Fault feature extraction method, electronic device and storage medium

Abstract

The present application discloses a fault feature extraction method, electronic device and storage medium, relating to the field of server technology, the method comprising: obtaining current operating data of a server; the current operating data comprising current eigenvalues ​​of multiple dimensions; extracting a fault feature set from the current operating data, and calculating the importance score of the current eigenvalue of one dimension in the current operating data; the fault feature set comprising multiple first eigenvectors; adjusting the individual first eigenvectors in the fault feature set according to the importance score of the current eigenvalue of one dimension in the current operating data to obtain the updated fault feature set; the updated fault feature set is used for fault detection, which solves the problem in related technologies that feature information related to the fault cannot be fully captured, resulting in limited prediction capabilities of the fault prediction model.

Description

Technical Field

[0001] The present application relates to the field of server management technology, and in particular to a fault feature extraction method, an electronic device, and a storage medium. Background Art

[0002] Server management methods refer to a set of technologies and processes used to monitor, maintain, and optimize server performance, aiming to ensure high server availability, stability, and security. Traditional server management methods fail to fully capture fault-related feature information during feature extraction, limiting the predictive power of fault prediction models. Summary of the Invention

[0003] The present application provides a fault feature extraction method, an electronic device, and a storage medium to at least solve the problem in related technologies that the feature information related to the fault cannot be fully captured, resulting in limited prediction capabilities of the fault prediction model.

[0004] The present application provides a fault feature extraction method, including: obtaining current operating data of a server; the current operating data includes current feature values ​​of multiple dimensions; extracting a fault feature set from the current operating data, and calculating the importance score of the current feature value of one dimension in the current operating data; the fault feature set includes multiple first feature vectors; adjusting the individual first feature vectors in the fault feature set according to the importance score of the current feature value of one dimension in the current operating data to obtain the updated fault feature set; the updated fault feature set is used for fault detection.

[0005] The present application also provides a fault feature extraction device, including: an acquisition module, used to obtain current operating data of a server; the current operating data includes current feature values ​​of multiple dimensions; a feature extraction module, used to extract a fault feature set from the current operating data, and calculate the importance score of the current feature value of one dimension in the current operating data; the fault feature set includes multiple first feature vectors; a feature update module, used to adjust the individual first feature vectors in the fault feature set according to the importance score of the current feature value of one dimension in the current operating data to obtain the updated fault feature set; the updated fault feature set is used for fault detection.

[0006] The present application also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-mentioned fault feature extraction methods when executing the computer program.

[0007] The present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned fault feature extraction methods are implemented.

[0008] The present application also provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned fault feature extraction methods when executed by a processor.

[0009] Through the present application, a fault feature set is extracted from the current operating data of the server obtained in real time, and the importance score of the current feature value of a dimension in the current operating data is calculated. The importance score reflects the actual influence of the feature on fault prediction at a specific time point. Unlike the previous static feature weights, the importance score can be adaptively adjusted according to different operating states and scenarios, ensuring the dynamic and flexibility of the feature set; according to the importance score of the current feature value of a dimension in the current operating data, the monomer first feature vector in the fault feature set is adjusted in real time and intelligently to obtain an updated fault feature set, wherein the updated fault feature set is optimized according to its importance in the current data state. Therefore, when the fault prediction model performs fault detection based on the updated fault feature set, it can capture key information related to the fault in real time, significantly enhancing the accuracy and reliability of fault prediction, and solving the problem that the related technology cannot fully capture the feature information related to the fault, resulting in limited prediction ability of the fault prediction model. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0011] Figure 1 This is an application scenario diagram of a fault feature extraction method provided in an embodiment of the present application.

[0012] Figure 2 A flowchart of a fault feature extraction method provided in an embodiment of the present application.

[0013] Figure 3 A flowchart of server failure handling provided in an embodiment of the present application.

[0014] Figure 4 A structural diagram of a server management system provided in an embodiment of the present application.

[0015] Figure 5 This is a structural diagram of a fault feature extraction device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0016] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0017] It should be noted that, in the description of this application, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. The terms "first," "second," etc., in this application are used to distinguish similar objects, and are not used to describe a particular order or sequence.

[0018] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0019] According to one aspect of the embodiment of the present application, a fault feature extraction method is provided. Optionally, in this embodiment, the fault feature extraction method can be applied to, but is not limited to, Figure 1 The hardware environment shown includes a terminal device 102 and a server 104. The server 104 can be connected to the terminal device 102 via a network and can be used to provide services (e.g., application services, etc.) for the terminal device 102 or a client installed on the terminal device 102. A database can be set on the server 104 or independently of the server 104 to provide data storage services for the server 104.

[0020] The aforementioned network may include, but is not limited to, at least one of the following: a wired network and a wireless network. The aforementioned wired network may include, but is not limited to, at least one of the following: a wide area network, a metropolitan area network, or a local area network. The aforementioned wireless network may include, but is not limited to, at least one of the following: wireless fidelity (Wi-Fi) and Bluetooth. The terminal device 102 may be, but is not limited to, a personal computer (PC), a mobile phone, a tablet computer, etc. The server 104 may be, but is not limited to, a cloud server, a server, or other server types.

[0021] The fault feature extraction method of the embodiment of the present application can be executed by the server 104, or by the terminal device 102, or jointly by the server 104 and the terminal device 102. The fault feature extraction method of the embodiment of the present application can also be executed by the client installed on the terminal device 102.

[0022] Taking the server 104 as an example to execute the fault feature extraction method in this embodiment, Figure 2 FIG. 1 is a flow chart of an optional fault feature extraction method according to an embodiment of the present application, such as Figure 2 As shown, the process of the method may include the following steps:

[0023] Step S202, obtaining the current operation data of the server; the current operation data includes current feature values ​​of multiple dimensions.

[0024] The fault feature extraction method provided in this embodiment can be applied in the field of electronic device fault detection, wherein the electronic device can be a terminal device, a server, or other electronic devices.

[0025] Current operation data refers to a collection of real-time data generated by the server at a specific point in time that reflects its operating status. For example, current operation data includes, but is not limited to, multi-dimensional performance indicators such as central processing unit (CPU) usage, memory usage, disk input / output (I / O), and network traffic.

[0026] The current multi-dimensional eigenvalues ​​refer to the specific values ​​of various performance indicators in the current running data. Each indicator corresponds to a dimension, and the eigenvalue is the actual observed value in that dimension. For example, CPU utilization of 75% and memory usage of 3GB are the eigenvalues ​​of the current running data in different dimensions.

[0027] Step S204 : extracting a fault feature set from the current operating data, and calculating an importance score of a current feature value of a dimension in the current operating data.

[0028] The fault signature set refers to a combination of data features or indicators extracted from the server's current operating data that are closely related to the likelihood of a fault occurring. The fault signature set is identified and selected using statistical methods and machine learning algorithms to build a fault prediction model.

