Service component monitoring method and related product

Abstract

The invention discloses a service component monitoring method and a related product. The method comprises the following steps: acquiring a first index value of a performance index item of a service component at a first time point, a second index value of the performance index item at a second time point and first attribute information of the service component at the first time point, wherein the second time point is earlier than the first time point; determining a first threshold value corresponding to the performance index item at the first time point based on the second index value; adjusting the first threshold value based on the first attribute information to obtain a second threshold value; and determining whether the service component is abnormal based on the second threshold value and the first index value. Therefore, the personalized threshold value meeting the actual requirement can be dynamically and intelligently generated for the performance index item of the service component, it is ensured that the abnormal state of the service component can be truly monitored, and false alarm abnormity or missing alarm abnormity caused by improper threshold values is avoided.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a monitoring method for a service component and related products. Background Art

[0002] To ensure the continuous, stable, and efficient operation of business systems, it is often necessary to monitor the service components of these systems. Accurately monitoring service components for abnormal conditions and effectively avoiding false positives and negative alerts has become a hot research topic. Summary of the Invention

[0003] The purpose of the embodiments of the present application is to provide a service component monitoring method and related products, which are used to dynamically and intelligently generate personalized thresholds that meet actual needs for the performance indicator items of the service components, ensure that the abnormal status of the service components can be truly monitored, and avoid false alarms or missed alarms due to inappropriate thresholds.

[0004] In order to achieve the above objectives, the embodiments of the present application adopt the following technical solutions: In a first aspect, an embodiment of the present application provides a method for monitoring a service component, comprising: Obtaining a first indicator value of a performance indicator item of a service component at a first time point, a second indicator value of the performance indicator item at a second time point, and first attribute information of the service component at the first time point, where the second time point is earlier than the first time point; Determine a first threshold corresponding to the performance indicator item at the first time point based on the second indicator value; Adjusting the first threshold based on the first attribute information to obtain a second threshold; Determine whether the service component is abnormal based on the second threshold and the first indicator value.

[0005] In a second aspect, an embodiment of the present application provides a monitoring device for a service component, comprising: An acquisition module, configured to acquire a first indicator value of a performance indicator item of a service component at a first time point, a second indicator value of the performance indicator item at a second time point, and first attribute information of the service component at the first time point, where the second time point is earlier than the first time point; a determining module, configured to determine a first threshold corresponding to the performance indicator item at the first time point based on the second indicator value; an adjusting module, configured to adjust the first threshold based on the first attribute information to obtain a second threshold; A monitoring module is used to determine whether the service component is abnormal based on the second threshold and the first indicator value.

[0006] In a third aspect, an embodiment of the present application provides an electronic device, including: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the service component monitoring method provided in the first aspect.

[0007] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which, when the instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute the monitoring method of the service component provided in the first aspect.

[0008] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to enable a computer to execute some or all of the steps in the monitoring method of the service component provided in the first aspect.

[0009] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects: Because the second time point is earlier than the first time point, the second indicator value of the performance indicator item of the service component at the second time point contains the dynamic change trend of the indicator value of the performance indicator item. Based on the second indicator value, the threshold corresponding to the performance indicator item at the first time point is determined, thereby dynamically generating a first threshold for the performance indicator item that meets the monitoring requirements, ensuring that the first threshold can adapt to the dynamic changes in the indicator value of the performance indicator item, and avoiding false positives or missed reports of abnormalities caused by such dynamic changes. On this basis, because the indicator value of the performance indicator item is affected by attribute information such as the purpose of the service component, the business it handles, the role, and the technology stack used, the same indicator value of the performance indicator item has different degrees of impact on different service components. Based on this, the first threshold is adjusted according to the first attribute information of the service component at the first time point to obtain the second threshold, thereby realizing the intelligent setting of personalized thresholds for the same performance indicator item of different service components. Furthermore, based on the second threshold and the first indicator value, it is possible to timely and accurately identify whether the service component is abnormal, avoiding the occurrence of false positives or missed reports of abnormalities. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 A schematic diagram of an implementation environment provided for an embodiment of the present application; Figure 2A flowchart of a method for monitoring a service component provided in an embodiment of the present application; Figure 3 A schematic diagram of the structure of a monitoring device for a service component provided in an embodiment of the present application; Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0011] To make the purpose, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the specific embodiments of this application and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0012] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, and this is merely a way of distinguishing the objects of the same attributes when describing them in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0013] Key terms explained: Threshold: The boundary of a field or a system is called a threshold, and its value is called the threshold.

[0014] Sparse algorithm: It is an algorithm that uses sparse matrix as the core data structure. Its biggest feature is that it greatly reduces storage space requirements and computational complexity by only storing and processing non-zero elements.

