Health assessment method, electronic device, storage medium and product

Abstract

The present application discloses a health assessment method, electronic device, storage medium and product, which relate to the field of computer technology, including determining the monitoring indicator deviation corresponding to the time series indicator data and the log data corresponding to the log data based on the time series indicator data and log data in the system to be evaluated; determining the indicator fusion weight corresponding to the monitoring indicator deviation and the log fusion weight corresponding to the log anomaly probability based on the monitoring indicator deviation and the log anomaly probability; determining the health score of the system to be evaluated based on the monitoring indicator deviation, the log anomaly probability, the indicator fusion weight and the log fusion weight, in combination with the health score function, so as to perform recovery operations on the system to be evaluated based on the health score. More accurate detection and evaluation of system faults can be achieved, and the recovery strategy can be dynamically adjusted according to the severity of different faults and the actual situation of the system, significantly improving the recovery efficiency and fault tolerance of the system.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to health assessment methods, electronic devices, storage media, and products. Background Art

[0002] In today's digital age, computing systems are widely used in various fields, such as finance, healthcare, scientific research, and communications. Their stable operation is crucial to ensuring the normal operation of these industries. As computing systems continue to grow in size and complexity, the risk of system failures also increases. To ensure that computing systems can provide continuous and stable services, timely and accurate detection of system failures and the implementation of appropriate recovery measures have become key requirements.

[0003] Currently, related technologies use a fixed threshold monitoring approach to detect computing system failures. Specifically, a fixed threshold is set. When the actual value of a monitored indicator exceeds the corresponding threshold, a failure is determined and recovery actions are triggered. However, because the thresholds in these technologies are fixed and unchanging, they lack flexibility and cannot be dynamically adjusted based on the severity of the failure and the actual system conditions. This makes them difficult to adapt to the complex and changing state of computing systems, and they are prone to false positives and false negatives, which affects the recovery efficiency of computing systems. Summary of the Invention

[0004] This application provides a health assessment method, electronic equipment, storage medium and product to at least solve the problem in related technologies that a simple fixed threshold monitoring method lacks flexibility and is prone to false alarms and missed alarms, resulting in low recovery efficiency of the system to be evaluated.

[0005] This application provides a health assessment method, including:

[0006] Based on the time series indicator data and log data in the system to be evaluated, the monitoring indicator deviation corresponding to the time series indicator data and the log anomaly probability corresponding to the log data are determined respectively;

[0007] Based on the monitoring indicator deviation and log anomaly probability, determine the indicator fusion weight corresponding to the monitoring indicator deviation and the log fusion weight corresponding to the log anomaly probability;

[0008] According to the monitoring indicator deviation, log abnormality probability, indicator fusion weight and log fusion weight, combined with the health score function, the health score of the system to be evaluated is determined, so that recovery operations are performed on the system to be evaluated according to the health score.

[0009] This application also provides a health assessment device, comprising:

[0010] A first determining unit is configured to determine, based on the time series indicator data and log data in the system to be evaluated, a monitoring indicator deviation corresponding to the time series indicator data and a log anomaly probability corresponding to the log data;

[0011] A second determining unit is configured to determine, based on the monitoring indicator deviation and the log anomaly probability, an indicator fusion weight corresponding to the monitoring indicator deviation and a log fusion weight corresponding to the log anomaly probability;

[0012] The evaluation unit is used to determine the health score of the system to be evaluated based on the monitoring indicator deviation, log abnormality probability, indicator fusion weight and log fusion weight, combined with the health score function, so as to perform recovery operations on the system to be evaluated according to the health score.

[0013] The present application also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-mentioned health assessment methods when executing the computer program.

[0014] The present application also provides a computer-readable storage medium, in which a computer program is stored, wherein when the computer program is executed by a processor, the steps of any of the above-mentioned health assessment methods are implemented.

[0015] The present application also provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned health assessment methods when executed by a processor.

[0016] Through this application, based on the time series indicator data and log data in the system to be evaluated, the monitoring indicator deviation corresponding to the time series indicator data and the log anomaly probability corresponding to the log data are determined respectively; based on the monitoring indicator deviation and the log anomaly probability, the indicator fusion weight corresponding to the monitoring indicator deviation and the log fusion weight corresponding to the log anomaly probability are determined; based on the monitoring indicator deviation, the log anomaly probability, the indicator fusion weight and the log fusion weight, combined with the health score function, the health score of the system to be evaluated is determined, so that recovery operations are performed on the system to be evaluated according to the health score. This achieves more accurate detection and evaluation of system faults, avoids the false alarm and missed alarm problems caused by the lack of flexibility of the fixed threshold monitoring method in related technologies, and can dynamically adjust the recovery strategy according to the severity of different faults and the actual situation of the system, significantly improving the recovery efficiency and fault tolerance of the system, and ensuring stable and reliable operation of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0018] Figure 1A flowchart of the first health assessment method provided in an embodiment of the present application;

[0019] Figure 2 A flowchart of the second health assessment method provided in the embodiment of the present application;

[0020] Figure 3 A flowchart of the third health assessment method provided in the embodiment of the present application;

[0021] Figure 4 A flowchart of the fourth health assessment method provided in the embodiment of the present application;

[0022] Figure 5 A structural diagram of a health assessment device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0024] It should be noted that, in the description of this application, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. The terms "first," "second," etc., in this application are used to distinguish similar objects, and are not used to describe a particular order or sequence.

[0025] Computing systems (such as intelligent computing systems) serve as the core infrastructure supporting applications such as artificial intelligence, big data analytics, and high-performance computing. Driven by the rapid development of technologies such as deep learning, natural language processing, and computer vision, their importance is growing. Intelligent computing systems must process large amounts of data and complex computing tasks. However, as systems continue to grow in size and complexity, their reliability and fault tolerance face significant challenges. Frequent hardware failures, software errors, and network anomalies can lead to data loss, computational errors, or service interruptions, severely impacting system stability and availability.

[0026] Currently, related technologies use a simple threshold monitoring approach to detect computing system failures. Specifically, these technologies set fixed thresholds for various monitoring indicators within the computing system. During operation, the actual values of these indicators are continuously monitored. Once the actual value of a monitoring indicator exceeds the pre-set fixed threshold, the system determines that a failure has occurred and triggers appropriate recovery actions.