[0029] The current feature value of a dimension refers to the real-time observed value of a specific performance metric (such as CPU usage) in the current operating data. It represents a specific slice of multidimensional data. The importance score of the current feature value of a dimension indicates the contribution of the feature value of that dimension in the current operating data to the output of the fault prediction model. A higher importance score indicates a more significant role of the feature in fault prediction. The importance score of the current feature value of a dimension in the current operating data can be calculated using a machine learning model or by measuring the correlation between features through multivariate statistical analysis. For example, suppose a machine learning model (such as a neural network) has been trained for server failure prediction. During the server failure prediction training phase, the number of times the current eigenvalue of a dimension in the current running data is used to update weights during the gradient descent process and the changing trend of the resulting gradient size are recorded. The total number of times the current eigenvalue of a dimension in the current running data is referenced throughout the training process is calculated, which reflects the level of activity of the current eigenvalue of a dimension in the current running data in the model decision-making process. The gradient update size associated with the reference of the current eigenvalue of a dimension in the current running data is analyzed. A larger gradient update means that the current eigenvalue of a dimension in the current running data has a more significant impact on the server failure prediction output, and therefore has a higher importance score. For example, a multivariate statistical correlation matrix can be constructed based on the server running data to reflect the linear and nonlinear correlation between different eigenvalues. Various statistical indicators, such as the Pearson correlation coefficient and the Spearman rank correlation coefficient, are used to analyze the correlation matrix and identify feature sets that are highly correlated with failure events. Statistical tools such as conditional entropy and standard error in regression analysis are used to quantify the strength of the association between key factors and failure events. Based on the above analysis results, a scoring system is established to quantify the importance of the current eigenvalue of a dimension in the current running data.

[0030] Step S206 , adjusting the single first eigenvector in the fault feature set according to the importance score of the current eigenvalue of one dimension in the current operating data to obtain an updated fault feature set; the updated fault feature set is used for fault detection.

[0031] The process of adjusting the individual first feature vectors in the fault feature set refers to the process of modifying or optimizing a specific feature in the fault feature set based on an importance score. For example, a fusion strategy can be designed, such as using the importance score of the current feature value of a dimension in the current operating data as a weight. Based on this weight, the current feature value of a dimension in the current operating data is fused with other relevant features to update the fault feature set. For example, a scoring threshold can be set to reduce the dimensionality of individual first feature vectors in the fault feature set whose importance score is less than or equal to the scoring threshold. For example, a complex system log feature can be simplified to a count of key events, or multiple low-scoring features can be merged into a comprehensive feature. Feature enhancement is performed on individual first feature vectors in the fault feature set whose importance score is greater than the scoring threshold. The low-scoring features after dimensionality reduction are fused with the high-scoring features after dimensionality reduction to obtain reconstructed high-scoring features. The reconstructed high-scoring features and the low-scoring features after dimensionality reduction are then determined as the updated fault feature set. The updated fault feature set more accurately reflects key information about the server's operating status and is used to optimize the fault prediction model, improving its performance and reducing false positives and false negatives.

[0032] Through the embodiments of the present application, a fault feature set is extracted from the current operating data of the server obtained in real time, and the importance score of the current feature value of a dimension in the current operating data is calculated. The importance score reflects the actual influence of the feature on fault prediction at a specific time point. Unlike the previous static feature weights, the importance score can be adaptively adjusted according to different operating states and scenarios, ensuring the dynamic and flexibility of the feature set; according to the importance score of the current feature value of a dimension in the current operating data, the monomer first feature vector in the fault feature set is adjusted in real time and intelligently to obtain an updated fault feature set, wherein the updated fault feature set is optimized according to its importance in the current data state. Therefore, when the fault prediction model performs fault detection based on the updated fault feature set, it can capture key information related to the fault in real time, significantly enhancing the accuracy and reliability of fault prediction, and solving the problem that the related technology cannot fully capture the feature information related to the fault, resulting in limited prediction ability of the fault prediction model.

[0033] In one exemplary embodiment, in the field of server management methods, related server management often relies on data collection methods that rely on scheduled polling or manual triggering. This method is not only inefficient but also difficult to implement real-time monitoring. Therefore, to address the above issues, in this embodiment, obtaining the current operating data of the server includes: collecting the current operating data through a collection component pre-deployed in the server; the configuration parameters of the collection component are configured based on the number of nodes in the server cluster and the network environment.

[0034] The server can be a server in a server cluster. The server cluster can be a Kafka cluster. The collection component refers to a software or hardware module pre-deployed on the server, whose primary function is to collect server operational data in real time. For example, the collection component can be a Kafka producer, a client program responsible for publishing data to a specific topic in the Kafka cluster. Its main task is to collect server operational data (such as CPU usage, memory usage, disk I / O, and network traffic) in real time and then send this data to a specified Topic (a unit for classifying or storing messages) in the Kafka cluster. The configuration parameters of the collection component are settings used to customize the runtime characteristics of the collection component. They are primarily adjusted based on the number of nodes in the server cluster and the network environment. For example, the configuration parameters of the collection component include the number of brokers (message agents) and the number of topic partitions in the Kafka cluster.

[0035] Through this embodiment, the collection component is deployed on the server in advance, so that the server's operating data can be continuously collected, instead of relying on periodic task scheduling or manual triggering, thereby improving the collection efficiency and real-time performance; the configuration parameters of the collection component will be automatically adjusted according to the number of cluster nodes and the network environment in which the server is located. The configuration parameters of the collection component can be flexibly configured to adapt to server clusters of different sizes and maintain efficient data transmission performance in a high-concurrency environment, which not only improves the reliability and real-time performance of data collection, but also provides a solid foundation for subsequent data processing and analysis.

[0036] In an exemplary embodiment, before extracting the fault feature set from the current operating data, the method further includes:

[0037] 1. Identify, remove, and fill the first abnormal data point in the current running data to obtain the cleaned current running data; the first abnormal data point refers to a data point whose characteristic value is not within a preset range.

[0038] 2. Convert the format of the cleaned current running data to obtain the current running data in a unified format.

[0039] 3. Verify the current operating data in the unified format, identify and correct the second abnormal data point, and obtain the processed current operating data; the second abnormal data point refers to a data point that does not conform to the historical behavior pattern or trend.

[0040] A first outlier data point refers to a data point in server performance data whose characteristic value (such as CPU usage, memory usage, disk I / O, network traffic, etc.) exceeds the preset normal range. By identifying and removing first outlier data points and filling them with appropriate methods (such as interpolation), more accurate and reliable server performance data can be obtained.

[0041] Secondary outlier data points are those in the cleaned current operating data whose values ​​or behavior patterns significantly deviate from the normal behavior or trends in the historical data. These points are typically identified using machine learning algorithms (such as time series analysis and cluster analysis). Machine learning algorithms learn and understand the behavioral patterns of historical operating data and identify them as secondary outliers when the current operating data deviates from these patterns. Correcting secondary outlier data points helps further improve data quality, reduce noise interference during fault prediction model training and prediction, and thus enhance the performance and reliability of the fault prediction model.

[0042] Optionally, the server performs preliminary cleaning of the current operating data of the server based on a statistical outlier detection algorithm, identifies and removes first abnormal data points that significantly deviate from the normal range, and obtains the current operating data after preliminary cleaning; applies interpolation to fill in the small number of suspected first abnormal data points that still exist after cleaning, and obtains the final cleaned current operating data; according to a predefined data format standard, converts the final cleaned current operating data into current operating data in a unified format; uses a machine learning algorithm to perform a secondary check on the current operating data in the unified format, identifies and corrects the missed second abnormal data points, and obtains high-quality server operating data.

[0043] Among them, a machine learning algorithm is used to perform a secondary check on the current running data in a unified format to identify and correct the missed second abnormal data points, including:

[0044] Perform feature selection and standardization on the current running data in a unified format, extract key performance indicators including CPU usage, memory usage, disk I / O and network traffic, and construct feature vectors for anomaly detection; build an anomaly detection model based on the training data set, and the machine learning algorithms used include one or more combinations of isolation forest, local anomaly factor, autoencoder or support vector machine; input the current running data in a unified format into the anomaly detection model, and identify potential second anomaly data points through the anomaly score or classification results output by the anomaly detection model; for the identified second anomaly data points, use the interpolation method to correct them through the prediction model combined with the time series context information, where the prediction model includes but is not limited to the ARIMA or LSTM time series prediction model; finally, verify the corrected current running data to determine whether the corrected current running data meets expectations. If anomalies still exist, return to adjust the anomaly detection model parameters or correction strategy to achieve closed-loop processing and continuous optimization of the second anomaly data, and obtain high-quality server operation data.

