Database intelligent operation and maintenance diagnosis tree method and system based on multi-dimensional indexes

Abstract

According to the database intelligent operation and maintenance diagnosis tree method and system based on the multi-dimensional indexes, the range of a root cause candidate set can be gradually narrowed by the system, then the ranking results of possibility scores and variable quantity proportions are calculated respectively, and the ranks of the two ranking results are added to obtain a new ranking score; and according to the ranking score, the results are sorted again, and the root cause with the maximum possibility is output. Through the intelligent diagnosis tree module, high-level performance anomalies can be gradually decomposed to a specific fine-grained operation level, the accuracy and speed of anomaly diagnosis are greatly improved through hierarchical fault positioning, and the workload of invalid data search is reduced. And meanwhile, a possibility score PS is proposed to quantify the possibility of the root cause candidate set, and the current state and the historical normal state of the database are compared, so that the range of the root cause set is further narrowed. The system can automatically evaluate the possibility of abnormity caused by each root cause candidate set, and provides an objective basis.

Description

Technical Field

[0001] The present invention relates to a database intelligent operation and maintenance diagnosis tree method and system based on multi-dimensional indicators, belonging to the field of database intelligent operation and maintenance. Background Art

[0002] With the rapid development of information technology, the business systems of enterprises have become increasingly complex, making it impossible for traditional operation and maintenance management methods to meet the high demands of enterprises for efficiency, intelligence, etc. In order to meet the diverse business needs, new intelligent operation and maintenance diagnosis methods continue to emerge and are applied to the complex database systems of enterprises.

[0003] In the database operation and maintenance system, there are many complex data types such as alarms, performance indicators, logs, etc., which require real-time collection and processing of these data. Due to the complex relationships between these data, operation and maintenance managers must have extensive domain knowledge, which further increases the difficulty of operation and maintenance analysis.

[0004] Traditional operation and maintenance methods rely on the monitoring and troubleshooting of operation and maintenance personnel, which has high labor and time costs, and low operation and maintenance accuracy, and cannot meet the requirements of enterprises for business continuity and high availability. At the same time, when faced with sudden system failures and performance bottlenecks, the speed of manual intervention is far slower than that of the automatic operation and maintenance system. Through real-time monitoring and automatic fault diagnosis of the database intelligent operation and maintenance system, timely solutions can be taken when problems occur, reducing the economic losses caused by database system failures.

[0005] The intelligent operation and maintenance diagnosis method analyzes the performance indicator data generated in the same time period to find the root cause of the abnormal indicators in response to various operation and maintenance needs that need to be dealt with in the database system. The root cause analysis of database indicator abnormalities needs to be analyzed from multiple dimensions. Different combinations of indicator items affect each other, and no quantitative judgment is made on the root cause of the indicator, which brings challenges to finding the root cause indicator items that cause the abnormal indicators. On the other hand, the database indicators are complex, the indicators have multi-dimensional attributes, and the number of indicator items is large, which will cause the root cause analysis operation to search from thousands of multi-dimensional attribute spaces. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1 It is the system flow chart. Summary of the invention

[0007] In view of the problems existing in the above existing database operation and maintenance methods, this application proposes a database intelligent operation and maintenance diagnosis tree method based on multi-dimensional indicators, which includes the following steps:

[0008] (1) Collect and process multi-dimensional data when the database is running, build an expert knowledge base, and collect and analyze historical data;

[0009] (2) Detect anomalies in query delays and IO operation waiting times during database operation;

[0010] (3) Identify the source of anomalies in the database system by constructing a set of root cause candidates, alarm event association, and root cause diagnosis;

[0011] (4) Store and manage historical alarms and root cause analysis results, support rapid root cause inference of alarms, and continuously optimize the system through dynamic learning;

[0012] Among them, step (3) uses the possibility score PS to measure the possibility score of the candidate set of database anomaly root causes, and uses the change ratio VP model to focus on locating the root causes with a high change ratio through the impact measurement of time series data changes and the false positive rate control mechanism.

[0013] Furthermore, step (3) specifically includes:

[0014] 3.1 Construct a set of root cause candidates;

[0015] 3.2 Associated alarm events;

[0016] 3.3 Diagnose the root cause and calculate the likelihood score The value range of PS is 0 to 1. For vector and The distance v i and f i Represents vectors and Component index of ; is the current state of the database, is the normal behavior predicted by the system, Behaviors that are caused by some combination of features in the root cause candidate set.