[0027] However, this simple threshold monitoring approach has significant drawbacks. First, because the threshold is fixed and inflexible, it cannot be dynamically adjusted based on the severity of the fault and the actual system conditions. In actual operation, the system's operating state is complex and variable. The same monitoring indicator value may represent different fault conditions at different times and in different environments, and fixed thresholds are difficult to adapt to such variations. Second, this approach is prone to false positives and false negatives. False positives can cause the system to frequently and unnecessarily perform recovery operations, wasting system resources and impacting the system's normal operating efficiency. False negatives prevent the fault from being discovered and addressed in a timely manner, leading to further deterioration of the fault, reducing the system's fault tolerance, and severely impacting its stability and reliability.

[0028] Furthermore, related technologies also suffer from the problem of relying solely on log analysis to troubleshoot computing system problems. However, relying solely on log analysis fails to monitor system status in real time and struggles to capture dynamic changes in system status. Furthermore, processing and analyzing logs alone is inefficient, making it difficult to respond quickly when system failures occur. Furthermore, fault detection methods based solely on log analysis lack accuracy and cannot effectively integrate multi-source data, making it difficult to comprehensively and accurately assess the health of computing systems.

[0029] In order to solve the problems existing in the relevant solutions, the embodiment of the present application provides a health evaluation method, which combines the mutation detection of time series indicator data with the semantic analysis of log text to respectively determine the monitoring indicator deviation corresponding to the time series indicator data and the log anomaly probability corresponding to the log data, thereby realizing the deep fusion of multi-source heterogeneous data. At the same time, the adaptive fusion algorithm based on confidence assessment determines the indicator fusion weight corresponding to the monitoring indicator deviation and the log fusion weight corresponding to the log anomaly probability in real time based on the monitoring indicator deviation and the log anomaly probability; according to the monitoring indicator deviation, the log anomaly probability, the indicator fusion weight and the log fusion weight, combined with the health scoring function, the optimal health score of the system to be evaluated is determined, which effectively solves the contradiction between the sensitivity and false alarm rate of the traditional static threshold method, realizes more accurate detection and evaluation of system failures, significantly improves the system's recovery efficiency and fault tolerance, and ensures stable and reliable operation of the system.

[0030] It should be noted that the health assessment method in this application is not only applicable to intelligent computing systems, but can also be applied to other distributed computing systems with high requirements for reliability and fault tolerance, such as cloud computing platforms, big data processing clusters, etc. In the cloud computing platform, time series indicator data such as resource utilization and network traffic of virtual machines, as well as log data of systems and applications can be collected. Through similar dual-channel anomaly detection and fault propagation map construction methods, fault detection, prediction and fault tolerance processing of cloud computing platforms can be achieved. In the big data processing cluster, the time series indicator data and log data of data storage and computing nodes are analyzed, and the method of this application is used to improve the reliability and stability of the cluster and ensure the normal progress of data processing tasks.

[0031] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0032] Figure 1 A flowchart of the first health assessment method provided in an embodiment of the present application.

[0033] like Figure 1 As shown, the method comprises the following steps:

[0034] Step 101 : Based on the time series indicator data and log data in the system to be evaluated, the monitoring indicator deviation corresponding to the time series indicator data and the log anomaly probability corresponding to the log data are determined respectively.

[0035] In some embodiments, system monitoring and alarm tools are used to collect time-series indicator data such as CPU / GPU utilization, memory pressure, network latency, storage system, etc.; data collectors (such as Fluentd) are used to collect various types of log data generated by the intelligent computing system, such as operating system logs, application logs, device logs, etc.

[0036] Time series metric data refers to system performance data recorded over time, typically used to measure the operating status of the system being evaluated at different points in time. This data includes, but is not limited to, GPU utilization (measuring computing resource usage), memory pressure (indicating whether memory usage is nearing saturation), network latency (data transmission response time), and storage system performance (such as read and write speeds and I / O operations). This application can use system monitoring and alerting tools (such as Prometheus and Zabbix) to collect this time series metric data at a consistent frequency to monitor the system's operating status in real time.

[0037] The monitoring indicator deviation refers to the degree of difference between the current time series indicator data and the normal or expected value. Before determining the monitoring indicator deviation corresponding to the time series indicator data, this application needs to aggregate the time series indicator data of each data category to obtain multi-indicator deviation data for each data category. Based on the multi-indicator deviation data and the trained prediction model (such as LSTM, Long Short-Term Memory, long short-term memory network, used to predict the normal value range of the monitoring indicator), the monitoring indicator deviation corresponding to the multi-indicator deviation data is output. The greater the monitoring indicator deviation, the further the current time series indicator data deviates from the normal state, there may be potential problems, and the higher the system health risk.

[0038] Log data is the various recorded information generated by the system being evaluated during operation, including operating system logs (recording information such as operating system startup, shutdown, and errors), application logs (recording application operating status and exceptions), and device logs (recording hardware device status and failure information). This application can use a data collector (such as Fluentd or Logstash) to collect this log data, store it, and centrally manage it for subsequent analysis and processing.

[0039] Log anomaly probability refers to the probability of a log falling into a preset anomaly category by analyzing log data. This application can use log analysis tools (such as BERT, Bidirectional Encoder Representations from Transformers, a pre-trained language model for parsing log text) and a preset neural network to mine and analyze log data and identify the probability of a log falling into a preset anomaly category.

[0040] Step 102 : Based on the monitoring indicator deviation and the log abnormality probability, determine the indicator fusion weight corresponding to the monitoring indicator deviation and the log fusion weight corresponding to the log abnormality probability.

[0041] In some embodiments, monitoring indicator deviation and log anomaly probability are both important evaluation metrics in evaluating the health of the system being evaluated. However, different indicators may have different impacts on system health. Therefore, it is necessary to assign an appropriate weight to each indicator to accurately reflect its importance in the comprehensive evaluation. The indicator fusion weight is used to measure the relative importance of monitoring indicator deviation in the health assessment, while the log fusion weight is used to measure the importance of log anomaly probability.

[0042] This application can determine the standard deviation of the monitoring indicator deviation and the log anomaly probability in real time, and use the standard deviation to determine the indicator fusion weight corresponding to the monitoring indicator deviation and the log fusion weight corresponding to the log anomaly probability. This is because the standard deviation is a statistic that measures the degree of dispersion of the data distribution and reflects the fluctuation range of the monitoring indicator deviation or the log anomaly probability.

[0043] Step 103 : Determine the health score of the system to be evaluated based on the monitoring indicator deviation, log abnormality probability, indicator fusion weight, and log fusion weight, combined with the health score function, so as to perform a recovery operation on the system to be evaluated based on the health score.

[0044] In some embodiments, the health scoring function is a model for comprehensively assessing the health of a system under evaluation. The health scoring function may use monitoring indicator deviation, log anomaly probability, indicator fusion weight, and log fusion weight as input parameters, and calculates the system's health score using a specific calculation method. The health score can be a value between 0 and 100, with higher scores indicating better system health and lower scores indicating more serious system problems.