[0045] Through this embodiment, the first abnormal data point whose characteristic value exceeds the preset range is removed, and the interpolation method is used to fill the gap to ensure data integrity; the cleaned data is then converted into a unified format to enhance cross-system compatibility; finally, through deep verification by a machine learning algorithm, the second abnormal data point that does not conform to historical behavior is corrected, which significantly improves the data quality. By carefully cleaning and standardizing the current operating data of the server, the impact of noise and erroneous information can be effectively reduced, and the quality of the data can be improved, thereby enhancing the robustness and prediction accuracy of the fault prediction model, and effectively solving the problems of low data collection efficiency, difficulty in real-time monitoring, and accuracy of analysis affected by data anomalies in related server management.

[0046] In an exemplary embodiment, extracting a fault feature set from current operating data includes:

[0047] 1. Calculate the covariance matrix corresponding to the current running data; the covariance matrix represents the linear correlation between different indicators in the current running data.

[0048] The covariance matrix is ​​a mathematical tool used to characterize the linear correlation between different indicators in the current operation data of the server. The elements in the covariance matrix are covariance values, which describe the strength and direction of the linear relationship between different variables in the current operation data. Specifically, if the covariance matrix is ​​the eigenvalues ​​of m dimensions in the current operation data ({x1, x2, ..., x m}), then the i-th row and j-th column element of the covariance matrix is ​​the variable x i and x jThe larger the covariance value, the stronger the linear dependence between the two indicators.

[0049] 2. Perform eigenvalue decomposition on the covariance matrix to obtain multiple principal component eigenvalues ​​and multiple second eigenvectors corresponding to the multiple principal component eigenvalues.

[0050] Eigenvalue decomposition is a linear algebraic method that decomposes the covariance matrix into principal component eigenvalues ​​and corresponding second eigenvectors. Principal component eigenvalues ​​are a series of numerical values ​​obtained by eigenvalue decomposition of the covariance matrix of the server's current running data. Each principal component eigenvalue corresponds to a second eigenvector of the covariance matrix, and the magnitude of the principal component eigenvalue reflects the data variance in the direction of the corresponding second eigenvector. The second eigenvector is the eigenvector corresponding to the principal component eigenvalue obtained through eigenvalue decomposition. Each principal component eigenvalue corresponds to a second eigenvector, and the second eigenvectors form a new orthogonal coordinate system, where the direction of each second eigenvector represents the primary trend of data variation in that direction. As the direction of the principal component, the second eigenvector indicates the weight of each dimension (such as CPU utilization, memory usage, network traffic, and disk I / O) in the server's current running data in the new coordinate system.

[0051] 3. Arrange multiple second eigenvectors in descending order of the principal component eigenvalues, select the second eigenvector starting from the largest principal component eigenvalue, and when the selected second eigenvectors meet a preset condition, determine the selected second eigenvectors as multiple first eigenvectors to obtain a fault feature set; the preset condition refers to the condition that the cumulative contribution rate of the selected second eigenvectors is greater than a preset contribution rate threshold.

[0052] The cumulative contribution rate refers to the sum of the proportions of the total variance explained by the selected second eigenvectors in principal component analysis (PCA) or factor analysis to the total variance of the server's current operating data. The fault feature set in this embodiment refers to a data set obtained by selecting a set of second eigenvectors from the eigenvalue decomposition results of the covariance matrix according to the condition that the cumulative contribution rate is greater than a preset contribution rate threshold. The cumulative contribution rate is used to measure the importance of the second eigenvector. The larger the principal component eigenvalue, the stronger the corresponding second eigenvector's ability to explain the data.

[0053] Optionally, based on the current operating data of a high-quality server, the covariance matrix corresponding to the current operating data of the server is calculated, and the eigenvalue decomposition of the covariance matrix is ​​performed to obtain multiple principal component eigenvalues ​​and corresponding second eigenvectors; multiple second eigenvectors are arranged in descending order according to the principal component eigenvalues, and k second eigenvectors are selected starting from the maximum principal component eigenvalue, with k starting from 1. After each selection, the cumulative contribution rate of the selected k second eigenvectors is calculated until the cumulative contribution rate of the selected k second eigenvectors is greater than a preset contribution rate threshold, and the selected k second eigenvectors are used as k first eigenvectors, which are also called k principal components, and the selected second eigenvectors are determined as the fault feature set. The cumulative contribution rate of the k second eigenvectors can be calculated according to the following formula (1):

[0054]

[0055] in, is the cumulative contribution rate of the k second eigenvectors, is the principal component eigenvalue corresponding to the jth second eigenvector selected, is the sum of all principal component eigenvalues ​​obtained after decomposition of the covariance matrix, Represents the total number of principal component eigenvalues ​​obtained after covariance matrix decomposition.

[0056] For example, suppose that eigenvalue decomposition of the covariance matrix yields four principal component eigenvalues: [2.4, 0.5, 0.08, 0.02] and a 4x4 matrix of second eigenvectors. Each column in the matrix represents a second eigenvector, corresponding one-to-one to a principal component eigenvalue. Assuming that the second eigenvectors corresponding to the principal component eigenvalue 2.4 are [0.6, 0.7, 0.1, 0.3], this means that the weights of the four features (CPU usage, memory usage, network traffic, and disk I / O) in the main direction of data change are 0.6, 0.7, 0.1, and 0.3, respectively. After sorting the second eigenvectors in descending order of principal component eigenvalue, if the cumulative contribution rate of the two selected second eigenvectors is 95% and the preset contribution rate threshold is 90%, then these two selected second eigenvectors are used as the fault feature set.

[0057] This embodiment uses a covariance matrix to analyze the linear correlations between different indicators in the server's current operating data in real time, thereby quickly capturing potential connections between indicators and improving the sensitivity of fault prediction. Eigenvalue decomposition of the covariance matrix extracts key information from the covariance matrix, enabling the acquisition of eigenvalues ​​and corresponding eigenvectors representing the direction and intensity of data changes. Eigenvectors are then sorted by eigenvalue, and a fault feature set is selected based on the principle that the cumulative contribution rate is greater than a preset contribution rate threshold. This avoids interference from redundant information, ensures that the fault prediction model focuses on the most important data dimensions, and thus improves the accuracy of the fault prediction model.

[0058] In an exemplary embodiment, calculating the importance score of a current eigenvalue of a dimension in current operating data includes: obtaining historical operating data of a server; the historical operating data includes historical eigenvalues ​​of multiple dimensions; determining the historical mean and standard deviation of the eigenvalue of a dimension in the current operating data based on the historical operating data; determining the importance score of the current eigenvalue of a dimension in the current operating data based on the current eigenvalue, historical mean, standard deviation and a first preset weight of the dimension in the current operating data.

[0059] The historical mean of a dimension in the current operating data reflects the average operating status of the server over a long period of time. It estimates the central tendency of the server's performance metrics under past normal operating conditions. When calculating the importance score of the current feature value, the historical mean serves as a reference point to measure whether the current feature value deviates from the normal operating level over a long period of time.

