Resource use alarm method of configurable linux desktop system

Abstract

The invention discloses a configurable linux desktop system resource usage alarm method, and the method comprises the steps: carrying out the sampling of different types of target resource data in a preset time window based on a target sampling strategy determined by the load of a target desktop system, and obtaining a plurality of different types of target resource data; the method comprises the following steps: performing anomaly detection on different types of target resource data according to an abnormal data detection model, continuously performing judgment based on a target threshold value corresponding to each type of target resource data according to a preset judgment strategy under the condition of determining that the different types of target resource data are not abnormal, and determining an alarm level, and finally, giving an alarm according to an alarm strategy corresponding to the alarm level. The data used by the method is diversified, so that the situation of inaccurate alarm caused by single data type is avoided; in addition, the inaccuracy condition caused by monitoring the resource use condition of the linux desktop system only from a single angle can be avoided, and therefore the purpose of improving the alarm accuracy is achieved.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of system resource monitoring, and particularly to a configurable resource usage alarm method for Linux desktop system and a computer readable storage medium. BACKGROUND

[0002] Linux desktop system resources refer to various software components and system tools in a Linux desktop environment for supporting system operation and providing user interaction functions. In order to guarantee user experience, avoid security risks, prolong hardware life, and reduce operation and maintenance costs, it is necessary to monitor the usage of Linux desktop system resources and perform alarm according to the monitoring results.

[0003] At present, some traditional tools (such as top, htop, etc.) are used to monitor the usage of Linux desktop system resources. However, the existing monitoring method is relatively single, and the monitoring effect is poor. SUMMARY

[0004] In view of the above defects or deficiencies in the prior art, it is desirable to provide a configurable resource usage alarm method for Linux desktop system.

[0005] The first aspect provides a configurable resource usage alarm method for Linux desktop system, the method comprising: determining the load of a target desktop system, and determining a target sampling strategy according to the load; sampling according to the target sampling strategy within a preset time window to obtain target resource data, the types of the target resource data including multiple types; performing abnormality detection on the target resource data based on the target resource data and an abnormality data detection model to obtain an abnormality detection result; if the abnormality detection result is normal, determining an alarm level based on a preset determination strategy, the target resource data, and a target threshold corresponding to each type of the target resource data; performing alarm according to an alarm strategy corresponding to the alarm level.

[0006] The application provides a configurable linux desktop system resource use alarm method, which considers that the prior art has a single monitoring method for the resource use of a linux desktop system and poor monitoring effect. In view of this problem, the target sampling strategy determined based on the load of the target desktop system is used to sample different kinds of target resource data in a preset time window to obtain a plurality of different kinds of target resource data. First, the different kinds of target resource data are subjected to abnormality detection according to an abnormal data detection model, in a case where it is determined that the different kinds of target resource data have no abnormality, a preset determination strategy is used to determine based on a target threshold corresponding to each kind of target resource data, and an alarm level is determined, and finally, an alarm is given according to an alarm strategy corresponding to the alarm level. The application performs abnormality detection on a plurality of different kinds of target resource data and gives an alarm according to the abnormality detection result, and determines different kinds of target resource data to give an alarm according to the determination result. It can be seen that the application uses different kinds of resource data as data support in the alarm process, so that the data is diversified, and the resource use of the linux desktop system is alarmed from two different angles of abnormality of the target resource data and the relationship between the target resource data and the corresponding target threshold. This not only avoids the inaccurate alarm caused by the single type of data, but also avoids the inaccurate monitoring of the resource use of the linux desktop system from a single angle, thereby achieving the purpose of improving the alarm accuracy.

[0007] The second aspect provides a computer readable storage medium, having a computer program stored thereon, wherein the computer program is executed by a processor to implement the method of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0008] Other features, objects and advantages of the application will become more apparent from the following detailed description of non-limiting embodiments, made with reference to the accompanying drawings: Figure 1 A step flowchart of a configurable linux desktop system resource use alarm method provided by the application; Figure 2 A step flowchart of a configurable linux desktop system resource use alarm method provided by the application; Figure 3 A step flowchart of a configurable linux desktop system resource use alarm method provided by the application; Figure 4 A step flowchart of a configurable linux desktop system resource use alarm method provided by the application; Figure 5A step flow chart of a configurable Linux desktop system resource use alarm method provided by the application; Figure 6 A step flow chart of a configurable Linux desktop system resource use alarm method provided by the application; Figure 7 A step flow chart of a configurable Linux desktop system resource use alarm method provided by the application; Figure 8 A step flow chart of a configurable Linux desktop system resource use alarm method provided by the application; Figure 9 A structural block diagram of a configurable Linux desktop system resource use alarm device provided by the application; Figure 10 A structural schematic diagram of a computer system provided by the application. DETAILED DESCRIPTION

[0009] The application will be further described below in conjunction with the accompanying drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the related application, and not to limit the application. In addition, it should be noted that only the parts related to the application are shown in the drawings for ease of description.