[0045] Specifically, the present application may use a health scoring function to calculate the health score of the system based on the output results of LSTM and BERT (i.e., monitoring indicator deviation and log anomaly probability), indicator fusion weight, and log fusion weight.

[0046] The health score function is:

[0047] in, To monitor the deviation of indicators; is the log anomaly probability; is the indicator fusion weight, is the log fusion weight; k is the slope coefficient (for example, it can be 3).

[0048] Furthermore, the present application may further select a recovery operation corresponding to a preset interval based on the preset interval corresponding to the calculated health score, and perform the corresponding recovery operation on the system to be evaluated.

[0049] Through this application, based on the time series indicator data and log data in the system to be evaluated, the monitoring indicator deviation corresponding to the time series indicator data and the log anomaly probability corresponding to the log data are determined respectively; based on the monitoring indicator deviation and the log anomaly probability, the indicator fusion weight corresponding to the monitoring indicator deviation and the log fusion weight corresponding to the log anomaly probability are determined; based on the monitoring indicator deviation, the log anomaly probability, the indicator fusion weight and the log fusion weight, combined with the health score function, the health score of the system to be evaluated is determined, so that recovery operations are performed on the system to be evaluated according to the health score. This achieves more accurate detection and evaluation of system faults, avoids the false alarm and missed alarm problems caused by the lack of flexibility of the fixed threshold monitoring method in related technologies, and can dynamically adjust the recovery strategy according to the severity of different faults and the actual situation of the system, significantly improving the recovery efficiency and fault tolerance of the system, and ensuring stable and reliable operation of the system.

[0050] Figure 2 The flowchart of the second health assessment method proposed in this application is further shown. Figure 1 The embodiment shown in FIG. 1 further explains step 101. Figure 2 The following steps may be included.

[0051] Step 201 : collecting time series indicator data according to a sampling frequency corresponding to the time series indicator data, and performing window normalization processing on the time series indicator data to obtain multi-indicator deviation data based on the time series indicator data after the window normalization processing.

[0052] In some embodiments, the present application may collect timing indicator data according to an initial sampling frequency corresponding to the timing indicator data; if the timing indicator data is greater than or equal to a preset fault threshold corresponding to the timing indicator data, the initial sampling frequency is adjusted to collect the timing indicator data according to the adjusted sampling frequency; if the duration for which the timing indicator data is less than the preset fault threshold is greater than or equal to a preset recovery period, the sampling frequency is restored to the initial sampling frequency to collect the timing indicator data using the initial sampling frequency.

[0053] The timing indicator data is collected according to the initial sampling frequency corresponding to the timing indicator data; if the load of the system to be evaluated is greater than or equal to the preset load threshold, the initial sampling frequency is reduced to collect the timing indicator data using the reduced sampling frequency.

[0054] After the above-mentioned sampling frequency adjustment, when the time series indicator data is obtained, the present application can standardize the time series indicator data for each sliding window corresponding to the sampling frequency to obtain standard time series indicator data; determine the indicator difference between the standard time series indicator data and the ideal data corresponding to the standard time series indicator data; based on the indicator difference and the preset indicator weight corresponding to the standard time series indicator data, perform weighted aggregation processing on the standard time series indicator data of each data category to obtain multi-indicator deviation data for each data category.

[0055] In an optional embodiment of the present application, the present application can deploy sampling frequencies based on the different data categories corresponding to time series indicator data. Time series indicator data is sampled at a sampling frequency of 1 minute. Time series indicator data refers to fault indicators, which are key quantitative indicators used to reflect system health and are used for fault analysis.

[0056] Among them, the timing indicator data of different data categories are shown in Tables 1 to 5. It should be noted that the timing indicator data in Tables 1 to 5 are only used as an example. The specific indicators can be adjusted according to actual needs and are not limited in the embodiments of this application.

[0057] Table 1 shows the timing indicator data for computing resource categories:

[0058]

[0059] Table 2 shows the timing indicator data for the memory system category:

[0060]

[0061] Table 3 shows the timing indicator data for network communication categories:

[0062]

[0063] Table 4 shows the timing indicator data for storage systems:

[0064]

[0065] The time series indicator data for the environmental support category is shown in Table 5:

[0066]

[0067] After this application has completed three complete business cycles (training / inference), the automatic parameter adjustment mode is enabled. First, the sampling frequency is set to the initial sampling frequency, that is, the initial sampling frequency of each time series indicator data is set to its upper limit sampling frequency for collection (that is, the initial sampling frequency of each time series indicator data in Tables 1 to 5 above is the maximum value of the sampling frequency range). When an abnormality in the time series indicator data is detected, that is, when the time series indicator data exceeds its corresponding preset fault threshold (for example, each time series indicator data in Tables 1 to 5 above exceeds its corresponding threshold), the initial sampling frequency is adjusted, and the automatically associated time series indicator data enters the high-frequency sampling mode.

[0068] If the duration of the time series indicator data being below the preset fault threshold is less than the preset recovery period, sampling will continue at the adjusted sampling frequency. For example, enhanced monitoring will continue at a high-frequency sampling frequency of 1.5 times the baseline for 30 minutes after the time series indicator data has recovered from the fault. If the duration of the time series indicator data being below the preset fault threshold is greater than or equal to the preset recovery period, the sampling frequency will be restored to the initial sampling frequency.

[0069] At the same time, this application also takes into account the impact of sampling on system performance. If the load of the system to be evaluated is greater than or equal to the preset load threshold, the initial sampling frequency is reduced. For example, if the load of the system to be evaluated is ≥70%, the sampling frequency is dynamically reduced.

[0070] Furthermore, this application can make the monitored time series indicator data more usable and representative through sliding window standardization and multi-indicator aggregation.

[0071] Specifically, the time series indicator data of the system to be evaluated will fluctuate over time, and sliding window normalization can normalize the data to a specific interval, making data of different times and magnitudes comparable. It can effectively remove noise and abnormal fluctuations in the data, highlight the core features of the data, and make subsequent model training and analysis more stable and accurate. For example, when monitoring GPU utilization, this application can use sliding window normalization to eliminate the impact of instantaneous fluctuations caused by task scheduling, allowing the model to focus on long-term trends and accurately identify anomalies. In addition, it can also improve the efficiency and convergence speed of model training, avoid gradient vanishing or explosion problems, and make model training more efficient and stable.