[0015] Currently, various inspection systems / platforms usually adopt a "one-size-fits-all" monitoring mode, that is, setting the same fixed threshold for all service components. Once the basic data of a monitored service component exceeds the threshold, it is determined that there is an abnormality in the service component.

[0016] However, the inventors have discovered through extensive research that this "one-size-fits-all" monitoring method has many drawbacks. On the one hand, the index value of the performance indicator item of the same service component may change dynamically due to changes in attribute information such as the business processed by the service component, the operation of the technology stack, the purpose, and the role, and the fixed threshold cannot adapt to such dynamic changes, resulting in the service component being missed or falsely reporting anomalies. On the other hand, different service components have different functions and importance in the business system, and their tolerance and operating characteristics are also very different. Therefore, the same index value of the performance indicator item has different effects on different service components, and therefore the thresholds corresponding to the same performance indicator item of different service components should also be different. If the same threshold is set for the same performance indicator item of all service components, some service components will be missed or some service components will be falsely reported.

[0017] For example, if a "one-size-fits-all" monitoring model is used, with a pre-set threshold of 85% for all hosts' disk usage, the inspection system / platform will determine that a host's disk usage exceeds 85% if it is monitored. Because disk usage for the same host can fluctuate normally due to peak and off-season business, a fixed threshold cannot adapt to these dynamic changes in disk usage. This can either trigger frequent false alarms during peak season, disrupting operations and maintenance personnel's judgment, or prevent the identification of true anomalies during off-season, delaying action.

[0018] Furthermore, since a host's disk usage is determined by factors such as the business it handles and the operational status of its technology stack, different hosts may handle different business and technology stacks. Therefore, the same disk usage will have different impacts on different hosts, and therefore the disk usage thresholds for different hosts should also be different. If the same disk usage threshold is set for all hosts, disk anomalies on some hosts may be masked due to the usage threshold being set too high, while disk anomalies on other hosts may be falsely reported due to the usage threshold being set too low.

[0019] To this end, the present invention proposes a monitoring method for a service component. Considering that the historical indicator value of a performance indicator item of a service component contains the dynamic change trend of the indicator value of the performance indicator item, the threshold value corresponding to the performance indicator item at the current time point is determined based on the historical indicator value of the performance indicator item of the service component, thereby dynamically generating a threshold value that meets the monitoring requirements for the performance indicator item, ensuring that the threshold value can adapt to the dynamic change of the indicator value of the performance indicator item, and avoiding false positives or missed reports of abnormalities caused by the dynamic change. On this basis, since the indicator value of the performance indicator item is affected by attribute information such as the purpose of the service component, the business processed, the role, and the technology stack used, the same indicator value of the performance indicator item has different impacts on different service components. Based on this, the threshold value determined based on the historical indicator value is adjusted according to the first attribute information of the service component at the current time point, thereby realizing intelligent setting of personalized threshold values ​​for the same performance indicator item of different service components; further, based on the adjusted threshold value and the current indicator value of the performance indicator item of the service component, it is possible to timely and accurately identify whether the service component is abnormal, avoiding the occurrence of false positives or missed reports of abnormalities.

[0020] It should be understood that the monitoring method of the service component proposed in the embodiment of the present application can be executed by a patrol electronic device. For example, it can be executed by software in the electronic device. The electronic device here can include terminal devices, such as smart phones, tablet computers, laptops, desktop computers, intelligent voice interaction devices, smart home appliances, etc.; or, the electronic device can also include a server, such as an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0021] Before introducing the monitoring method of the service component provided by the embodiment of the present application in detail, a brief introduction to the implementation environment involved in the embodiment of the present application is given. Figure 1 , is a schematic diagram of an implementation environment of a service component monitoring method provided in an embodiment of the present application, the implementation environment includes a business system 10 and an inspection system 20. The business system 10 is connected to the inspection system 20 via a wireless network or a wired network.

[0022] The business system 10 includes a plurality of service components 11. These service components 11 may include, but are not limited to, a host, a database, middleware, etc., which are not limited in the present embodiment.

[0023] The inspection system 20 may include one or more electronic devices. The electronic devices mentioned here may include terminal devices, such as smartphones, tablet computers, laptop computers, desktop computers, etc.; alternatively, the electronic devices may also include servers, such as independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers that provide cloud computing services. The inspection system 20 is used to monitor the business system 10 in real time, that is, to determine whether the various performance indicators of the business system 10 are in an abnormal state, and to output warning information when any performance indicator of the business system 10 is in an abnormal state, so as to remind the operation and maintenance personnel to pay attention or handle it.

[0024] Exemplarily, the monitoring of the business system 10 by the inspection system 20 includes the following stages: (1) Basic data collection stage: The inspection system 20 collects the index values ​​of various performance index items from various service components of the business system 10.