[0060] The standard deviation is a statistical metric that measures the fluctuation range of the feature value for that dimension in historical operational data. It indicates the average difference between the data points in the historical operational data and the historical mean. A larger standard deviation indicates greater variability in the feature value, which may be more sensitive to server health and indicate a higher potential risk. When determining the importance score, the standard deviation can be used to determine the degree of abnormality of the current feature value, that is, how severe its deviation from the historical mean is.

[0061] The first preset weight is pre-set according to the frequency of occurrence and impact of the current eigenvalue in historical fault cases, and it assigns each eigenvalue an importance level in fault warning.

[0062] For example, the historical feature values ​​of four dimensions (CPU usage, memory usage, network traffic, and disk I / O) of a server at different time points (for example, 10 time points) are shown in Table 1:

[0063] Table 1

[0064]

[0065] Based on the eigenvalues ​​in each column of Table 1, calculate the historical mean and standard deviation of the current eigenvalue for each dimension in the current running data. For example, for the dimension of CPU usage, calculate the historical mean and standard deviation of the eigenvalues ​​of the CPU usage dimension based on the historical eigenvalues ​​of CPU usage at 10 time points.

[0066] In one embodiment, the importance score of the current feature value of a dimension in the current running data can be calculated according to the following formula (2):

[0067]

[0068] in, is the importance score of the current feature value of a dimension in the current running data; is the current feature value of a dimension in the current running data; It is the historical mean of the current feature value of a dimension in the current running data; is the standard deviation of the current eigenvalue of a dimension in the current running data; is the first preset weight.

[0069] Through this embodiment, when calculating the importance score of the characteristic value in the server operation data, the current characteristic value, historical mean, standard deviation and first preset weight are combined, wherein the historical mean and standard deviation represent the operation mode and data fluctuation range over a long period of time. By comparing the current characteristic value with the historical mean and standard deviation, the degree of deviation of the current state from the normal range can be evaluated, thereby determining the normal fluctuations and potential fault signals in the current operation data of the server, and dynamically adjusting the importance score in combination with the first preset weight, thereby assigning a reasonable importance score to the current characteristic value of a dimension in the current operation data, thereby improving the accuracy of the importance score of the current characteristic value of a dimension in the current operation data.

[0070] In an exemplary embodiment, adjusting the first feature vector of a single entity in the fault feature set according to the importance score of the current feature value of a dimension in the current operating data to obtain an updated fault feature set includes:

[0071] 1. According to the importance score of the current eigenvalue of a dimension in the current running data, a weighted sum is performed on the current eigenvalue of a dimension in the current running data to obtain a first contribution corresponding to the current running data.

[0072] As can be seen from the above embodiment, the multiple first eigenvectors are eigenvectors extracted after principal component analysis of the current operating data; each individual first eigenvector in the multiple first eigenvectors corresponds to a principal component eigenvalue. The calculation process of the first eigenvectors and principal component eigenvalues ​​will not be reiterated here.

[0073] The first contribution degree is the degree of influence of the characteristic value of a dimension in the current operating data on the overall data set, calculated based on the current characteristic value of the dimension and its importance score, and is used to quantify the direct impact of the characteristic value in the current operating data on the health status of the server. In this embodiment, in the process of calculating the first contribution degree corresponding to the current operating data, the importance score of the current characteristic value of a dimension in the current operating data is used as an adaptive weight to quantify the sensitivity and influence of the current characteristic value of the dimension on changes in the server status. Specifically, the importance score is a measure of the direct contribution of the current characteristic value of a specific dimension (such as CPU usage, memory usage, etc.) to the prediction of potential failures when characterizing the server operating status at a given point in time.

[0074] Optionally, the server calculates the product of the current eigenvalue of each dimension in the current running data and its importance score, and then determines the sum of the products of the current eigenvalue of each dimension in the current running data and its importance score as the first contribution corresponding to the current running data.

[0075] 2. Calculate the product between the first eigenvector of the monomer in the fault feature set and the corresponding principal component eigenvalue, and determine the product result as the second contribution degree of the first eigenvector of the monomer in the fault feature set.

[0076] As can be seen from the above embodiment, the fault feature set includes k first eigenvectors extracted through principal component analysis, where the k first eigenvectors are k second eigenvectors selected from the covariance matrix, and each principal component eigenvalue corresponds to a second eigenvector. In this embodiment, the second contribution refers to the product of each individual first eigenvector in the fault feature set and its corresponding principal component eigenvalue, reflecting the contribution of each individual first eigenvector in the fault feature set to fault prediction.

[0077] 3. Determine the sum of the second contribution of the first characteristic vector of the single unit in the fault feature set and the first contribution corresponding to the current operating data as the updated first characteristic vector of the single unit in the fault feature set to obtain an updated fault feature set.

[0078] Among them, the updated single-unit first feature vector in the fault feature set can be expressed as shown in the following formula (3):

[0079]

[0080] in, represents the updated eigenvector of the jth first eigenvector, represents the principal component eigenvalue corresponding to the jth first eigenvector, Indicates the The first eigenvector, Indicates the The second contribution of the first eigenvector, represents the total number of current feature values ​​in the current operating parameters of the server, and f represents the f-th feature in the current operating parameters of the server; is the importance score of the current feature value of a dimension in the current running data; is the current feature value of a dimension in the current running data; Indicates the first contribution corresponding to the current running data.

[0081] For example, assuming that the total number of current feature values ​​in the current operating parameters of the server is 4, that is, m is 4, assuming The value of is 8. Perform eigenvalue decomposition on the covariance matrix to obtain four principal component eigenvalues ​​[2.4, 0.5, 0.08, 0.02] and a 4x4 second eigenvector matrix. Each column in the second eigenvector matrix represents a second eigenvector, which corresponds one-to-one to the principal component eigenvalue. The fault feature set includes the second eigenvector corresponding to the principal component eigenvalue [2.4, 0.5]. Among them, the second eigenvector corresponding to the principal component eigenvalue 2.4 is [0.6, 0.7, 0.1, 0.3]. The updated eigenvector of the second eigenvector [0.6, 0.7, 0.1, 0.3] is expressed as follows:

[0082]

[0083] Through this embodiment, the sum of the second contribution degree of the single-unit first feature vector in the fault feature set and the first contribution degree corresponding to the current operating data is determined as the updated single-unit first feature vector in the fault feature set, and an updated fault feature set is obtained. The updated fault feature set integrates the analysis results of real-time data and historical data, ensuring that the fault prediction model not only has the robustness based on historical data, but can also promptly reflect changes in recent operating trends, thereby making more accurate and timely fault warnings.

[0084] In an exemplary embodiment, the relevant fault warning system has problems such as delayed warning or frequent false alarms, which affects the stable operation of the server. To solve this problem, the above-mentioned fault feature extraction method further includes the following steps:

[0085] First, input the updated fault feature set into the pre-trained fault prediction model to obtain a prediction value, which represents the possibility of server failure.

[0086] The fault prediction model is built using a machine learning algorithm and is used to output a predicted value for server failure based on input fault characteristics. This predicted value is an estimated probability of a potential server failure, as output by the fault prediction model. For example, this predicted value can be a server failure probability value or a server failure probability score.

[0087] In some embodiments, the updated fault signature set It can also be used to train fault prediction models. For example, the fault prediction model selects the random forest RF algorithm. As a powerful ensemble learning method, random forest has good generalization ability and anti-overfitting ability. As a training set, it is input into the fault prediction model for training. The training process expression is shown in the following formula (5):

[0088]

[0089] in, To represent the trained fault prediction model, For the training set.

[0090] After obtaining the trained fault prediction model, a new data set to be predicted can be prepared, and a new set of fault features can be extracted according to the above fault feature extraction method. , the fault characteristics Input to the trained fault prediction model The prediction process is expressed as follows:

[0091]

[0092] in, Represents a fault prediction model Output predicted value.