[0072] In the case of different sampling frequencies, the core goal of sliding window standardization is still to standardize the time series indicator data within each sliding window so that the data has zero mean and unit variance, while taking into account the impact of sampling frequency changes on the time series indicator data within the sliding window. This application can use the following formula to standardize the time series indicator data within each sliding window to obtain standard time series indicator data.

[0073] For a sliding window X={x1, x2,…, xn} containing n time series indicator data, the standardized standard time series indicator data The calculation formula is: ;

[0074] is the mean of the time series indicator data in the sliding window, is the standard deviation of the time series indicator data in the sliding window, is the i-th time series indicator data before normalization in the sliding window;

[0075] in, and The calculation formula is: ; ;

[0076] n is the number of time series indicator data in the sliding window.

[0077] Taking into account that the time series indicator data of different sampling frequencies, that is, the time series indicator data of time intervals corresponding to different sampling frequencies may contribute differently to the statistics, the present application can further adopt a time-weighted approach to calculate the mean and standard deviation within each sliding window.

[0078] Assume that each time series indicator data The corresponding time interval weight is ,and . Then the weighted mean and weighted standard deviation The calculation formula is: ; .

[0079] Normalized time series indicator data for: ;

[0080] Among them, the weight The weight can be determined based on the time interval corresponding to the sampling frequency of the time series indicator data. For example, the closer the time interval, the higher the weight of the time series indicator data.

[0081] The weight of this application The calculation formula is: ;

[0082] in, It is time series indicator data The corresponding timestamp; is the maximum timestamp in the sliding window.

[0083] Furthermore, the operation of the system to be evaluated involves multiple complex monitoring indicators, and it is difficult to fully grasp the system status by analyzing a single indicator alone. Therefore, after obtaining the standard time series indicator data, this application performs weighted aggregation processing on multiple standard time series indicator data according to preset data categories to obtain multi-indicator deviation data corresponding to each data category. For example, the CPU, GPU, memory, network, storage and other aspects of the time series indicator data are integrated to construct a comprehensive feature vector, that is, multi-indicator deviation data, which comprehensively reflects the system operation status.

[0084] Among them, this application can use a multi-indicator aggregation formula to perform weighted aggregation processing on multiple time series indicator data of each data category.

[0085] The multi-indicator aggregation formula is: ;

[0086] in, for (actual value), that is, the actual value of the standard timing indicator data in this application; for (ideal value), which is the ideal value of the ideal data in this application;

[0087] The multi-indicator aggregation formula of this application represents weighted aggregation of different standard time series indicator data of each data category, calculating the weighted sum of the difference between the actual value and the ideal value, and using this weighted sum as the multi-indicator deviation data in this application.

[0088] Indicator weight represents the weight of the i-th standard time series indicator data in a certain data category, and . The indicator weight reflects the importance of each standard time series indicator data in the comprehensive evaluation. In the system to be evaluated, the CPU, GPU, memory, network and other indicators have different degrees of influence on the overall performance of the system. This application can highlight the role of key indicators by pre-setting different indicator weights. For example, in deep learning training tasks, GPU utilization has a greater impact on computing performance and can be given a higher indicator weight; while the disk I / O indicator has a relatively small impact and can be given a lower indicator weight;

[0089] Index difference It calculates the absolute difference between the actual value and the ideal value of each standard time series indicator data in a certain data category. is the actual monitoring value of the i-th standard time series indicator data, This is the ideal value or normal range for the standard time series metric. For example, if the ideal CPU usage is between 30% and 70%, and the actual CPU usage is 80%, the difference is |80% - 70%| = 10%. This difference reflects the degree to which the metric deviates from the ideal state.

[0090] The ideal value for each standard timing metric in this application (i.e., the ideal data in this application) is set based on the system's design specifications and performance goals. For example, if network equipment is designed to have a latency of no more than 50 milliseconds under normal load, then 50 milliseconds is the ideal value for network latency. If the system's memory design capacity is 32GB and the memory utilization rate should not exceed 80% during normal operation, then the ideal memory utilization is 25.6GB (32GB x 80%).

[0091] This application multiplies the weight of each standard time series indicator in each data category by the corresponding indicator difference, and then sums the results to obtain multi-indicator deviation data, namely the multi-indicator aggregation result M. The multi-indicator deviation data comprehensively reflects the degree to which the overall indicators of each data category deviate from the ideal state. The larger the M value, the further the system deviates from the ideal state, and the more serious the potential problems. Conversely, the smaller the M value, the closer the system operation state is to the ideal state.

[0092] Step 202 : obtaining log data generated by the system to be evaluated, and merging the log data based on similarity of the log data to obtain merged log data.

[0093] In some embodiments, log data generated by the system to be evaluated is obtained; the log data is parsed to extract keywords and parameter positions in the log data; based on the keywords and parameter positions, the similarity corresponding to the log data is determined, and the log data with similarity greater than or equal to a preset similarity threshold is merged to obtain merged log data.

[0094] In an optional embodiment of the present application, the present application may use a data collector (such as Fluentd) to collect various types of log data generated by the system to be evaluated, such as operating system logs, application logs, device logs, etc.

[0095] Afterwards, a clustering-based log template extraction algorithm (such as Drain3) can be used. By defining the structure of the log template and using clustering to group similar logs into one category, each merged log data in this application is obtained, and each category corresponds to a log template. The log template extraction algorithm mainly matches and clusters based on the keywords and parameter positions of the logs. First, the log data can be parsed to extract the keywords and parameter positions. Then, based on this information, the similarity between the log data is calculated, and logs with high similarity are merged into the same cluster. The center of each cluster is a log template.

[0096] Step 203 : performing an anomaly analysis on the multi-indicator deviation data and the merged log data to obtain the monitoring indicator deviation degree corresponding to the multi-indicator deviation data and the log anomaly probability corresponding to the merged log data.

[0097] In some embodiments, the present application can train the prediction model based on the training set and verification set corresponding to the original multi-indicator deviation data, and verify the trained prediction model using the test set of the original multi-indicator deviation data to obtain a verification result; if the verification result of the prediction model is normal, the multi-indicator deviation data is input into the trained prediction model to obtain the deviation of the proctoring indicator output by the trained prediction model.

[0098] Among them, the prediction model is trained based on the training set and validation set corresponding to the original multi-indicator deviation data, and the trained prediction model is verified using the test set of the original multi-indicator deviation data. The verification results specifically include: preprocessing the original multi-indicator deviation data to obtain the training set, validation set and test set corresponding to the multi-indicator deviation data; inputting the training set into the prediction model, and performing forward propagation to determine the loss value of the loss function of the prediction model; based on the loss value and the validation set, backpropagation is used to update the parameters of the prediction model until the loss function converges to obtain the trained prediction model; using the validation set to verify the deviation of the monitoring indicators output by the trained prediction model to obtain the verification result; if the verification result is normal, the test set is input into the trained prediction model to obtain the deviation of the monitoring indicators output by the trained prediction model.