[0025] (2) Data storage stage: The inspection system 20 stores the collected data for subsequent access and analysis. Specifically, the inspection system 20 may archive or merge the collected data and store it in a storage device. The storage device may be a device with storage function within the inspection system 20 or a device independent of the inspection system 20 and also with storage function, which is not limited in this embodiment of the present application.

[0026] Taking into account that the stored data will continue to increase, in order to reduce the storage pressure of the storage device and increase the computing speed, the inspection system 20 may use a sparse algorithm to process the data in the storage device. As an example, the sparse algorithm may include: reducing data of a certain dimension, and removing some redundant data or data of less value, and only retaining data that is more meaningful or of reference value for anomaly identification, thereby reducing the overall data volume, making the data in the storage device sparse, and improving computing efficiency. Specifically, for a certain performance indicator item, if the threshold corresponding to the performance indicator item is the same in the same time period every day, these thresholds are merged and stored; or, the average value of the thresholds that are farther away from the current time is taken, such as the average value of the thresholds for the same time period every day 3 months ago, without the need to store the thresholds for the same time period every day; or, the indicator values ​​and thresholds of the previous 6 months are deleted. This is because, as the business changes, old data will deviate from the actual situation, and this deviation can be reduced and ignored.

[0027] (3) Intelligent generation of personalized thresholds: For each performance indicator item of each service component 11, the inspection system 20 intelligently generates a threshold value at the current time point for the performance indicator item of the service component 11 based on the indicator value of the performance indicator item of the service component 11 at the historical time point and the attribute information at the current time point, and stores it as a reference for the abnormality identification stage.

[0028] (4) Abnormality identification stage: The inspection system 20 determines whether each performance indicator item of each service component 11 is abnormal at the current time point based on the indicator value at the current time point and the threshold at the current time point.

[0029] (5) Early warning stage: For each performance indicator item of each service component 11, if the inspection system 20 determines that the performance indicator item of the service component 11 is abnormal at the current time point, it can output early warning information to remind the operation and maintenance personnel to pay attention or handle it, or it can also automatically handle it according to the preset strategy.

[0030] Based on the implementation environment introduced above, the monitoring method of the service component provided by the embodiment of the present application is described in detail with reference to the accompanying drawings.

[0031] Please refer to Figure 2 , is a flow chart of a method for monitoring a service component provided in an embodiment of the present application, the method comprising the following steps: S202: Obtain a first indicator value of a performance indicator item of a service component at a first time point, a second indicator value of the performance indicator item at a second time point, and first attribute information of the service component at the first time point.

[0032] The service component can be any component in the business system, and the performance indicator item can be any indicator item reflecting the performance of the service component. There can be at least one service component, and there can be at least one performance indicator item. Exemplarily, the service component can include but is not limited to the host, database, and middleware in the business system. The performance indicator items of the host can, for example, include but are not limited to at least one of the indicators such as disk space usage, memory usage, disk I / O read and write rate, and network bandwidth utilization. The performance indicator items of the database can, for example, include but are not limited to at least one of the indicators such as query response time, transaction processing throughput, number of database connections, and disk space usage. The performance indicator items of the middleware can include but are not limited to at least one of the indicators such as message processing delay, number of concurrent connections, resource consumption, and cache hit rate.

[0033] The second time point is earlier than the first time point. There can be at least one second time point. The embodiment of the present application does not impose too many restrictions on the first time point and the second time point. For example, the first time point and the second time point are both in days, hours, minutes, or seconds as the time granularity.

[0034] For example, for each service component in the business system, the indicator values ​​of each performance indicator item of the service component and the attribute information of the service component are collected in real time, and the current time point is determined as the first time point, and at least one time point before the current time point is determined as the second time point. In this case, for each performance indicator item, the first indicator value of the performance indicator item at the first time point refers to the current indicator value of the performance indicator item, and the second indicator value of the performance indicator item at the second time point refers to the historical indicator value of the performance indicator item.

[0035] Since the second indicator value contains the dynamic change trend of the indicator value of the performance indicator item, the first threshold corresponding to the performance indicator item at the first time point is determined by analyzing the second indicator value. The first threshold is not a static, unchanging value, but fully considers the dynamic change trend of the performance indicator item of the service component. It is a dynamic and intelligent threshold that can accurately adapt to this dynamic change trend, providing a solid and reliable benchmark reference for accurately judging the real-time status of the service component, thereby improving the monitoring accuracy of the service component.

[0036] The first attribute information may include an attribute value of at least one attribute of the service component. The attributes of the service component may include, but are not limited to, at least one of the following attributes: the purpose of the service component (e.g., production or testing), role (e.g., master node or slave node), technology stack (e.g., physical machine, virtual machine, cloud server, relational database, non-relational database, etc.), processed business, etc.

[0037] S204: Determine a first threshold corresponding to the performance indicator item at the first time point based on the second indicator value.