[0017] 3.4 Calculate the combination x in the time period (T 0 ,T 1 ) Among them, value(x,T 0 )、value(x,T 1 ) are respectively the combination x in T 0 and T 1 The value corresponding to the indicator at the time, value(*,T 0 )、value(*,T 1 ) are the overall indicators * in T 0 and T 1 The value of the moment.

[0018] Based on the above method, the present application further proposes a database intelligent operation and maintenance diagnosis tree system based on multi-dimensional indicators, the system comprising:

[0019] (1) Diagnostic tree basic module: This module is responsible for multi-dimensional data collection and processing during database operation, the construction of the expert knowledge base, and the collection and analysis of historical data;

[0020] (2) Anomaly detection module: This module detects anomalies in query delays and IO operation waiting times during database operation;

[0021] (3) Intelligent operation and maintenance diagnosis tree construction module: This module identifies the source of anomalies in the database system by constructing a set of root cause candidates, alarm event association, and root cause diagnosis;

[0022] (4) Knowledge base learning module: This module stores and manages historical alarms and root cause analysis results, supports rapid root cause inference of alarms, and continuously optimizes the system through dynamic learning;

[0023] Among them, the intelligent operation and maintenance diagnosis tree construction module uses the possibility score PS to measure the possibility score of the candidate set of database anomaly root causes, and uses the change proportion VP model to focus on locating the root causes with a high change proportion through the impact measurement of time series data changes and the misjudgment rate control mechanism.

[0024] Furthermore, the intelligent operation and maintenance diagnosis tree construction module includes the following steps:

[0025] 3.1 Construct a set of root cause candidates;

[0026] 3.2 Associated alarm events;

[0027] 3.3 Diagnose the root cause and calculate the likelihood score The value range of PS is 0 to 1. For vector and The distance v i and f i Represents vectors and Component index of ; is the current state of the database, is the normal behavior predicted by the system, Behaviors that are caused by some combination of features in the root cause candidate set.

[0028] 3.4 Calculate the combination x in the time period (T 0 ,T 1 ) Among them, value(x,T 0 )、value(x,T1 ) are respectively the combination x in T 0 and T 1 The value corresponding to the indicator at the time, value(*,T 0 )、value(*,T 1 ) are the overall indicators * in T 0 and T 1 The value of the moment.

[0029] By comparing the current state of the database with the system's predicted state and the feature combination of the root cause candidate set to track the source of the anomaly, the system can quickly locate the potential root cause combination, thereby shortening the troubleshooting time. and The distance formula is It helps to more accurately capture subtle changes in the database's operating status and is very effective in detecting some complex and subtle abnormal features in the operation and maintenance system.

[0030] The present invention solves the problems of low efficiency, over-reliance on manual experience, and the need to manually screen and analyze a large amount of operation data in traditional operation and maintenance. Compared with traditional operation and maintenance methods, it improves the automation and accuracy of root cause analysis, reduces manual workload, and improves the efficiency and reliability of database operation and maintenance. After adopting the present invention, the system can gradually narrow the scope of the root cause candidate set, and then calculate the ranking results of the possibility score and the proportion of the change respectively, and add the rankings of the two ranking results to obtain a new ranking score. The results are re-sorted according to the ranking score and the most likely root cause is output. Through the intelligent diagnosis tree module, high-level performance anomalies can be gradually decomposed into specific fine-grained operation levels. This hierarchical fault location greatly improves the accuracy and speed of abnormal diagnosis and reduces the workload of invalid data search. At the same time, the possibility score PS is proposed to quantify the possibility of the root cause candidate set, and the current state of the database is compared with the historical normal state, so as to further narrow the scope of the root cause set. The system can automatically evaluate the possibility of each root cause candidate set causing anomalies and provide objective basis. DETAILED DESCRIPTION

[0031] In response to the problems existing in the above existing operation and maintenance methods, this application proposes a database intelligent operation and maintenance diagnostic tree method based on multi-dimensional indicators. Through the diagnostic tree basic module, multi-dimensional data collection and the construction of an expert experience knowledge base are realized to pave the way for root cause analysis. On the other hand, the core module of this application, the intelligent diagnostic tree module, will analyze performance anomalies in layers, build a set of root cause candidates, and use the Monte Carlo search algorithm to analyze the root cause combination, and sort the root causes by combining the possibility score and the proportion of the change, and finally realize the operation and maintenance diagnosis of database abnormality indicators with multi-dimensional indicators. The system flow chart is as follows Figure 1 shown.