[0099] The original multi-index deviation data is preprocessed to obtain the training set, validation set and test set corresponding to the multi-index deviation data, specifically including: normalizing the original multi-index deviation data; dividing the normalized original multi-index deviation data into training set, validation set and test set; converting the data formats of the training set, validation set and test set into the target format corresponding to the prediction model through a sliding window.

[0100] In an optional embodiment of the present application, the prediction model may be an LSTM prediction engine, which analyzes the obtained multi-indicator deviation data and predicts the deviation of the corresponding monitoring indicator. The LSTM (Long Short-Term Memory) prediction engine is a powerful recurrent neural network capable of processing time series indicator data with long-term dependencies. It is suitable for analyzing and predicting collected time series indicators of the system to be evaluated (such as CPU / GPU utilization, memory pressure, network latency, etc.).

[0101] Specifically, this application can normalize the original multi-index deviation data obtained, for example, using the Min-Max normalization method to scale the data to the [0, 1] interval to eliminate the impact of the dimensions between different indicators and improve the training effect of the model. The normalization formula is: ;

[0102] in, is the normalized original multi-index deviation data, x is the original multi-index deviation data currently being processed, is the maximum value of all original multi-index deviation data, is the minimum value of all original multi-index deviation data.

[0103] Afterwards, the normalized original multi-index deviation data is divided into a training set, a validation set, and a test set according to a preset ratio. Among them, the preset ratio can be 70% for the training set, 15% for the validation set, and 15% for the test set. It can also be adjusted according to actual needs and is not limited in the embodiments of this application. The training set is used to train the model, the validation set is used to adjust the hyperparameters of the model, and the test set is used to evaluate the final performance of the model.

[0104] After the training set, validation set, and test set are divided, the present application can further convert the original multi-index deviation data of each data set into a target format suitable for the input of the prediction model. The present application can adopt the sliding window method, taking the original multi-index deviation data of several consecutive time steps as input and the original multi-index deviation data of the next time step as output, and apply this method to the training set, validation set, and test set to construct their input and output pairs respectively. For example, if the sliding window size is 10, the input is the original multi-index deviation data from time t-9 to time t, and the output is the original multi-index deviation data at time t+1, that is, the input is , the output is ,in represents the original multi-index deviation data at the t-th time step, is the original multi-index deviation data for the next time step.

[0105] The target format of the converted raw multi-index data is a series of input and output pairs, each of which contains a fixed-length input vector and an output value.

[0106] Furthermore, after the above preprocessing, the training set, validation set and test set corresponding to the multi-index deviation data are obtained, and the present application can train the prediction model.

[0107] Specifically, the present application can first construct an initial prediction model, that is, determine the number of neurons in the LSTM layer (this number will affect the expressiveness of the model. The more neurons, the stronger the expressiveness of the model, but the training time will also increase accordingly), add a fully connected layer after the LSTM layer, and map the output of the LSTM layer to the dimension of the predicted monitoring indicator deviation. After the fully connected layer, a suitable activation function can be selected, such as a linear activation function (for regression problems).

[0108] After that, this application trains the initial prediction model based on the training set. For the prediction problem of multiple indicators deviating from the data, the mean square error (MSE) is usually used as the loss function to measure the error between the model prediction value and the true value. The formula of the loss function is: ;

[0109] in, It is the monitoring indicator data predicted based on the original multi-indicator deviation data. is the predicted value corresponding to the original multi-indicator deviation data, and n is the number of multi-indicator deviation data.

[0110] This application can also select a suitable optimizer, such as the Adam optimizer, to update the parameters of the model so as to minimize the value of the loss function.

[0111] The training set and verification machine are input into the model, forward propagation is performed to calculate the loss, and then the parameters of the model are updated through back propagation. This process is repeated until the loss function converges.

[0112] When the loss function converges, the trained prediction model is obtained, and then the test set is used to evaluate the performance of the trained prediction model. The evaluation indicators include mean square error (MSE), root mean square error (RMSE), mean absolute error (MAE), etc. That is, the test set is input into the trained prediction model to obtain the output result, and it is determined whether the evaluation indicators between the output monitoring indicator data and its predicted value are within the preset range to determine whether the model performance meets the requirements.

[0113] If the evaluation metric meets the preset requirements, that is, the evaluation metric is within the preset range, the verification result is considered normal, indicating that the model performs well on unseen data and has reliable generalization ability. If the evaluation metric does not meet the preset requirements, that is, the evaluation metric is not within the preset range, the verification result is considered abnormal, indicating that the model may have overfitting, underfitting, or other problems and requires further adjustment and optimization.

[0114] If the verification result of the trained prediction model is normal, the deviation data of multiple indicators are predicted to obtain the deviation degree of the monitoring indicator.

[0115] Based on the above content, this application uses the LSTM prediction engine to analyze the collected multi-indicator deviation data in a complete process, including data preprocessing, model construction, model training, model evaluation and prediction steps, so as to obtain accurate health indicator deviation and provide a basis for system fault detection and fault tolerance.

[0116] In this application, the monitoring indicator deviation Mt is the MAE (Mean Absolute Error) loss, which is used to calculate the monitoring indicator deviation. Specifically, this application uses MAE loss as a measure of monitoring indicator deviation, which can intuitively reflect the degree of deviation of the monitoring indicator from the normal state. In the health score function H(t), the larger Mt (calculated by MAE loss), the further the monitoring indicator deviates from the normal range, and the higher the system health risk. Conversely, the smaller Mt, the closer the monitoring indicator is to the normal state, and the healthier the system. For example, if the MAE loss of GPU utilization continues to increase, it means that the GPU operating state is unstable and the system may have potential faults. At this time, the Mt term in the health score function will increase, lowering the system health score H(t), indicating that the system is abnormal.

[0117] In some embodiments, the merged log data is segmented, and the segmented merged log data is converted into a target format corresponding to a semantic analysis model to obtain target log data; log features of the target log data are extracted through the semantic analysis model, and log features marked as target tags in the log features are used as semantic coding features of the target log data; based on a preset neural network, the semantic coding features and log features are classified as abnormalities to determine the abnormality probability of the merged log data being in different abnormal categories; based on the abnormality probability, the log abnormality probability corresponding to the merged log data is determined.

