through a greedy strategy: randomly select an action to explore with probability ϵ to avoid local optimality. Select the action with the largest current Q value, that is, select the optimal action to use; .

[0061] Step S303, execute the action, observe the reward and the new state. The system executes action a in state s and obtains the immediate reward R and the new state s′ after the transfer.

[0062] Step S304, update the Q value. Update the Q value according to the Q-learning formula: Here, the updated Q value is the new policy basis of the system. In the same state s, the system may choose a different action a next time to obtain a higher Q value.

[0063] Step S305, perform an iterative operation. Repeat the above process until the system learns a stable strategy, that is, the optimal action can be selected in each state. This process enables the system to gradually improve the effectiveness of the strategy by repeatedly updating the Q value.

[0064] In this embodiment, the CPU usage rate is taken as an example for explanation, and other operating status information such as memory occupancy rate and network traffic value can also be processed in the same manner.

[0065] For example, the management system is deployed on a server, the state s represents the current CPU usage, and the action a represents the response measures taken, such as load balancing or script optimization. Through Q-learning, we can learn how to take the best response measures under different CPU usage.

[0066] At the initial moment, state s is 80% CPU usage. Optional actions a include: load balancing action 1, optimization script action 2. Immediately take the reward R=30 for load balancing, and the reward R=20 for optimization script. Assume the current Q value: Q(s,a1)=10, Q(s,a2)=5. Learning rate α=0.1, discount factor γ=0.9. The next optimal Q value maxa′Q(s′,a′)=50.

[0067] Select an action. Assuming that the system adopts a greedy strategy, the current Q value shows that load balancing has a higher Q value, so the system chooses action 1, which is load balancing.

[0068] Perform load balancing and observe the reward. After the system performs load balancing, the CPU usage decreases, the system receives a reward R=30, and moves to the new state s′.

[0069] Update the Q value. According to the Q-learning formula, update the Q value: The updated Q value is 16.5, which means that the long-term expected benefit of performing load balancing is improved when the CPU utilization rate is 80%.

[0070] The strategy is updated, and the Q value of the system has been updated. The next time the system encounters the same state again, the Q value of performing load balancing will be higher, and the system will be more inclined to choose load balancing as the priority strategy. Eventually, by repeating this feedback learning process, the system gradually learns how to choose the best action in different states to maximize long-term benefits.

[0071] In another embodiment, if Figure 4 As shown, a network system status monitoring device is also disclosed, including a data acquisition module 1, a data analysis module 2 and a response module 3. The data acquisition module 1 is used to collect the operation status information of the current server at a set time interval, and after cleaning and gathering the collected information, a structured collection data set is obtained, and the operation status information includes memory occupancy rate, CPU usage rate and network traffic value with a timestamp. The data analysis module 2 is used to perform data analysis on the collection data set, filter out abnormal operation status information and abnormal collection time points that exceed the set range, and obtain the changes of the same type of abnormal operation status information at the adjacent collection time points, as well as other types of operation status information values ​​at the abnormal collection time points. The response module 3 is used to predict abnormal behavior attributes according to the abnormal operation status information, other types of operation status information values ​​at the same collection time point, and the changes of the same type of abnormal operation status information at adjacent collection time points, and select and execute corresponding response strategies in the response strategy library according to the abnormal behavior attributes and the overload range of the abnormal operation status information. The response strategies include sending warning notifications, executing corresponding preset automation scripts, distributing server loads, setting traffic restrictions and restarting servers.

[0072] In this embodiment, the response module is also configured to query the changes in network traffic values ​​at the collection time point and subsequent collection time points when the CPU usage rate at a collection time point exceeds the usage rate threshold and the memory usage rate at the collection time point or an adjacent subsequent collection time point also exceeds the usage rate threshold. If the corresponding network traffic value gradually decreases, it is judged as a memory overflow, and the memory sorting component is called to find objects or resources with lower usage frequency and release them; if the CPU usage rate and memory usage rate still exceed the corresponding threshold and the network traffic value still gradually decreases at multiple subsequent collection time points, a load distribution request is sent to other task servers and the server is restarted.

[0073] The specific functions of the above-mentioned network system status monitoring device correspond to the network system status monitoring method disclosed in the previous embodiment, so it will not be described in detail here. For details, please refer to the various embodiments of the network system status monitoring method disclosed in the previous embodiment. It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other.

[0074] In some other embodiments, a server is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the network system status monitoring method described in the above embodiments when executing the computer program. The server for network system status monitoring may include but is not limited to a processor and a memory.

[0075] If the network system status monitoring method is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device that can carry the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory, random access memory, electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

[0077] In conclusion, the above is only a preferred embodiment of the present invention, and all equivalent changes and modifications made according to the scope of the patent application of the present invention should fall within the scope of the patent of the present invention.