[0038] The second indicator value of the performance indicator item of the service component at the second time point can be analyzed in various appropriate ways to capture the trend, periodic fluctuations and abnormal value characteristics in the second indicator value, so as to estimate the first threshold value corresponding to the performance indicator item at the first time point.

[0039] In one implementation, the above S204 includes the following steps: determining a first mean based on the second indicator value; determining a first standard deviation based on a difference between the second indicator value and the first mean; and determining the first standard deviation as a first threshold.

[0040] Exemplarily, the first threshold is determined by the following formula (1): (1) in, represents the first threshold, which is equal to the first standard deviation, represents the number of the second time point, Indicates the indicator value of the performance indicator item of the service component at the i-th second time point, Represents the first mean.

[0041] Since the standard deviation is a statistic used to measure the degree of dispersion of a set of data, it reflects the dispersion of the data relative to the mean. The larger the standard deviation, the more dispersed the data; the smaller the standard deviation, the more concentrated the data is around the mean. In the above implementation, the first threshold is determined by using the standard deviation of the first indicator value, which can fully consider the fluctuation characteristics of the indicator value of the performance indicator item and can be adjusted adaptively, thereby effectively avoiding false positives or missed reports caused by fluctuations in the indicator value, providing a more scientific, flexible and practical solution for the precise monitoring of the performance indicator items of the service components, and greatly improving the reliability and effectiveness of the inspection system.

[0042] In another implementation, the above S204 may include the following steps: determining a first mean value based on the second indicator value; and determining the first mean value as a first threshold value.

[0043] In another implementation, the above S204 may include the following steps: determining a first mean based on the second indicator value; determining a first variance based on a difference between the second indicator value and the first mean; and determining the first variance as a first threshold.

[0044] The above describes some implementations of the above S204. Of course, it should be understood that the above S204 can also be implemented in other ways, which are not limited in the present embodiment.

[0045] S206: Adjust the first threshold based on the first attribute information to obtain a second threshold.

[0046] Since the indicator value of a performance indicator item is affected by attribute information such as the purpose of the service component, the business processed, the role, and the technology stack used, the same indicator value of the performance indicator item has different degrees of impact on different service components. Based on this, the first threshold is adjusted according to the first attribute information of the service component at the first time point, thereby intelligently setting personalized thresholds for the same performance indicator item of different service components. In other words, the threshold corresponding to the same performance indicator item varies for different service components, thereby ensuring that the abnormal state of each service component can be truly monitored, avoiding the false reporting or omission of abnormalities of some service components due to improper thresholds.

[0047] In one implementation, the above S206 includes the following steps: S261: Determine a first adjustment method and a first adjustment range for a first threshold based on the first attribute information.

[0048] The first adjustment method includes an increase or a decrease. The first adjustment range is used to describe the change amount of the first threshold.

[0049] As an example, by querying the preset correspondence between attribute information, adjustment methods, and adjustment ranges, the adjustment method corresponding to the first attribute information is determined as the first adjustment method, and the adjustment range corresponding to the first attribute information is determined as the first adjustment range. This correspondence can be obtained through expert experience, big data analysis, or experimentation, and pre-set in the inspection system's configuration library. This approach is simple to implement and suitable for most scenarios. When actual conditions change, adjustments can be made in the configuration library as needed.

[0050] For example, the configuration library of the inspection system pre-sets the following correspondence between attribute information, adjustment methods, and adjustment ranges.

[0051] [Purpose: Production], downgraded to 10% [Purpose: Testing], floating, 20% [Role: Master Node], downgraded to 10% [Role: From Node], Upward, 10% Assuming that the first attribute information includes [Purpose: Production], by querying the configuration library, it is determined that the first adjustment method is downward adjustment, and the first adjustment range is determined to be 10%.

[0052] As another example, the first adjustment method and the first adjustment range are determined as follows: obtain the business processed by the service component at the first time point, and determine the first impact degree of the first attribute information on the first business; based on the first impact degree, determine the first adjustment method for the first threshold; based on the importance level of the business, determine the first adjustment range for the first threshold.

[0053] For example, a service component can be used for production and testing. Since its stability has a direct impact on the business when used in production, but minimally so when used in testing, [Use: Production] has a higher impact on the business than [Use: Testing]. In this scenario, if the first attribute is [Use: Production], the first adjustment method is determined to be a downward adjustment, facilitating early detection of production risks and enabling proactive intervention. If the first attribute is [Use: Testing], the first adjustment method is determined to be an upward adjustment, reducing focus on the testing process.

[0054] If the importance level of the first business processed by the service component at the first time point is high, it means that the stability of the service component will have a greater impact on the business system, then the first adjustment range is determined to be a larger value, such as 20%, to facilitate early detection of abnormal status of the service component and avoid the service component affecting the normal operation of the business system; if the importance level of the first business is low, it means that the stability of the service component has little impact on the business system, then the first adjustment range is determined to be a smaller value, such as 10%, to appropriately reduce the attention to the service component.