[0118] In an optional embodiment of the present application, the log analysis tool in the present application may be a BERT classification model. The present application parses the log text through the BERT classification model to identify error patterns.

[0119] Specifically, this application uses a pre-trained BERT classification model to process the log text of the merged log data. First, the log text of the merged log data is tokenized, and the tokenized results are converted into an input format acceptable to the model (such as token_ids, attention_mask, etc.). Next, this input data is fed into the BERT classification model, which performs feature extraction on the text and finally extracts the output vector corresponding to the [CLS] tag as the semantic encoding vector of the log text. This vector contains the semantic information of the log text and can be used for subsequent anomaly detection and classification tasks.

[0120] Furthermore, the present application can construct a neural network consisting of two fully connected layers (MLPs), i.e., a pre-set neural network. The template-extracted and semantically encoded log features and semantically encoded features are then used as input. The first fully connected layer transforms and combines the input features to increase the model's nonlinear expressiveness. The output of the first layer is then processed using an activation function (such as ReLU) and fed into the second fully connected layer. The output of the second fully connected layer is processed using a softmax function to determine the probability that each merged log data point belongs to a different anomaly category (e.g., normal, connection anomaly, or other anomaly).

[0121] This application can determine whether the merged log data is abnormal and the type of anomaly based on the probability value of the abnormality probability. To convert the log probability vector z into a probability distribution, this application requires the use of the softmax function. The softmax function is defined as follows: for a vector z = [z1,z2,...,zc] of length C, the softmax function converts it into a probability distribution y = [y1,y2,...,yc].

[0122] It should be noted that if there are multiple anomalies in the merged log data, the anomaly probabilities corresponding to multiple anomaly categories will be obtained. In this case, the anomaly probability with the highest probability value can be used as the log anomaly probability. Alternatively, different probability fusion weights can be assigned to different anomaly categories, and a weighted fusion is performed based on each anomaly probability and its probability fusion weight to obtain the final log anomaly probability.

[0123] In summary, this application can combine real-time time series indicator data and log data to achieve cross-modal analysis of time series and text, explore the spatiotemporal correlation between monitoring data mutations and log error messages, and improve the accuracy of fault diagnosis.

[0124] Figure 3 The flowchart of the third health assessment method proposed in this application is further shown. Figure 1 The embodiment shown in FIG. 1 further explains step 102. Figure 3 The following steps may be included.

[0125] Step 301: Determine a first standard deviation of a monitoring indicator deviation in a preset period and a second standard deviation of a log abnormality probability in a preset period.

[0126] Step 302: Determine the indicator fusion weight and the log fusion weight based on the first standard deviation and the second standard deviation.

[0127] In some embodiments, the present application may determine the indicator fusion weight based on the first standard deviation and the second standard deviation, and then determine the log fusion weight according to the indicator fusion weight.

[0128] Specifically, the present application can calculate the indicator fusion weight and the log fusion weight through a weight adaptive formula.

[0129] The weight adaptation formula is: , .

[0130] in, The square of the first standard deviation of the monitoring indicator deviation in a preset period (for example, the last 2 minutes), is the square of the second standard deviation of the log anomaly probability in a preset period (for example, the last 2 minutes), is the inverse of the square of the first standard deviation, is the inverse of the square of the second standard deviation, is the indicator fusion weight, is the log fusion weight.

[0131] In summary, this application designs a weight adaptive formula for dynamic weight fusion, dynamically determines the indicator fusion weight and log fusion weight, and more accurately evaluates the system health status.

[0132] Figure 4 The flowchart of the fourth health assessment method proposed in this application is further shown. Figure 1 The embodiment shown in FIG. 1 further explains step 103. Figure 4 The following steps may be included.

[0133] Step 401: Determine a preset interval corresponding to the health score.

[0134] Step 402: Execute a recovery operation corresponding to a preset interval.

[0135] In some embodiments, if the preset interval is the first preset interval, non-core functions of the system to be evaluated are shut down; if the preset interval is the second preset interval, the system to be evaluated is restarted; if the preset interval is the third preset interval, the backup system corresponding to the system to be evaluated is determined, and the system to be evaluated is switched to the backup system.

[0136] Specifically, this application can implement a hierarchical recovery strategy based on the health score results. When H(t) is in different intervals, the system will perform corresponding recovery operations. For example, when the health score H(t) belongs to the first preset interval (0.6, 0.8), the system will perform service degradation; when the health score H(t) belongs to the second preset interval (0.8, 1.0), the node (system) will be restarted; when the health score H(t) belongs to the third preset interval [1.0, +∞), the cluster (system) will be switched.

[0137] Among them, the determination of non-core functions can be based on the importance and frequency of use of system functions. Functions that have little impact on the core business logic of the system and will not cause the overall failure of the system even if they are temporarily unavailable are defined as non-core functions, such as some auxiliary data analysis and non-real-time report generation functions in the system to be evaluated. The determination of the backup system requires comprehensive consideration of factors such as the system architecture, data consistency requirements, and switching costs. This application can deploy in advance a set of independent systems that are similar to the main system in architecture and functions and have a data synchronization mechanism as a backup system. When the main system encounters a serious failure or the health score is in the third preset interval, it can quickly switch to the backup system to ensure business continuity.

[0138] In summary, this application takes different recovery actions based on the health score results, establishing a three-level recovery mechanism driven by health scores (service degradation, node restart, and cluster switching). By quantitatively assessing the severity of faults, accurate resource scheduling and fault isolation are achieved, significantly reducing the mean time to repair (MTTR).

[0139] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0140] The embodiment of the present application further provides a health assessment device 500, Figure 5 A structural diagram of a health assessment device provided in an embodiment of the present application is shown as follows: Figure 5 Shown, including:

[0141] The first determining unit 510 is configured to determine, based on the time series indicator data and log data in the system to be evaluated, the monitoring indicator deviation corresponding to the time series indicator data and the log anomaly probability corresponding to the log data;

[0142] The second determining unit 520 is configured to determine, based on the monitoring indicator deviation and the log anomaly probability, an indicator fusion weight corresponding to the monitoring indicator deviation and a log fusion weight corresponding to the log anomaly probability;

[0143] The evaluation unit 530 is used to determine the health score of the system to be evaluated based on the monitoring indicator deviation, log abnormality probability, indicator fusion weight and log fusion weight, combined with the health score function, so as to perform recovery operations on the system to be evaluated according to the health score.