[0093] 2. When the predicted value is greater than the warning threshold, a warning message is generated; the warning threshold is determined based on current operating data; the warning message includes response operation process information, and the response operation process information includes multiple operation steps.

[0094] The warning threshold is a standard value used to determine whether the server's operating status is approaching or reaching a critical point of possible failure. The warning threshold is dynamically generated based on current operating data. By setting a reasonable warning threshold, you can accurately determine the risk of failure. Dynamic adjustment of the warning threshold, combined with detailed warning information, allows you to promptly identify potential problems and take appropriate measures, thereby minimizing the impact of failures on the system.

[0095] Warning messages are notifications automatically generated by the server when a predicted value exceeds a warning threshold. For example, warning messages can include key information such as server identification, failure probability, and recommended response steps and their order of execution. Warning messages serve as a bridge between failure prediction and automated response mechanisms, guiding server and maintenance personnel to quickly identify and respond to potential server failures.

[0096] Response action flow information is a component of early warning information. It defines a series of predefined action steps that the server should execute when a failure risk is detected to restore the server from the warning state to normal operation. For example, a series of predefined action steps may include data backup, service migration, and resource allocation adjustment.

[0097] In an exemplary embodiment, when the predicted value is greater than the warning threshold, generating warning information includes:

[0098] When the predicted value is greater than the warning threshold, a target warning level is determined from multiple warning levels, wherein each warning level corresponds to a threshold range, wherein the threshold range is obtained based on real-time data analysis of the current operating status of the server; each warning level corresponds to a set of response operation process templates, and each response operation process template contains a series of operation steps, such as resource adjustment, service degradation, fault isolation, emergency shutdown, etc.; according to the fault type and the current operating data of the server, a target response operation process template is determined from a set of response operation process templates corresponding to the target warning level, and the target response operation process template is adjusted according to the current operating data of the server; based on the adjusted target response operation process template, a response operation process list is generated, and multiple operation steps in the response operation process list are sorted according to execution priority, and each step will clearly indicate the command to be executed and the expected effect; warning information is generated based on the response operation process list.

[0099] Multiple warning levels are pre-set based on historical fault data. For example, historical fault data is collected, including information such as fault type, fault impact, processing time, and business loss. Using clustering algorithms or decision tree models, these historical fault data is divided into three levels: minor fault, moderate fault, and severe fault.

[0100] When selecting the target response operation process template, a scenario feature vector is extracted from each response operation process template in a set of response operation process templates corresponding to the target warning level, and the fault type and the current operation data of the server are vectorized to obtain an operation state vector. The operation state vector is matched with the scenario feature vector of each response operation process template, and the response operation process template with the highest matching degree is selected as the target response operation process template.

[0101] For example, if a server's CPU usage exceeds the dynamically adjusted warning threshold, the system automatically identifies this fault as a moderate fault (warning level II). Based on the moderate fault response process template, the generated warning information includes: fault description (e.g., abnormal increase in CPU usage), estimated impact (e.g., possible service response delays), and recommended response process (e.g., Step 1: Increase CPU and memory resource allocation; Step 2: Monitor fault recovery; if ineffective, proceed to Step 3: Start a backup server; Step 4: Back up critical data; Step 5: Analyze the cause of the high CPU load and perform targeted optimization).

[0102] Through this embodiment, the predicted value is compared with the dynamically adjusted warning threshold, and the target warning level is determined in combination with the real-time operating status of the server. For each warning level, a set of response operation process templates containing multiple operation steps is preset. By extracting the situational feature vector related to the fault type and current operating data, and matching it with the situational feature vector of each response operation process template, the target response operation process template that best suits the current situation can be selected, thereby improving the pertinence and effectiveness of the response operation and reducing the possibility of invalid operation or excessive operation.

[0103] 3. Issue an early warning based on the early warning information and execute multiple operation steps according to the timing in the response operation process information.

[0104] Optionally, the server determines the warning threshold based on the current operating data and outputs the predicted value according to the fault prediction model. Determine whether there is a potential failure risk; when the prediction result When the warning threshold is exceeded, the corresponding warning information is generated. The expression for generating the warning information is shown in the following formula (7):

[0105]

[0106] in, Indicates whether to issue a warning message. is the warning threshold; when = When a fault occurs, a detailed warning message is generated; the warning message includes the server ID, failure probability, recommended operation steps, and timestamp. The server executes multiple operation steps according to the execution sequence of each operation step in the warning message.

[0107] Through this embodiment, early warning thresholds are dynamically generated based on current operating data to ensure the timeliness and accuracy of early warnings, avoiding problems such as early warning delays or frequent false alarms due to fixed thresholds. After the early warning information is triggered, the predefined response operation process is automatically executed, including a series of operation steps for fault recovery, without the need for human intervention, reducing the waiting time for fault handling, minimizing the impact of faults on the system, and alleviating the burden on operation and maintenance personnel.

[0108] In an exemplary embodiment, after executing multiple operation steps according to the time sequence in the response operation process information, the fault feature extraction method further includes:

[0109] A performance evaluation is performed on the server after executing multiple operation steps to obtain a fault response processing result; when the fault response processing result is greater than a preset response value, the fault response is stopped.

[0110] In an exemplary embodiment, a performance evaluation is performed on a server after executing multiple operation steps to obtain a fault response processing result, including:

[0111] The preset performance indicators of the server after executing a single operation step in the multiple operation steps are evaluated, and the preset performance indicators of the server after executing a single operation step in the multiple operation steps are integrated to obtain a fault response processing result.

[0112] Preset performance indicators are a set of key performance parameters defined to assess server health, such as CPU utilization, memory usage, disk I / O rate, and network bandwidth usage. These indicators provide a performance baseline for normal server operation and are used to measure changes in server performance before and after fault response operations.

[0113] A single action within multiple action steps is a specific action in response to the action flow information, such as restarting a service, adjusting resource allocation, or performing data recovery. Multiple action steps are designed to directly resolve or mitigate server failures, and each action step has an immediate impact on server performance.

[0114] The fault response processing result refers to the overall evaluation result of the server's preset performance indicators after the server executes a series of operation steps in the response operation process information. The fault response processing result is obtained by comparing the performance indicators before and after the operation, integrating the changing trends of multiple indicators, and is used to evaluate the overall effect of the fault response operation. If the fault response processing result is less than or equal to the preset response value, it means that the response operation has not effectively improved the server's specified performance to a non-fault state, and may even cause performance degradation. In this case, the operation steps need to be readjusted. If the fault response processing result is greater than the preset response value, it means that the response operation has effectively improved the server's specified performance to a non-fault state. In this case, there is no need to adjust the operation steps.

[0115] Preset response values ​​are used to assess whether the fault response results have achieved the expected performance recovery or improvement. These values ​​are determined by analyzing historical fault cases and performance indicators under normal operating conditions, combined with business requirements and server performance tolerances. They aim to ensure that post-fault recovery server performance is no less than or better than pre-fault performance.

[0116] Optionally, the server executes a single operation step, such as restarting the server, adjusting resource allocation, etc., based on the response operation process information in the early warning information, and performs real-time monitoring of the server after executing the single operation step, and collects preset performance indicators, such as CPU utilization, memory usage, disk I / O, etc.; the performance indicators after executing multiple operation steps are integrated and processed, and weighted average, maximum value selection and other methods are used to obtain a comprehensive fault response processing result; the obtained fault response processing result is compared with the preset response value to determine whether the server performance has recovered to the expected level. If the fault response processing result is less than or equal to the preset response value, it indicates that the server's specified performance indicator is lower than the non-fault state, and further fault diagnosis or higher-level response measures may be required. If the fault response processing result is greater than the preset response value, it indicates that the server's specified performance indicator is higher than the non-fault state, and there is no need to change the response measures at this time.