[0032] 1. Diagnostic tree basic module: This module is the core basic part of the intelligent diagnostic tree, responsible for multi-dimensional data collection and processing during database operation, building an expert knowledge base, and collecting and analyzing historical data. This module monitors data in real time and provides a solid decision-making basis for the overall system based on the abnormal judgment and trend analysis capabilities of historical data. The core functions include:

[0033] Multi-dimensional data collection: covers alarm data, performance indicators (such as query latency, IO wait time, resource utilization), business operation logs, database transaction information and other multi-dimensional data to ensure comprehensive monitoring of the system.

[0034] Expert experience knowledge base: Establish and continuously update a knowledge base based on domain expert experience to supplement and optimize the system's automatic analysis capabilities.

[0035] Historical data analysis: Collect and analyze the system's historical operating data to establish a baseline model. Compare historical data with the current status to determine the severity of the anomaly and its evolution trend.

[0036] 2. Anomaly detection module: This module is designed to perform intelligent anomaly detection on key indicators in database operation (such as query latency, IO operation waiting time, etc.).

[0037] Pre-detection process: The points to be detected first enter the pre-detection process, and the time series feature similarity model is used to intercept most normal points. If the pre-detection process determines that it is abnormal, it enters the next step of feature extraction and classification.

[0038] Feature extraction and classification: When pre-detecting anomalies, extract the multi-dimensional features of the alarm data, use machine learning algorithms to classify, record the impact of each dimensional feature on the indicator anomaly, generate a dimensional importance ranking, and feed back the classification results to the sample set.

[0039] 3. Intelligent diagnostic tree construction module:

[0040] When the system detects a high-level performance anomaly, the diagnostic tree module will automatically decompose the anomaly downward and analyze the fine-grained operations of the system layer by layer. Through hierarchical analysis of anomalies, the system can quickly narrow the scope of the fault and avoid ineffective searches in large amounts of operational data.

[0041] The design process of this module revolves around the cross-analysis of multi-dimensional indicators, and through the intelligent diagnosis tree, it goes deeper layer by layer to achieve a comprehensive and systematic diagnosis of database anomalies. The core process is as follows:

[0042] (1) Constructing a root cause candidate set: In a database environment, the root cause candidate set is the basis of the diagnostic tree analysis. This set is constructed by combining multiple dimensions, and the potential root causes are identified by cross-analyzing the combination of these dimensions. The system can generate a potential root cause candidate set to provide a basis for subsequent anomaly location.

[0043] (2) Alarm event association: When a performance indicator is abnormal, the system triggers an alarm event, which serves as a start signal for the diagnostic tree, guiding operation and maintenance personnel or automated tools to further track down the root cause of the abnormality.

[0044] (3) Root cause diagnosis: Compare the currently observed database status with the historical normal status to further narrow the root cause candidate set and determine the most likely source of the anomaly through quantitative analysis. This step includes the following:

[0045] The probability score PS is used to measure the probability score of a candidate set of root causes of a database anomaly. The higher the score, the greater the probability that the root cause set will cause anomalies (such as performance bottlenecks or query failures). By comparing the observed state of the current database operation with the predicted value and the behavioral characteristics of the candidate root causes, we can quantify which root cause set is most likely to be the source of the problem. The calculation formula is as follows:

[0046]

[0047] The value range of PS is 0 to 1.

[0048] Representation vector and The distance is calculated as where v i and f i Represents vectors and The component index of . Represents the current state of the database. represents the normal behavior predicted by the system, It is a behavior caused by a combination of certain features in the root cause candidate set.

[0049] On the other hand, considering that database indicator data is usually time series data, this application will use the percentage of change to describe a certain time period (T 0 ,T 1), the proportion of the change in a certain attribute combination x in the overall indicator change in the period (T), and pay attention to the root causes of the high proportion of changes. In actual scenarios, the database may experience small fluctuations, which are often not significant, but may trigger unnecessary alarms. In order to prevent the slight fluctuations of attribute combinations with small initial values ​​in subsequent time periods from being misjudged as major changes and reduce the misjudgment rate, this application combines x in the time period (T 0 ,T 1 ) can be defined as:

[0050]

[0051] Among them, value(x,T 0 )、value(x,T 1 ) respectively represent the combination x in T 0 and T 1 The value corresponding to the indicator at the time, value(*,T 0 )、value(*,T 1 ) represent the overall index* in T 0 and T 1 The value of the moment.