Claims

1. A network system status monitoring method, characterized in that: The steps include: S1, collecting the operation status information of the current server at a set time interval, and obtaining a structured collection data set after cleaning and aggregating the collected information, wherein the operation status information includes memory occupancy rate, CPU usage rate and network traffic value with a timestamp; S2, performing data analysis on the collected data set, screening out abnormal operation status information and abnormal collection time points that exceed a set range, obtaining changes in the same type of abnormal operation status information at adjacent collection time points, and other types of operation status information values ​​at abnormal collection time points; S3, predicting abnormal behavior attributes based on the abnormal operation status information, other types of operation status information values ​​at the same collection time point, and changes in the same type of abnormal operation status information at adjacent collection time points, and selecting and executing corresponding response strategies in the response strategy library based on the abnormal behavior attributes and the overload range of the abnormal operation status information.

2. The network system status monitoring method according to claim 1, characterized in that: The response strategy includes sending warning notifications, executing corresponding preset automation scripts, distributing server loads, setting traffic restrictions, and restarting servers.

3. The network system status monitoring method according to claim 2, characterized in that: The step S3 specifically includes: If the CPU usage at a collection time point exceeds the usage threshold, and the memory usage at the collection time point or the adjacent subsequent collection time point also exceeds the usage threshold, the network traffic value change at the collection time point and the subsequent collection time points is queried. If the corresponding network traffic value gradually decreases, it is judged as a memory overflow, and the memory cleaning component is called to find objects or resources with low usage frequency and release them; If the CPU usage and memory occupancy still exceed the corresponding thresholds and the network traffic value still gradually decreases during the subsequent multiple collection time points, a load distribution request is sent to other task servers and the server is restarted.

4. The network system status monitoring method according to claim 3, characterized in that: The step S3 specifically includes: If the CPU usage at a collection time point exceeds the usage threshold, and the memory usage at the collection time point or the adjacent subsequent collection time points gradually increases, query the changes in the network traffic value at the collection time point and the subsequent collection time points; If the corresponding network traffic value changes within the corresponding reasonable value range, the attribute information of multiple task processes that occupy the top of the current CPU usage rate is obtained, the priority authority of the corresponding task process is queried according to the attribute information, and the task process whose priority authority is lower than the set value is terminated; If the corresponding network traffic value increases by more than the first threshold, the external network access request at the corresponding collection time point is obtained, and the addresses of multiple access requests with the top upload network traffic values ​​and the required upload data type are obtained. If the address is not in the trust list, a flow limit is set for it.

5. The network system status monitoring method according to claim 4, characterized in that: The step S3 specifically includes: If the CPU usage, memory occupancy and network traffic values ​​at the same collection time point all exceed the corresponding thresholds, it is determined whether the current collection time is in the set working period. If it is in the set working period, the attribute information of multiple task processes that occupy the top of the current CPU usage is queried, and the priority of the corresponding task process is queried according to the attribute information, and the task process whose priority is lower than the set value is terminated; if it is not in the set working period, a flow limit is set for subsequent access requests.

6. A network system status monitoring device, characterized in that: include: The data collection module is used to collect the operation status information of the current server at a set time interval, and obtain a structured collection data set after cleaning and aggregating the collected information. The operation status information includes memory occupancy rate, CPU usage rate and network traffic value with timestamp; A data analysis module is used to analyze the collected data set, filter out abnormal operation status information and abnormal collection time points that exceed a set range, obtain changes in the same type of abnormal operation status information at adjacent collection time points, and other types of operation status information values ​​at abnormal collection time points; A response module is used to predict abnormal behavior attributes based on the abnormal operating status information, other types of operating status information values ​​at the same collection time point, and changes in the same type of abnormal operating status information at adjacent collection time points, and select and execute corresponding response strategies from a response strategy library based on the abnormal behavior attributes and the overload range of the abnormal operating status information.

7. The network system status monitoring device according to claim 6, characterized in that: The response strategy includes sending warning notifications, executing corresponding preset automation scripts, distributing server loads, setting traffic restrictions, and restarting servers.

8. The network system status monitoring device according to claim 7, characterized in that: The response module is also configured to query the changes in network traffic values ​​at the collection time point and subsequent collection time points when the CPU usage rate at a collection time point exceeds the usage rate threshold and the memory usage rate at the collection time point or an adjacent subsequent collection time point also exceeds the usage rate threshold; if the corresponding network traffic value gradually decreases, it is judged as a memory overflow, and the memory sorting component is called to find objects or resources with low usage frequency and release them; if the CPU usage rate and memory usage rate still exceed the corresponding threshold and the network traffic value still gradually decreases at multiple subsequent collection time points, a load distribution request is sent to other task servers and the server is restarted.

9. A server comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images