[0117] Through this embodiment, in the fault response, the server performance after executing each operation step is immediately evaluated, and the preset performance indicators of the server after executing multiple operation steps are integrated to obtain a comprehensive fault response processing result, which comprehensively considers the recovery of various performance parameters, avoids the limitations of single indicator evaluation, and ensures the comprehensiveness and high degree of pertinence of the fault response strategy; when the fault response processing result reaches or exceeds the preset response value, it means that the server performance has been restored or improved to a non-fault state, and the subsequent fault response operation steps are automatically stopped, effectively reducing excessive intervention in server operation.

[0118] In an exemplary embodiment, a preset performance indicator of a server after executing a single operation step among multiple operation steps is subjected to fusion processing to obtain a fault response processing result, including:

[0119] Calculate the difference between a first parameter value of a preset performance indicator of the server after executing a single operation step in multiple operation steps and a second parameter value of a preset performance indicator of the server after executing the previous operation step to obtain multiple difference values; and determine the ratio between the sum of the multiple difference values ​​and the total number of steps in the multiple operation steps as the fault response processing result.

[0120] The first parameter value specifically refers to the value of the server's preset performance indicator measured and calculated immediately after executing a single operation step, reflecting the direct impact of the operation execution on server performance. The second parameter value refers to the value of the server's preset performance indicator recorded before executing the current operation step, that is, after the previous operation step is completed. It is used to provide a comparison baseline so that the server can evaluate whether the performance change brought about by the current operation step is positive or negative. The difference between the first and second parameter values ​​reflects the direction of change in the server performance indicator before and after the current operation step is executed. A positive value indicates performance improvement, and a negative value indicates performance degradation.

[0121] In this embodiment, the fault response processing result is obtained by adding all the differences obtained during the execution of multiple operation steps, and then the ratio between the sum of the obtained differences and the total number of operation steps is used as the final evaluation index. The fault response processing result can be expressed by the following formula (8):

[0122]

[0123] in, Indicates the result of fault response processing. Indicates the The first parameter value of the preset performance index after the step operation, Indicates the The second parameter value of the preset performance index after the step operation, is the total number of operation steps.

[0124] According to this embodiment, after each operation step is executed, the difference in the change of the preset performance indicator of the server is immediately calculated, and the first parameter value of the preset performance indicator after the current step is executed is compared with the second parameter value of the preset performance indicator after the previous step is executed to obtain a difference list. This dynamic evaluation mechanism allows real-time monitoring of the actual impact of each operation step on server performance during the fault recovery process, and can promptly identify which operations have a positive contribution to the server performance improvement and which operations are invalid or have a negative impact, thereby quickly adjusting the response strategy to avoid the continued execution of invalid operations, thereby improving resource utilization efficiency and fault recovery speed. Further, all differences obtained after the operation steps are executed are added together and then the ratio is calculated with the total number of operation steps to finally obtain a fault response processing result. The fault response processing result reflects the average degree of server performance improvement, which facilitates the subsequent judgment of whether the response operation is effective and whether the expected performance improvement has been achieved based on the fault response processing result, thereby deciding whether to continue to execute subsequent operations or stop when the preset response value is reached, avoiding excessive intervention, ensuring that the server is restored to an optimal state, and minimizing interference with normal business.

[0125] In an exemplary embodiment, the fault feature extraction method further includes:

[0126] When the fault response processing result is less than or equal to the preset response value, the resource allocation ratio of multiple types of resources in the server is adjusted to obtain a target resource allocation plan, and the resource configuration of the server is adjusted according to the target resource allocation plan.

[0127] Among them, when the fault response processing result is less than or equal to the preset response value, the fault response processing result indicates that the specified performance of the server is less than the performance when the server fails. In this case, the server resource configuration needs to be adjusted; when the fault response processing result is greater than the preset response value, the fault response processing result indicates that the specified performance of the server is greater than the performance when the server fails. In this case, the fault response can be terminated. For example, assuming the preset response value is 0, if the fault response processing result is >0, it means that after executing multiple steps in the response operation process information, the server performance has improved; if the fault response processing result If the value is ≤0, it means that after executing multiple operation steps in the response operation process information, further investigation or other measures are required, such as adjusting the resource allocation ratio of multiple types of resources in the server.

[0128] The resource allocation ratio refers to the proportion of each type of server resource (such as CPU, memory, storage, and network bandwidth) within the total resource pool. If the fault response fails to meet the preset response value, indicating that the current resource allocation is insufficient to effectively address the fault or improve performance, the server will recalculate the resource allocation ratio based on the resource optimization algorithm, hoping to further improve server performance through resource reallocation.

[0129] The target resource allocation plan is a detailed plan for re-planning server resources after adjusting resource allocation ratios. The target resource allocation plan includes specific allocation ratios and adjustment strategies for each resource type to ensure that the server can operate in an optimal state.

[0130] Optionally, the server continuously monitors the results of the fault response process. If it finds that the fault response process results do not meet the preset response value, it immediately initiates the resource optimization process. That is, based on the latest server operation data, it analyzes resource bottlenecks and identifies deficiencies in multiple resource types such as CPU, memory, storage, and network. It uses dynamic resource adjustment strategies, such as prediction models based on historical data and load balancing algorithms, to calculate the optimal allocation ratio of each resource and form a resource allocation ratio adjustment plan. The resource allocation ratio adjustment plan is integrated to formulate a target resource allocation plan. The target resource allocation plan clearly defines the adjustment goals and priorities for each type of resource. Based on the target resource allocation plan, the server's resource configuration is automatically adjusted, including but not limited to adjusting CPU and memory quotas, optimizing storage allocation strategies, and regulating network bandwidth allocation. After the adjustment, the server re-evaluates server performance to ensure that resource optimization has indeed improved the fault response process results. The process is iterated until the preset response value is reached or exceeded.

[0131] This embodiment introduces a mechanism for dynamically adjusting resource allocation based on the results of fault response processing. If the fault response processing result is lower than or equal to the preset response value, indicating that the current resource allocation plan has failed to effectively address the fault, the server will automatically adjust the allocation ratios of multiple resource types and generate a new target resource allocation plan. By real-time monitoring and analyzing the fault response processing results, the server can quickly identify resource allocation deficiencies and make timely adjustments, avoiding poor recovery results or resource waste caused by unreasonable resource allocation. This solves the problems of poor resource scheduling flexibility and delayed fault response evaluation in related technologies.

[0132] In an exemplary embodiment, adjusting resource allocation ratios of multiple resource types in a server to obtain a target resource configuration solution includes:

[0133] Based on the ratio between the current utilization rate of a single type of resource among the multiple types of resources and the maximum resource utilization rate among the multiple types of resources, as well as the second preset weight of a single type of resource among the multiple types of resources, the new resource allocation ratio of the multiple types of resources in the server is determined, and the set of the new resource allocation ratios of the multiple types of resources in the server is determined as the target resource configuration plan.

[0134] The current utilization of a single resource type refers to the ratio of the amount of a resource (such as CPU, memory, disk I / O, network bandwidth, etc.) currently in use on a server to the total amount of that resource at a given moment. The maximum resource utilization refers to the highest ratio of the amount of resources currently in use to the total amount of that resource among all resources on the server.