[0055] In the application, the degree of influence of different attribute information on different services, the importance level of the services, etc. can be obtained by analyzing the historical operation of the business system, and the embodiments of the present application are not limited to this.

[0056] S262: Adjust the first threshold based on the first adjustment method and the first adjustment range to obtain a second threshold.

[0057] As an example, for each attribute in the first attribute information, based on the first adjustment method corresponding to the attribute, the product between the weight corresponding to the attribute and the first adjustment range corresponding to the attribute is increased or decreased on the basis of the first threshold, thereby obtaining the second threshold.

[0058] Specifically, the second threshold can be determined by the following formula (2): (2) in, represents the second threshold, represents the first threshold, represents the weight corresponding to the j-th attribute, Indicates the first adjustment amplitude corresponding to the j-th attribute; Indicates the number of attributes contained in the first attribute information; if the first adjustment method corresponding to the jth attribute is floating up, then Take a positive value; if the first adjustment method corresponding to the jth attribute is downward adjustment, then Take a negative value.

[0059] In the application, the weight corresponding to each attribute can be determined according to actual needs, and the embodiments of the present application do not limit this. For example, if the attribute value of a certain attribute has a greater first impact on the first business, the weight corresponding to the attribute is set to a larger value; if the attribute value of the attribute has a smaller first impact on the first business, the weight corresponding to the attribute is set to a smaller value.

[0060] As another example, determine the second degree of impact of the first time point on the service component; based on the second degree of impact, determine the second adjustment method and second adjustment range for the first threshold; based on the first adjustment method, the weight corresponding to the first attribute information, the second adjustment method and the weight corresponding to the first time point, perform preset operations on the first adjustment range and the second adjustment range to obtain the second threshold.

[0061] Among them, the preset operation can be set to any appropriate operation according to actual needs, and the embodiments of the present application are not limited to this.

[0062] For example, the preset operation may include a weighted summation operation. In this case, if the first adjustment method is a downward adjustment, the first adjustment amplitude is a negative value; if the first adjustment method is an upward adjustment, the first adjustment amplitude is a positive value. Similarly, if the second adjustment method is a downward adjustment, the second adjustment amplitude is a negative value; if the second adjustment method is an upward adjustment, the second adjustment amplitude is a positive value. Furthermore, a weighted sum of the first threshold, the first adjustment amplitude, and the second adjustment amplitude is added to the first threshold to obtain the second threshold.

[0063] For another example, the preset operation may include taking a minimum budget. In this case, if the first adjustment method and the second adjustment method are the same, the smaller of the first adjustment amplitude and the second adjustment amplitude is determined; if both the first adjustment method and the second adjustment method are downward adjustments, the smaller value is subtracted from the first threshold to obtain the second threshold; if both the first adjustment method and the second adjustment method are upward adjustments, the smaller value is added to the first threshold to obtain the second threshold.

[0064] In the above implementation, the second degree of impact of the first time point on the service component can be determined in the following manner: obtain the reference visits corresponding to the first business in multiple time periods, the first business being the business processed by the service component at the first time point; determine the second mean based on the reference visits corresponding to each time period; determine the first time period to which the first time point belongs from multiple time periods, and determine the second degree of impact of the first time point on the service component based on the difference between the reference visits corresponding to the first time period and the second mean.

[0065] Furthermore, if the second impact is large, the second adjustment method is determined to be downward, and the second adjustment range is a larger value, so as to facilitate timely discovery of abnormal status of service components and early intervention and processing; if the second impact is small, the second adjustment method is determined to be upward, and the second adjustment range is a smaller value, so as to appropriately reduce the attention to service components and save computing resources.

[0066] For example, a day is divided into 12 time periods with a 2-hour time granularity. Assume the first time point is 11:00 AM on January 1, 2025. For each time period, the reference traffic for the first service in that time period can be the average of the traffic for the first service in that time period over the past week. The reference traffic for these 12 time periods is averaged to obtain a second average, which reflects the average traffic for the first service in a single day.

[0067] Furthermore, the difference between the reference visits corresponding to the first time point and the second mean can be determined as the second degree of influence of the first time point on the service component. If the difference between the reference visits corresponding to the first time period to which the first time point belongs and the second mean is positive and large, it indicates that the visits to the first business at the first time point are significantly higher than the average level, which is a peak period of business. The index values ​​of performance indicators such as the CPU usage and memory usage of the service component will accumulate and rise. Therefore, identifying abnormalities of the service component at the first time point can timely discover whether the service component can withstand high concurrency pressure, which is crucial for the processing of the first business. It is then determined that the second degree of influence of the first time point on the first business is also large. In this case, the second adjustment method is determined to be downward, and the second adjustment range is set to a larger value to reduce the threshold corresponding to the performance indicator item at the first time point, so as to facilitate timely discovery of the abnormal state of the service component and early intervention.