[0144] The health assessment device of the present application determines the monitoring indicator deviation corresponding to the time series indicator data and the log anomaly probability corresponding to the log data based on the time series indicator data and log data in the system to be evaluated; determines the indicator fusion weight corresponding to the monitoring indicator deviation and the log anomaly probability based on the monitoring indicator deviation and the log anomaly probability; determines the health score of the system to be evaluated based on the monitoring indicator deviation, the log anomaly probability, the indicator fusion weight and the log fusion weight, combined with the health score function, so as to perform recovery operations on the system to be evaluated based on the health score. This achieves more accurate detection and evaluation of system faults, avoids the false alarm and missed alarm problems caused by the lack of flexibility of the fixed threshold monitoring method in related technologies, and can dynamically adjust the recovery strategy according to different fault severity and actual system conditions, significantly improving the system's recovery efficiency and fault tolerance, and ensuring stable and reliable operation of the system to be evaluated.

[0145] Furthermore, in a possible implementation of the embodiment of the present application, the first determination unit 510 is used to: collect the time series indicator data according to the sampling frequency corresponding to the time series indicator data, and perform window normalization processing on the time series indicator data to obtain multi-indicator deviation data based on the time series indicator data after window normalization processing; obtain the log data generated by the system to be evaluated, and merge the log data based on the similarity of the log data to obtain merged log data; perform anomaly analysis on the multi-indicator deviation data and the merged log data to obtain the monitoring indicator deviation corresponding to the multi-indicator deviation data and the log anomaly probability corresponding to the merged log data.

[0146] Furthermore, in a possible implementation of the embodiment of the present application, the first determination unit 510 is used to: collect the timing indicator data according to the initial sampling frequency corresponding to the timing indicator data; if the timing indicator data is greater than or equal to the preset fault threshold corresponding to the timing indicator data, adjust the initial sampling frequency to collect the timing indicator data according to the adjusted sampling frequency; if the duration that the timing indicator data is less than the preset fault threshold is greater than or equal to the preset recovery period, restore the sampling frequency to the initial sampling frequency to collect the timing indicator data using the initial sampling frequency.

[0147] Furthermore, in a possible implementation of an embodiment of the present application, the first determination unit 510 is used to: collect the timing indicator data according to the initial sampling frequency corresponding to the timing indicator data; if the load of the system to be evaluated is greater than or equal to a preset load threshold, reduce the initial sampling frequency to collect the timing indicator data using the reduced sampling frequency.

[0148] Furthermore, in a possible implementation of the embodiment of the present application, the first determination unit 510 is used to: standardize the timing indicator data for each sliding window corresponding to the sampling frequency to obtain standard timing indicator data; determine the indicator difference between the standard timing indicator data and the ideal data corresponding to the standard timing indicator data; and perform weighted aggregation processing on the standard timing indicator data of each data category based on the indicator difference and the preset indicator weight corresponding to the standard timing indicator data to obtain multi-indicator deviation data for each data category.

[0149] Furthermore, in a possible implementation of the embodiment of the present application, the first determination unit 510 is used to: obtain the log data generated by the system to be evaluated; parse the log data to extract the keywords and parameter positions in the log data; based on the keywords and the parameter positions, determine the similarity corresponding to the log data, and merge the log data whose similarity is greater than or equal to a preset similarity threshold to obtain merged log data.

[0150] Furthermore, in a possible implementation of the embodiment of the present application, the first determination unit 510 is used to: train the prediction model based on the training set and the verification set corresponding to the original multi-indicator deviation data, and verify the trained prediction model using the test set of the original multi-indicator deviation data to obtain a verification result; if the verification result of the prediction model is normal, the multi-indicator deviation data is input into the trained prediction model to obtain the deviation degree of the proctoring indicator output by the trained prediction model.

[0151] Furthermore, in a possible implementation of the embodiment of the present application, the first determination unit 510 is used to: pre-process the original multi-index deviation data to obtain a training set, a validation set, and a test set corresponding to the multi-index deviation data; input the training set into the prediction model, and perform forward propagation to determine the loss value of the loss function of the prediction model; based on the loss value and the validation set, back-propagate to update the parameters of the prediction model until the loss function converges to obtain the trained prediction model; use the validation set to verify the deviation of the monitoring indicator output by the trained prediction model to obtain a verification result; if the verification result is normal, input the test set into the trained prediction model to obtain the deviation of the monitoring indicator output by the trained prediction model.

[0152] Furthermore, in a possible implementation of the embodiment of the present application, the first determination unit 510 is used to: segment the merged log data, and convert the segmented merged log data into a target format corresponding to the semantic analysis model to obtain target log data; extract log features of the target log data through the semantic analysis model, and use the log features marked as target tags in the log features as semantic coding features of the target log data; based on a preset neural network, perform anomaly classification on the semantic coding features and the log features to determine the anomaly probability of the merged log data being in different anomaly categories; based on the anomaly probability, determine the log anomaly probability corresponding to the merged log data.

[0153] Furthermore, in a possible implementation of the embodiment of the present application, the second determination unit 520 is used to: determine the first standard deviation of the monitoring indicator deviation in the preset time period and the second standard deviation of the log anomaly probability in the preset time period; based on the first standard deviation and the second standard deviation, determine the indicator fusion weight and the log fusion weight.

[0154] Furthermore, in a possible implementation of the embodiment of the present application, the evaluation unit 530 is configured to: determine a preset interval corresponding to the health score; and perform a recovery operation corresponding to the preset interval.

[0155] Furthermore, in a possible implementation of the embodiment of the present application, the evaluation unit 530 is used to: if the preset interval is a first preset interval, shut down the non-core functions of the system to be evaluated; if the preset interval is a second preset interval, restart the system to be evaluated; if the preset interval is a third preset interval, determine the backup system corresponding to the system to be evaluated, and switch the system to be evaluated to the backup system.

[0156] For the description of the features in the embodiment corresponding to the health assessment device, please refer to the relevant description of the embodiment corresponding to the health assessment method, and will not be repeated here.

[0157] An embodiment of the present application further provides an electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above health assessment method embodiments.

[0158] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above-mentioned health assessment method embodiments when run.

[0159] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0160] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any of the above health assessment method embodiments are implemented.

[0161] An embodiment of the present application also provides another computer program product, including a non-volatile computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps in any of the above-mentioned health assessment method embodiments.

[0162] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0163] The above is a detailed introduction to a health assessment method, electronic device, storage medium and product provided by this application. Specific examples are used herein to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method of this application and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of this application, several improvements and modifications can be made to this application, and these improvements and modifications also fall within the scope of protection of the claims of this application.