[0135] The second preset weight is a value pre-determined based on resource type and importance, reflecting the resource's priority and influence in overall resource allocation. This second preset weight is used to appropriately adjust and prioritize different resources when calculating new resource allocation ratios, ensuring that resource allocation plans take into account both the immediate situation and the long-term value of resources and business needs.

[0136] The new resource allocation ratio refers to the optimized value calculated by the server based on the resource dynamic adjustment strategy after the fault response processing result evaluation, which is used to guide the server's future resource allocation. In this embodiment, the new resource allocation ratio can be calculated according to the following formula (9):

[0137]

[0138] in, For the Resource allocation ratio of class resources, For the The current utilization of class resources, Maximum resource utilization for all resources; The second preset weight is determined based on historical data and current demand.

[0139] In this embodiment, the target resource configuration plan is a comprehensive resource optimization plan formed by integrating all single-type resource optimization strategies based on the new resource allocation ratio. Figure 3 A flowchart of a server failure processing provided in an embodiment of the present application is as follows: Figure 3 Shown, including:

[0140] Step S301: using a distributed data collection framework to collect runtime data of each server node to obtain the current running data of the server;

[0141] Step S302: Process the current operation data using a data cleaning and formatting method to obtain high-quality current operation data;

[0142] Step S303: Based on the high-quality current operating data, statistical methods and machine learning algorithms are used to extract key features to obtain a fault feature set;

[0143] Step S304: construct a fault prediction model based on a machine learning algorithm, input the fault feature set into the fault prediction model, and output a predicted value;

[0144] Step S305: setting a threshold based on the server operation data, comparing the predicted value with the warning threshold, and generating a warning message when the predicted value is greater than the warning threshold;

[0145] Step S306: Based on the warning information, an automated response mechanism is used to execute a predefined response operation process to obtain a fault response processing result;

[0146] Step S307: Based on the fault response processing result, a resource dynamic adjustment strategy is adopted to optimize the server resource configuration to obtain a target resource configuration solution.

[0147] Figure 4 A structural diagram of a server management system provided in an embodiment of the present application, such as Figure 4 As shown, the system includes a data acquisition module, a data cleaning module, a feature extraction module, a model building module, an early warning generation module, a response execution module, and a resource optimization module. The data acquisition module is used to implement the aforementioned step S301, the data cleaning module is used to implement the aforementioned step S302, the feature extraction module is used to implement the aforementioned step S303, the model building module is used to implement the aforementioned step S304, the early warning generation module is used to implement the aforementioned step S305, the response execution module is used to implement the aforementioned step S306, and the resource optimization module is used to implement the aforementioned step S307.

[0148] Through this embodiment, the resource allocation ratio is adjusted according to the ratio between the current utilization rate of a single type of resource and the maximum resource utilization rate, which can accurately identify resource bottlenecks and adjust resource allocation in a timely manner to avoid affecting the overall server performance due to excessive use of a certain type of resource. This solves the problem in related technologies that resource management ignores the real-time comparison of resource utilization efficiency, resulting in uneven resource allocation or waste.

[0149] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0150] The embodiment of the present application also provides a fault feature extraction device, such as Figure 5 Shown, including:

[0151] The acquisition module 502 is used to obtain the current operation data of the server; the current operation data includes the current feature values ​​of multiple dimensions;

[0152] Feature extraction module 504, configured to extract a fault feature set from the current operating data and calculate an importance score of a current feature value of a dimension in the current operating data; the fault feature set includes a plurality of first feature vectors;

[0153] The feature updating module 506 is used to adjust the single first feature vector in the fault feature set according to the importance score of the current feature value of a dimension in the current operating data to obtain an updated fault feature set; the updated fault feature set is used for fault detection.

[0154] For the description of the features in the embodiment corresponding to the fault feature extraction device, reference can be made to the relevant description of the embodiment corresponding to the fault feature extraction method, which will not be repeated here.

[0155] In an exemplary embodiment, the collection module 502 is further configured to collect current operation data through a collection component pre-deployed in the server; the configuration parameters of the collection component are configured according to the number of nodes in the server cluster where the server is located and the network environment.

[0156] In an exemplary embodiment, the feature extraction module 504 is also used to identify, remove and fill the first abnormal data point in the current operating data to obtain the cleaned current operating data; the first abnormal data point refers to the data point whose characteristic value is not within the preset range; the cleaned current operating data is formatted to obtain the current operating data in a unified format; the current operating data in the unified format is verified, the second abnormal data point is identified and corrected, and the processed current operating data is obtained; the second abnormal data point refers to the data point that does not conform to the historical behavior pattern or trend.

[0157] In an exemplary embodiment, the feature extraction module 504 is also used to calculate the covariance matrix corresponding to the current operating data; the covariance matrix represents the linear correlation between different indicators in the current operating data; the covariance matrix is ​​subjected to eigenvalue decomposition to obtain multiple principal component eigenvalues, and multiple second eigenvectors corresponding to the multiple principal component eigenvalues; the multiple second eigenvectors are arranged in descending order according to the principal component eigenvalues, and the second eigenvector is selected starting from the largest principal component eigenvalue. When the selected second eigenvector meets a preset condition, the selected second eigenvector is determined as multiple first eigenvectors to obtain a fault feature set; the preset condition refers to the condition that the cumulative contribution rate of the selected second eigenvector is greater than a preset contribution rate threshold.

[0158] In an exemplary embodiment, the feature update module 506 is also used to obtain historical operating data of the server; the historical operating data includes historical feature values ​​of multiple dimensions; based on the historical operating data, the historical mean and standard deviation of the current feature value of a dimension in the current operating data are determined; based on the current feature value, historical mean, standard deviation and first preset weight of a dimension in the current operating data, the importance score of the current feature value of a dimension in the current operating data is determined.

[0159] In an exemplary embodiment, multiple first eigenvectors are eigenvectors extracted after principal component analysis of the current operating data; the individual first eigenvectors in the multiple first eigenvectors correspond to principal component eigenvalues; the feature update module 506 is also used to perform weighted summation of the current eigenvalues ​​of a dimension in the current operating data according to the importance score of the current eigenvalues ​​of a dimension in the current operating data, to obtain the first contribution corresponding to the current operating data; calculate the product between the individual first eigenvector in the fault feature set and the corresponding principal component eigenvalue, and determine the product result as the second contribution of the individual first eigenvector in the fault feature set; determine the sum of the second contribution of the individual first eigenvector in the fault feature set and the first contribution corresponding to the current operating data as the updated individual first eigenvector in the fault feature set, to obtain an updated fault feature set.

[0160] In an exemplary embodiment, the device also includes a fault prediction module, which is used to input the updated fault feature set into a pre-trained fault prediction model to obtain a prediction value, which represents the possibility of a server failure; when the prediction value is greater than a warning threshold, a warning message is generated; the warning threshold is determined based on current operating data; the warning information includes response operation process information, and the response operation process information includes multiple operation steps; a warning is issued based on the warning information, and multiple operation steps are executed according to the timing in the response operation process information.

[0161] In an exemplary embodiment, the device also includes a response module for performing a performance evaluation on the server after executing multiple operation steps according to the timing in the response operation process information to obtain a fault response processing result; if the fault response processing result is greater than a preset response value, the fault response is stopped.

[0162] In an exemplary embodiment, the response module is also used to evaluate the preset performance indicators of the server after executing a single operation step among multiple operation steps, and to enter into fusion processing on the preset performance indicators of the server after executing a single operation step among multiple operation steps to obtain a fault response processing result.