[0052] When dealing with database anomalies, if the dimensional combination space of indicators is too large, traditional search methods may be too complex to effectively find the root cause set. Monte Carlo search algorithms will be used to explore the huge dimensional space to find the most likely root cause combination. The process includes the following four steps:

[0053] a. Selection: In the multi-dimensional combination of the database, the probability score PS of each dimensional combination is calculated to measure the possibility of a certain root cause candidate set causing anomalies, and the optimal exploration path is determined by ranking. The formula is as follows:

[0054]

[0055] Where s is the current state, representing the current database dimension combination or system state; a is the selected action, which refers to the operation of selecting a dimension combination or root cause candidate set for exploration under the current state s; s′ is the subsequent node of state s after action a, descendant(s′): the subsequent state set (descendants) of state s′, indicating all possible states that can be reached from state s′ after further expansion and exploration; u is all possible states on the current exploration path, and S(u) is the root cause candidate set.

[0056]

[0057] N(s) represents the total number of visits to the current state node s; N(s,a) represents the number of explorations to visit the current root cause set; C is a constant, usually 2; Q(s,a) is the average potential score value under a node, also known as the average dimension value; USB(s,a) represents the UCB value of each node below, which is the value of the root cause effect of this node. Therefore, the node with the largest USB value is taken.

[0058] According to the UCB formula, the node with the largest UCB value is selected as the node to be explored next, and A(s) is the action set under the current state s.

[0059]

[0060] b. Extension

[0061] From the set of elements that have not yet been explored, select an element e with the maximum potential score * , add the current root cause set S(s) to form a new extended node s′. The specific formula is as follows:

[0062] S(s′)=S(s)∪{e *}

[0063]

[0064] e * It is the element with the largest potential score among the elements not currently added to the set during the expansion process.

[0065] c. Evaluation

[0066] After the new node is expanded, the node is initialized, the likelihood score PS of the node is recalculated, and the related Q and N values ​​are updated.

[0067] d. Backtracking

[0068] When all nodes have been expanded or the number of iterations exceeds the limit, backtracking begins.

[0069] Through the above algorithm process, the system gradually narrows the range of the root cause candidate set. Then, the descending sorting results of the contribution probability score and the change ratio are calculated respectively, and the rankings of the two sorting results are added together to obtain a new ranking score. The results are re-sorted according to the ranking score and the most likely root cause is output.

[0070] 4. Knowledge base learning module: This module is responsible for storing and managing historical alarms and root cause analysis results, supports rapid root cause inference of alarms, and continuously optimizes the intelligence of the system through dynamic learning.

[0071] Alarm knowledge base: Stores the root cause analysis paths and processing solutions of historical alarms to form a searchable case library, making it easy to quickly find solutions to similar alarm events.

[0072] Dynamic learning: After each alarm analysis is completed, the system updates the new alarm data and analysis results to the knowledge base, continuously improving the mapping relationship between alarms and root causes, making the system more and more intelligent.

[0073] Example 2

[0074] The database system of a certain enterprise handles a large number of user queries and supports real-time business needs. During a certain period of time, the database performance suddenly became abnormal, the user query delay increased significantly, and the IO operation waiting time exceeded the normal range. Through the database intelligent operation and maintenance diagnosis tree method designed above, the system helps operation and maintenance personnel quickly locate the root cause and provide solutions. The specific implementation examples are as follows:

[0075] The system pre-checks all queries currently running in the database. The timing characteristics of most queries match the normal state well and are judged to be normal. However, some queries are detected to have significantly increased latency and long disk IO waiting time, and enter further feature extraction and classification processes.

[0076] Feature extraction and classification: The system extracts multi-dimensional features of abnormal queries, including:

[0077] The size of the table being queried

[0078] The query execution plan

[0079] Whether the query involves scanning or sorting large amounts of data

[0080] Most of the queries with increased latency involve large-scale data scans of the Orders table without using indexes.

[0081] Some queries are waiting for resource locks, which may cause delays in IO operations

[0082] The system generates a dimension importance ranking based on these features and identifies "missing index" and "lock wait" as the main causes of performance bottlenecks.

[0083] The currently observed database status indicator vector:

[0084] The normal behavior vector predicted by the system:

[0085] The behavior vector generated by some feature combination in the root cause candidate set:

[0086] The system evaluates the likelihood of each root cause candidate by calculating the likelihood score (PS) through quantitative analysis. The calculation formula is as follows:

[0087]

[0088] The distance formula is:

[0089] The calculation can be obtained:

[0090] The likelihood score for missing index is 0.85 (high), indicating that this is the primary root cause.

[0091] The likelihood score for lock waits is 0.60 (minor cause).