[0068] If the difference between the reference visits corresponding to the first time period and the second mean is negative and small, it indicates that the visits to the first business at the first time point are significantly lower than the average level, which is a business trough period. Alternatively, if the difference between the reference visits corresponding to the first time period and the second mean is small, it indicates that the visits to the first business at the first time point are at the average level, which is a business stable period. In both cases, the changes in the index values ​​of performance indicators such as the CPU utilization rate and memory utilization rate of the service component are relatively stable, thereby determining that the second impact of the first business at the first time point is small. In this case, the second adjustment method is determined to be floating, and the second adjustment range is set to a smaller value, so as to appropriately reduce the attention to the service component and save computing resources.

[0069] For example, the first attribute information includes [Purpose: Testing] and [Role: Master Node]. The first adjustment method for [Purpose: Testing] is an increase, with a first adjustment of 10% and a weight of 0.5. This means it increases the first threshold by 10% * 0.5 = 5%. The first adjustment method for [Role: Master Node] is a decrease, with a first adjustment of 10% and a weight of 0.2. This means it decreases the first threshold by 10% * 0.2 = 2%. The first time point is 11:00, and its first time period is 9:00-12:00. The second adjustment method for [Purpose: Testing] is a decrease, with a second adjustment of 20% and a weight of 0.3. This means it decreases the first threshold by 20% * 0.3 = 6%. Assuming the first threshold is 90%, the second threshold = 90% + 5% - 2% - 6% = 87%.

[0070] The above describes some implementations of the above S206. Of course, it should be understood that the above S206 can also be implemented in other ways, which are not limited in the present embodiment.

[0071] S208: Determine whether the service component is abnormal based on the second threshold and the first indicator value.

[0072] In one implementation, the second threshold is compared with the first indicator value; when the first indicator value is less than the second threshold, the service component is determined to be normal; when the first indicator value is greater than or equal to the second threshold, the service component is determined to be abnormal, and then a first warning information is output, the first warning information is used to indicate that the performance indicator item of the service component is abnormal.

[0073] In another implementation, a minimum value between the second threshold and a preset third threshold is determined; and when the first indicator value is greater than or equal to the minimum value, it is determined that the service component is abnormal.

[0074] The third threshold is also called the safety threshold, which can be set according to actual needs. By introducing the third threshold, the service component is judged to be abnormal based on the minimum value between the third threshold and the second threshold. This can avoid the second threshold being too high, which may cause the abnormal problem of the service component to not be exposed, and further improve the monitoring accuracy of the service component.

[0075] The above describes some implementations of the above S208. Of course, it should be understood that the above S208 can also be implemented in other ways, which are not limited in the present embodiment.

[0076] The monitoring method for a service component provided in an embodiment of the present application is such that, since the second time point is earlier than the first time point, the second indicator value of the performance indicator item of the service component at the second time point contains the dynamic change trend of the indicator value of the performance indicator item, and based on the second indicator value, the threshold value corresponding to the performance indicator item at the first time point is determined, thereby dynamically generating a first threshold value that meets the monitoring requirements for the performance indicator item, ensuring that the first threshold value can adapt to the dynamic change of the indicator value of the performance indicator item, and avoiding false positives or missed reports of abnormalities caused by the dynamic change. On this basis, since the indicator value of the performance indicator item is affected by attribute information such as the purpose of the service component, the business processed, the role, and the technology stack used, the same indicator value of the performance indicator item has different degrees of influence on different service components. Based on this, the first threshold value is adjusted according to the first attribute information of the service component at the first time point to obtain the second threshold value, thereby realizing intelligently setting personalized thresholds for the same performance indicator item of different service components; further, based on the second threshold value and the first indicator value, it is possible to timely and accurately identify whether the service component is abnormal, avoiding the occurrence of false positives or missed reports of abnormalities.

[0077] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0078] Based on the same inventive concept, the present application embodiment also provides a monitoring device for a service component. Figure 3 , is a structural diagram of a monitoring device 300 for a service component provided in an embodiment of the present application. The device 300 includes: an acquisition module 310, a determination module 320, an adjustment module 330 and a monitoring module 330.

[0079] The acquisition module 310 is used to obtain the first indicator value of the performance indicator item of the service component at the first time point, the second indicator value of the performance indicator item at the second time point, and the first attribute information of the service component at the first time point, where the second time point is earlier than the first time point.

[0080] The determination module 320 is configured to determine a first threshold corresponding to the performance indicator item at the first time point based on the second indicator value.