Claims

1. A health assessment method, characterized in that: The method comprises: Based on the time series indicator data and log data in the system to be evaluated, respectively determining the monitoring indicator deviation corresponding to the time series indicator data and the log anomaly probability corresponding to the log data; Based on the monitoring indicator deviation and the log abnormality probability, determining the indicator fusion weight corresponding to the monitoring indicator deviation and the log fusion weight corresponding to the log abnormality probability; Determining a health score of the system to be evaluated based on the monitoring indicator deviation, the log abnormality probability, the indicator fusion weight, and the log fusion weight, in combination with a health score function, so as to perform a recovery operation on the system to be evaluated based on the health score; The determining, based on the monitoring indicator deviation and the log anomaly probability, an indicator fusion weight corresponding to the monitoring indicator deviation and a log fusion weight corresponding to the log anomaly probability includes: Determine a first standard deviation of the monitoring indicator deviation in a preset period and a second standard deviation of the log abnormality probability in the preset period; Based on the first standard deviation and the second standard deviation, the indicator fusion weight and the log fusion weight are determined by a weight adaptive formula. The weight adaptation formula is: , ; in, is the square of the first standard deviation, is the square of the second standard deviation, is the reciprocal of the square of the first standard deviation, is the reciprocal of the square of the second standard deviation, is the fusion weight of the indicator, is the log fusion weight.

2. The method according to claim 1, characterized in that The determining, based on the time series indicator data and the log data in the system to be evaluated, respectively the monitoring indicator deviation corresponding to the time series indicator data and the log anomaly probability corresponding to the log data includes: The time series indicator data is collected according to a sampling frequency corresponding to the time series indicator data, and the time series indicator data is subjected to window normalization processing to obtain multi-indicator deviation data based on the time series indicator data after the window normalization processing; Acquire log data generated by the system to be evaluated, and merge the log data based on similarity of the log data to obtain merged log data; Anomaly analysis is performed on the multi-indicator deviation data and the merged log data to obtain the monitoring indicator deviation degree corresponding to the multi-indicator deviation data and the log anomaly probability corresponding to the merged log data.

3. The method according to claim 2, characterized in that The collecting of the timing indicator data according to the sampling frequency corresponding to the timing indicator data includes: Collect the time series indicator data according to the initial sampling frequency corresponding to the time series indicator data; If the timing indicator data is greater than or equal to a preset fault threshold corresponding to the timing indicator data, adjusting the initial sampling frequency to collect the timing indicator data according to the adjusted sampling frequency; If the duration during which the timing indicator data is less than the preset fault threshold is greater than or equal to a preset recovery period, the sampling frequency is restored to the initial sampling frequency to collect the timing indicator data using the initial sampling frequency.

4. The method according to claim 2, characterized in that The collecting of the timing indicator data according to the sampling frequency corresponding to the timing indicator data includes: Collect the time series indicator data according to the initial sampling frequency corresponding to the time series indicator data; If the load of the system to be evaluated is greater than or equal to a preset load threshold, the initial sampling frequency is reduced to collect the timing indicator data using the reduced sampling frequency.

5. The method according to claim 2, characterized in that The performing window normalization processing on the time series indicator data to obtain multiple indicator deviation data according to the time series indicator data after the window normalization processing includes: For each sliding window corresponding to the sampling frequency, the time series indicator data is standardized to obtain standard time series indicator data; Determining an indicator difference between the standard timing indicator data and ideal data corresponding to the standard timing indicator data; Based on the indicator difference and the preset indicator weights corresponding to the standard time series indicator data, weighted aggregation processing is performed on the standard time series indicator data of each data category to obtain multi-indicator deviation data of each data category.

6. The method according to claim 2, characterized in that The acquiring of log data generated by the system to be evaluated and merging the log data based on similarity of the log data to obtain merged log data includes: Obtaining log data generated by the system to be evaluated; Parsing the log data to extract keywords and parameter positions in the log data; Based on the keyword and the parameter position, the similarity corresponding to the log data is determined, and the log data with a similarity greater than or equal to a preset similarity threshold is merged to obtain merged log data.

7. The method according to claim 2, characterized in that The performing anomaly analysis on the multi-indicator deviation data and the merged log data to obtain the monitoring indicator deviation corresponding to the multi-indicator deviation data and the log anomaly probability corresponding to the merged log data includes: The prediction model is trained based on the training set and the validation set corresponding to the original multi-index deviation data, and the trained prediction model is validated using the test set of the original multi-index deviation data to obtain a validation result; If the verification result of the prediction model is normal, the multi-index deviation data is input into the trained prediction model to obtain the deviation of the proctoring index output by the trained prediction model.

8. The method according to claim 7, characterized in that The prediction model is trained based on the training set and the validation set corresponding to the original multi-index deviation data, and the trained prediction model is validated using the test set of the original multi-index deviation data, and the validation results obtained include: Preprocessing the original multi-index deviation data to obtain a training set, a validation set, and a test set corresponding to the multi-index deviation data; Inputting the training set into the prediction model and performing forward propagation to determine the loss value of the loss function of the prediction model; Based on the loss value and the validation set, back-propagation is used to update the parameters of the prediction model until the loss function converges, thereby obtaining the trained prediction model; The validation set is used to validate the monitoring indicator deviation output by the trained prediction model to obtain a validation result.

9. The method according to claim 2, characterized in that The performing anomaly analysis on the multi-indicator deviation data and the merged log data to obtain the monitoring indicator deviation corresponding to the multi-indicator deviation data and the log anomaly probability corresponding to the merged log data includes: Segmenting the merged log data, and converting the segmented merged log data into a target format corresponding to a semantic analysis model to obtain target log data; Extracting log features of the target log data through the semantic analysis model, and using log features marked as target marks in the log features as semantic coding features of the target log data; Based on a preset neural network, the semantic coding features and the log features are classified as abnormal, and the abnormal probability of the merged log data being in different abnormal categories is determined; Based on the abnormality probability, a log abnormality probability corresponding to the merged log data is determined.

10. The method according to claim 1, characterized in that The performing of a recovery operation on the system to be evaluated according to the health score includes: Determining a preset interval corresponding to the health score; Execute the recovery operation corresponding to the preset interval.

11. The method according to claim 10, characterized in that The performing of the recovery operation corresponding to the preset interval includes: If the preset interval is the first preset interval, shutting down non-core functions of the system to be evaluated; If the preset interval is the second preset interval, restarting the system to be evaluated; If the preset interval is the third preset interval, a backup system corresponding to the system to be evaluated is determined, and the system to be evaluated is switched to the backup system.

12. An electronic device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the health assessment method according to any one of claims 1 to 11 when executing the computer program.

13. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the health assessment method according to any one of claims 1 to 11.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the health assessment method according to any one of claims 1 to 11 are implemented.

Images