[0163] In an exemplary embodiment, the response module is also used to calculate the difference between a first parameter value of a preset performance indicator of the server after executing a single operation step among multiple operation steps and a second parameter value of a preset performance indicator of the server after executing the previous operation step, to obtain multiple difference values; and determine the ratio between the sum of the multiple difference values ​​and the total number of steps of the multiple operation steps as the fault response processing result.

[0164] In an exemplary embodiment, the response module is also used to adjust the resource allocation ratio of multiple types of resources in the server when the fault response processing result is less than or equal to the preset response value, obtain the target resource configuration plan, and adjust the resource configuration of the server according to the target resource configuration plan.

[0165] In an exemplary embodiment, the response module is also used to determine the new resource allocation ratio of multiple types of resources in the server based on the ratio between the current utilization of a single type of resource among the multiple types of resources and the maximum resource utilization among the multiple types of resources, and the second preset weight of the single type of resource among the multiple types of resources, and determine the set of new resource allocation ratios of multiple types of resources in the server as the target resource configuration plan.

[0166] An embodiment of the present application further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any of the above-mentioned fault feature extraction method embodiments.

[0167] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps of any of the above-mentioned fault feature extraction method embodiments when running.

[0168] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0169] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any of the above-mentioned fault feature extraction method embodiments are implemented.

[0170] An embodiment of the present application further provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above-mentioned fault feature extraction method embodiments are implemented.

[0171] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0172] The above is a detailed introduction to a fault feature extraction method, electronic device, and storage medium provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A fault feature extraction method, characterized in that: include: Get the current running data of the server; The current operation data includes current feature values ​​of multiple dimensions; Extracting a fault feature set from the current operating data, and calculating an importance score of a current feature value of a dimension in the current operating data; The fault feature set includes a plurality of first feature vectors; wherein the plurality of first feature vectors are feature vectors extracted after principal component analysis of the current operating data; and a single first feature vector in the plurality of first feature vectors corresponds to a principal component eigenvalue; According to the importance score of the current eigenvalue of a dimension in the current operating data, the current eigenvalue of a dimension in the current operating data is weightedly summed to obtain a first contribution corresponding to the current operating data, where the first contribution is the degree of influence of the current eigenvalue on the overall data set calculated based on the current eigenvalue of a dimension in the current operating data and its importance score; the importance score of the current eigenvalue of a dimension in the current operating data is used as an adaptive weight to quantify the sensitivity and influence of the current eigenvalue of a dimension in the current operating data on the change of the server state; the product between the monomer first eigenvector in the fault feature set and the corresponding principal component eigenvalue is calculated, and the product result is determined as the second contribution of the monomer first eigenvector in the fault feature set, where the second contribution reflects the degree of contribution of the monomer first eigenvector to fault prediction in the fault feature set; the sum of the second contribution of the monomer first eigenvector in the fault feature set and the first contribution corresponding to the current operating data is determined as the updated monomer first eigenvector in the fault feature set to obtain the updated fault feature set; the updated fault feature set is used for fault detection.

2. The method according to claim 1, characterized in that The obtaining of the current running data of the server includes: The current operation data is collected by a collection component pre-deployed in the server; the configuration parameters of the collection component are configured according to the number of nodes in the server cluster where the server is located and the network environment.

3. The method according to claim 1, characterized in that Before extracting the fault feature set from the current operating data, the method further includes: Identifying, removing, and filling a first abnormal data point in the current operating data to obtain cleaned current operating data; the first abnormal data point refers to a data point whose characteristic value is not within a preset range; Performing format conversion on the cleaned current operation data to obtain the current operation data in a unified format; The current operation data in the unified format is verified, and a second abnormal data point is identified and corrected to obtain the processed current operation data; the second abnormal data point refers to a data point that does not conform to the historical behavior pattern or trend.

4. The method according to claim 1, wherein The extracting a fault feature set from the current operating data includes: Calculating a covariance matrix corresponding to the current operating data; the covariance matrix represents the linear correlation between different indicators in the current operating data; Performing eigenvalue decomposition on the covariance matrix to obtain a plurality of principal component eigenvalues ​​and a plurality of second eigenvectors corresponding to the plurality of principal component eigenvalues; The multiple second eigenvectors are arranged in descending order according to the principal component eigenvalues, and the second eigenvector is selected starting from the maximum principal component eigenvalue. When the selected second eigenvector meets a preset condition, the selected second eigenvector is determined as the multiple first eigenvectors to obtain the fault feature set; the preset condition refers to the condition that the cumulative contribution rate of the selected second eigenvector is greater than a preset contribution rate threshold.

5. The method according to claim 1, characterized in that The calculating the importance score of the current feature value of a dimension in the current running data includes: Acquiring historical operation data of the server; the historical operation data includes the multi-dimensional historical feature values; Determining, based on the historical operating data, a historical mean and a standard deviation of a current feature value of a dimension in the current operating data; An importance score of a current eigenvalue of a dimension in the current operating data is determined according to a current eigenvalue, a historical mean, a standard deviation, and a first preset weight of the current eigenvalue of a dimension in the current operating data.

6. The method according to claim 1, wherein The method further comprises: Inputting the updated fault feature set into a pre-trained fault prediction model to obtain a prediction value, wherein the prediction value represents the possibility of the server failure; When the predicted value is greater than a warning threshold, generating warning information; the warning threshold is determined based on the current operating data; the warning information includes response operation process information, and the response operation process information includes multiple operation steps; An early warning is issued according to the early warning information, and the multiple operation steps are executed according to the timing in the response operation process information.

7. The method according to claim 6, characterized in that After executing the multiple operation steps according to the timing in the response operation process information, the method further includes: A performance evaluation is performed on the server after executing the multiple operation steps to obtain a fault response processing result; when the fault response processing result is greater than a preset response value, the fault response is stopped.

8. The method according to claim 7, characterized in that The performing of a performance evaluation on the server after executing the multiple operation steps to obtain a fault response processing result includes: The preset performance indicators of the server after executing a single operation step among the multiple operation steps are evaluated, and the preset performance indicators of the server after executing a single operation step among the multiple operation steps are subjected to fusion processing to obtain the fault response processing result.

9. The method according to claim 8, characterized in that The preset performance indicator of the server after executing a single operation step in the multiple operation steps enters into fusion processing to obtain a fault response processing result, including: Calculating a difference between a first parameter value of a preset performance indicator of the server after executing a single operation step among the multiple operation steps and a second parameter value of the preset performance indicator of the server after executing the previous operation step, to obtain a plurality of difference values; The ratio between the sum of the plurality of differences and the total number of the plurality of operation steps is determined as the fault response processing result.

10. The method according to claim 7, characterized in that The method further comprises: When the fault response processing result is less than or equal to the preset response value, the resource allocation ratio of multiple types of resources in the server is adjusted to obtain a target resource configuration scheme, and the resource configuration of the server is adjusted according to the target resource configuration scheme.

11. The method according to claim 10, characterized in that The adjusting the resource allocation ratio of multiple types of resources in the server to obtain a target resource configuration solution includes: Based on the ratio between the current utilization rate of a single type of resource among the multiple types of resources and the maximum resource utilization rate among the multiple types of resources, and the second preset weight of a single type of resource among the multiple types of resources, the new resource allocation ratio of the multiple types of resources in the server is determined, and the set of the new resource allocation ratios of the multiple types of resources in the server is determined as the target resource configuration plan.

12. An electronic device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the fault feature extraction method according to any one of claims 1 to 11 when executing the computer program.

13. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the fault feature extraction method according to any one of claims 1 to 11.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the fault feature extraction method according to any one of claims 1 to 11 are implemented.

Images