[0081] The adjustment module 330 is configured to adjust the first threshold based on the first attribute information to obtain a second threshold.

[0082] The monitoring module 340 is configured to determine whether the service component is abnormal based on the second threshold and the first indicator value.

[0083] In another embodiment, the determining module is configured to: determining a first mean based on the second indicator value; determining a first standard deviation based on a difference between the second indicator value and the first mean; The first standard deviation is determined as the first threshold.

[0084] In another embodiment, the adjustment module is configured to: determining a first adjustment method and a first adjustment range for the first threshold based on the first attribute information; The first threshold is adjusted based on the first adjustment method and the first adjustment range to obtain a second threshold.

[0085] In another embodiment, when the adjustment module determines the first adjustment method and the first adjustment range for the first threshold based on the first attribute information, the adjustment module performs the following steps: Obtaining a first business processed by the service component at the first time point, and determining a first impact degree of the first attribute information on the first business; determining a first adjustment method for the first threshold based on the first impact level; A first adjustment magnitude for the first threshold is determined based on the importance level of the first service.

[0086] In another embodiment, when the adjustment module adjusts the first threshold based on the first adjustment method and the first adjustment range to obtain the second threshold, the adjustment module performs the following steps: determining a second degree of impact of the first time point on the service component; determining a second adjustment method and a second adjustment range for the first threshold based on the second impact degree; Based on the first adjustment method, the weight corresponding to the first attribute information, the second adjustment method, and the weight corresponding to the first time point, a preset operation is performed on the first adjustment amplitude and the second adjustment amplitude to obtain a second threshold.

[0087] In another embodiment, when determining the second impact degree of the first time point on the service component, the adjustment module performs the following steps: Obtaining reference page views corresponding to a first service in multiple time periods, where the first service is a service processed by the service component at the first time point; Determine a second mean based on the reference visits corresponding to each time period; Determine the first time period to which the first time point belongs from the multiple time periods, and determine the second impact degree of the first time point on the service component based on the difference between the reference visits corresponding to the first time period and the second mean.

[0088] In another embodiment, the monitoring module is configured to: determining a minimum value between the second threshold and a preset third threshold; When the first indicator value is greater than or equal to the minimum value, it is determined that the service component is abnormal.

[0089] Obviously, the monitoring of the service components provided by the embodiment of the present application can be used as Figure 2 The execution subject of the monitoring method of the service component shown is, for example Figure 2 In the monitoring method of the service component shown in FIG. 1 , step S202 can be performed by Figure 3 The determining module 310 in the monitoring device of the service component shown in FIG. 1 is executed, and step S204 can be performed by Figure 3 The adjustment module 320 in the monitoring device of the service component shown in FIG. 1 is executed, and step S206 can be performed by Figure 3 The monitoring module 330 in the monitoring device of the service component is shown to be executed.

[0090] According to another embodiment of the present application, Figure 3 The various modules in the monitoring device of the service component shown can be individually or completely combined into one or several other modules to form a whole, or one (or some) of the modules can be further divided into multiple functionally smaller modules to form a whole, which can achieve the same operation without affecting the realization of the technical effects of the embodiment of the present application. The above-mentioned units are divided based on logical functions. In actual applications, the functions of one module can also be implemented by multiple modules, or the functions of multiple modules can be implemented by one module. The monitoring device of the service component in the embodiment of the present application can also include other modules. In actual applications, these modules can also be implemented with the assistance of other modules, and can be implemented by the collaboration of multiple modules.

[0091] According to another embodiment of the present application, the system can be executed on a general computing device such as a computer including processing elements such as a CPU, RAM, ROM and storage elements. Figure 2 A computer program (including program code) for each step involved in the corresponding method shown in FIG. Figure 3The computer program can be recorded on a computer-readable storage medium, for example, and transferred to an electronic device through the computer-readable storage medium and run therein.

[0092] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 4 At the hardware level, the electronic device includes a processor and, optionally, an internal bus, a network interface, and memory. The memory may include internal memory, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk drive. Of course, the electronic device may also include other hardware required for its services.

[0093] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, Figure 4 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0094] The memory is used to store programs. Specifically, the program may include program code, which includes computer operating instructions. The memory may include internal memory and non-volatile memory, and provides instructions and data to the processor.

[0095] The processor reads the corresponding computer program from the non-volatile memory into the internal memory and then runs it, forming a monitoring device for the service component at the logical level. The processor executes the program stored in the memory and is specifically used to perform the following operations: Obtaining a first indicator value of a performance indicator item of a service component at a first time point, a second indicator value of the performance indicator item at a second time point, and first attribute information of the service component at the first time point, where the second time point is earlier than the first time point; Determine a first threshold corresponding to the performance indicator item at the first time point based on the second indicator value; Adjusting the first threshold based on the first attribute information to obtain a second threshold; Determine whether the service component is abnormal based on the second threshold and the first indicator value.