[0092] In addition, the system uses the change ratio method to calculate the time period (T 0 ,T 1 ) and found that the scan volume of the Orders table increased significantly, accounting for 70%, further confirming that the lack of indexes was the main cause of the problem.

[0093] The system records the root cause analysis path of this alarm (missing index, lock wait) and the final solution (adding index, optimizing transactions) into the knowledge base to facilitate the rapid processing of similar alarms in the future.

[0094] The units, devices or modules described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. For the convenience of description, the above devices are described separately by functions divided into various modules. Of course, when implementing this application, the functions of each module can be implemented in the same or more software and / or hardware, or the modules that implement the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0095] Those skilled in the art also know that, in addition to implementing the controller in a purely computer-readable program code, the controller can be made to implement the same function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered as a hardware component, and the devices for implementing various functions included therein can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules for implementing the method and structures within the hardware component.

[0096] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, classes, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0097] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a mobile terminal, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0098] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc.

[0099] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A database intelligent operation and maintenance diagnosis tree method based on multi-dimensional indicators, the method comprising the following steps: (1) Collect and process multi-dimensional data when the database is running, build an expert knowledge base, and collect and analyze historical data; (2) Detect anomalies in query delays and IO operation waiting times during database operation; (3) Identify the source of anomalies in the database system by constructing a set of root cause candidates, alarm event association, and root cause diagnosis; (4) Store and manage historical alarms and root cause analysis results, support rapid root cause inference of alarms, and continuously optimize the system through dynamic learning; It is characterized in that: step (3) uses the possibility score PS to measure the possibility score of the candidate set of database abnormal root causes, and uses the change proportion VP model to focus on locating the root causes with a high change proportion through the impact measurement of time series data changes and the false positive rate control mechanism.

2. The method for intelligent database operation and maintenance diagnosis tree based on multidimensional indicators as claimed in claim 1, characterized in that: Step (3) specifically includes: 3.1 Construct a set of root cause candidates; 3.2 Associated alarm events; 3.3 Diagnose the root cause and calculate the likelihood score The value range of PS is 0 to 1. For vector and The distance v i and f i Represents vectors and Component index of ; is the current state of the database, is the normal behavior predicted by the system, Behaviors that are caused by some combination of features in the root cause candidate set. 3.4 Calculate the proportion of change in combination x in the time period (T0, T1) Among them, value(x,T0) and value(x,T1) are the values ​​corresponding to the indicators of combination x at T0 and T1 respectively, and value(*,T0) and value(*,T1) are the values ​​of the overall indicator * at T0 and T1 respectively.

3. A database intelligent operation and maintenance diagnosis tree system based on multi-dimensional indicators, the system comprising: (1) Diagnostic tree basic module: This module is responsible for multi-dimensional data collection and processing during database operation, the construction of expert knowledge base, and the collection and analysis of historical data; (2) Anomaly detection module: This module detects anomalies in query delays and IO operation waiting times during database operation; (3) Intelligent operation and maintenance diagnosis tree construction module: This module identifies the source of anomalies in the database system by constructing a set of root cause candidates, alarm event association, and root cause diagnosis; (4) Knowledge base learning module: This module stores and manages historical alarms and root cause analysis results, supports rapid root cause inference of alarms, and continuously optimizes the system through dynamic learning; Its characteristics are as follows: the intelligent operation and maintenance diagnosis tree construction module uses the possibility score PS to measure the possibility score of the candidate set of database abnormal root causes, and uses the change proportion VP model to focus on locating the root causes with a high change proportion through the impact measurement of time series data changes and the misjudgment rate control mechanism.

4. The intelligent operation and maintenance system of a database intelligent operation and maintenance diagnosis tree method based on multi-dimensional indicators as claimed in claim 3, characterized in that: The diagnostic tree construction module comprises the following steps: 3.1 Construct a set of root cause candidates; 3.2 Associated alarm events; 3.3 Diagnose the root cause and calculate the likelihood score The value range of PS is 0 to 1. For vector and The distance v i and f i Represents vectors and Component index of ; is the current state of the database, is the normal behavior predicted by the system, Behaviors that are caused by some combination of features in the root cause candidate set. 3.4 Calculate the proportion of change in combination x in the time period (T0, T1) Among them, value(x,T0) and value(x,T1) are the values ​​corresponding to the indicators of combination x at T0 and T1 respectively, and value(*,T0) and value(*,T1) are the values ​​of the overall indicator * at T0 and T1 respectively.

Images