[0096] The above application Figure 2 The methods performed by the monitoring device for service components disclosed in the illustrated embodiments can be applied to or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the aforementioned method can be performed by hardware integrated logic circuits within the processor or by software instructions. The aforementioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of this application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules within the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above method.

[0097] The electronic device may also perform Figure 2 Method, and realize the monitoring device of service component in Figure 2 The functions of the illustrated embodiment will not be described in detail in the embodiments of the present application.

[0098] Of course, in addition to software implementation, the electronic device of this application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0099] The embodiment of the present application also provides a computer-readable storage medium, which stores one or more programs, wherein the one or more programs include instructions, which, when executed by an electronic device including multiple application programs, can enable the electronic device to execute Figure 2 The method of the embodiment shown is specifically used to perform the following operations: Obtaining a first indicator value of a performance indicator item of a service component at a first time point, a second indicator value of the performance indicator item at a second time point, and first attribute information of the service component at the first time point, where the second time point is earlier than the first time point; Determine a first threshold corresponding to the performance indicator item at the first time point based on the second indicator value; Adjusting the first threshold based on the first attribute information to obtain a second threshold; Determine whether the service component is abnormal based on the second threshold and the first indicator value.

[0100] An embodiment of the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to enable a computer to execute some or all of the steps in the monitoring method of the service component provided in the embodiment of the present application.

[0101] In short, the above description is only a preferred embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

[0102] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0103] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0104] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0105] The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

Claims

1. A method for monitoring a service component, characterized in that: include: Obtaining a first indicator value of a performance indicator item of a service component at a first time point, a second indicator value of the performance indicator item at a second time point, and first attribute information of the service component at the first time point, where the second time point is earlier than the first time point; Determine a first threshold corresponding to the performance indicator item at the first time point based on the second indicator value; Adjusting the first threshold based on the first attribute information to obtain a second threshold; Determine whether the service component is abnormal based on the second threshold and the first indicator value.

2. The method according to claim 1, characterized in that The determining, based on the second indicator value, a first threshold corresponding to the performance indicator item at the first time point includes: determining a first mean based on the second indicator value; determining a first standard deviation based on a difference between the second indicator value and the first mean; The first standard deviation is determined as the first threshold.

3. The method according to claim 1, characterized in that The adjusting the first threshold based on the first attribute information to obtain a second threshold includes: determining a first adjustment method and a first adjustment range for the first threshold based on the first attribute information; The first threshold is adjusted based on the first adjustment method and the first adjustment range to obtain a second threshold.

4. The method according to claim 3, characterized in that The determining, based on the first attribute information, a first adjustment method and a first adjustment range for the first threshold value includes: Obtaining a first business processed by the service component at the first time point, and determining a first impact degree of the first attribute information on the first business; determining a first adjustment method for the first threshold based on the first impact level; A first adjustment magnitude for the first threshold is determined based on the importance level of the first service.

5. The method according to claim 3, characterized in that The adjusting the first threshold based on the first adjustment method and the first adjustment range to obtain a second threshold includes: determining a second degree of impact of the first time point on the service component; determining a second adjustment method and a second adjustment range for the first threshold based on the second impact degree; Based on the first adjustment method, the weight corresponding to the first attribute information, the second adjustment method, and the weight corresponding to the first time point, a preset operation is performed on the first adjustment amplitude and the second adjustment amplitude to obtain a second threshold.

6. The method according to claim 5, characterized in that Determining a second impact degree of the first time point on the service component includes: Obtaining reference page views corresponding to a first service in multiple time periods, where the first service is a service processed by the service component at the first time point; Determine a second mean based on the reference visits corresponding to each time period; Determine the first time period to which the first time point belongs from the multiple time periods, and determine the second impact degree of the first time point on the service component based on the difference between the reference visits corresponding to the first time period and the second mean.

7. The method according to claim 1, characterized in that The determining whether the service component is abnormal based on the second threshold and the first indicator value includes: determining a minimum value between the second threshold and a preset third threshold; When the first indicator value is greater than or equal to the minimum value, it is determined that the service component is abnormal.

8. A monitoring device for a service component, characterized in that: include: An acquisition module, configured to acquire a first indicator value of a performance indicator item of a service component at a first time point, a second indicator value of the performance indicator item at a second time point, and first attribute information of the service component at the first time point, where the second time point is earlier than the first time point; a determining module, configured to determine a first threshold corresponding to the performance indicator item at the first time point based on the second indicator value; an adjusting module, configured to adjust the first threshold based on the first attribute information to obtain a second threshold; A monitoring module is used to determine whether the service component is abnormal based on the second threshold and the first indicator value.

9. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the service component monitoring method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the monitoring method of the service component as described in any one of claims 1 to 7.

Images