[0010] It should be noted that the embodiments in the application and the features in the embodiments can be combined with each other without conflict. The application will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

[0011] Linux desktop system resources refer to various software components and system tools used to support system operation and provide user interaction functions in a Linux desktop environment. In order to protect user experience, avoid security risks, prolong hardware life, and reduce operation and maintenance costs, it is necessary to monitor the use of Linux desktop system resources and give an alarm according to the monitoring results.

[0012] At present, some traditional tools (such as top, htop, etc.) are used to monitor the use of Linux desktop system resources. However, the existing monitoring method is relatively single, and the monitoring effect is poor.

[0013] In order to solve this problem, the application provides a configurable Linux desktop system resource use alarm method, which will be described below in conjunction with Figure 1 The configurable Linux desktop system resource use alarm method provided by the application will be described by way of example, Figure 1 A step flow chart of a configurable Linux desktop system resource use alarm method provided by the application, which comprises the following steps: Step S20, determining the load of the target desktop system, and determining the target sampling strategy according to the load; Wherein, the target desktop system is any Linux system. The load of the target desktop system refers to the workload or resource occupation degree that the target desktop system is currently processing.

[0014] The load of the target desktop system can be quantified by CPU usage, memory usage, disk usage, bandwidth usage, number of packets per second, number of requests processed simultaneously, number of concurrent connections, etc. The load of the target desktop system can be instantaneous load (i.e. peak value at the current time), average load, or special load of a specific process / service, which is not limited here and can be determined according to current needs.

[0015] For example, the application can obtain the memory usage of the system by the following method, and determine the load of the target desktop system according to the memory usage: Read the / proc / meminfo file, obtain the values of the MemTotal and MemFree fields, and calculate the memory usage according to the following formula: ; The target sampling strategy is used to limit the sampling method of the target resource data at future time points, time periods, etc. The target sampling strategy includes sampling frequency, such as sampling once per second; the target sampling strategy can also include sampling quantity, such as sampling 60 data once per second.

[0016] The application can reduce the sampling frequency and sampling quantity when the load of the target desktop system is high, and increase the sampling frequency and sampling quantity when the load of the target desktop system is low.

[0017] The application dynamically adjusts the target sampling strategy according to the load of the target desktop system, so as to make the current sampling strategy more suitable for the load of the target desktop system, and achieve a balance among resource efficiency, data quality, and system stability.

[0018] For example, when the terminal device obtains the current CPU usage reaching 90%, the sampling strategy of sampling once per second and sampling 30 resource data each time is adjusted to the sampling strategy of sampling once every five seconds and sampling 15 resource data each time. At this time, sampling once every five seconds and sampling 15 resource data each time is the determined target sampling strategy.

[0019] Step S30, sampling according to the target sampling strategy within a predetermined time window to obtain target resource data, and the types of the target resource data include multiple; Wherein, after the target sampling strategy is determined according to the load of the target desktop system, the target resource data needs to be sampled according to the target sampling strategy. The sampling is performed in a preset time window, and the time boundary of the sampling is clearly defined. The target resource data of multiple different types is obtained through sampling, which makes the data support more abundant, and ensures the comparability of the data.

[0020] In addition, in order to avoid the problem of low accuracy caused by single data alarm, the target sampling strategy is used to collect multiple different types of target resource data. These target resource data can include some basic indicators and process-level indicators. The basic indicators are, for example, user-mode CPU usage, physical memory usage, swap space usage, disk I / O throughput, GPU utilization, etc. The process-level indicators are, for example, single-process CPU occupancy, physical memory, exclusive memory, event response delay, etc.

[0021] In an optional embodiment, the basic indicators can be obtained by reading / proc virtual files, and the process-level indicators can be obtained by reading cgroups v2.

[0022] For example, the terminal device can use a sampling strategy of taking 10 minutes as a sampling time window, sampling every five seconds in 10 minutes, and sampling 15 resource data each time to sample multiple CPU usage, multiple physical memory usage, multiple swap space usage, multiple disk I / O throughput, multiple GPU utilization, multiple single-process CPU occupancy, multiple physical memory, multiple exclusive memory, and multiple event response delay.

[0023] Step S40, performing abnormality detection on the target resource data based on the target resource data and an abnormal data detection model to obtain an abnormality detection result; Wherein, after the target sampling strategy is determined according to the load of the target desktop system, the target resource data needs to be sampled according to the target sampling strategy. The sampling is performed in a preset time window, and the time boundary of the sampling is clearly defined. The target resource data of multiple different types is obtained through sampling, which makes the data support more abundant, and ensures the comparability of the data.

[0024] The anomaly detection results obtained by the anomaly data detection model can include both normal and abnormal results. It is understood that when the anomaly detection result is normal, it indicates that none of the different types of input target resource data are abnormal; conversely, when the anomaly detection result is abnormal, it indicates that abnormal target resource data exists among the different types of input target resource data.

[0025] It should be noted here that in order to improve the efficiency of the alarm, we do not need to know which target resource data has anomalies, nor do we need to know the number of target resource data with anomalies. This can simplify the training process when training the abnormal data detection model, allowing the model to converge quickly, thereby achieving the purpose of improving the training efficiency of the abnormal data detection model. By performing anomaly detection on the target resource data, the present application can quickly identify problems such as sudden surges in CPU usage or memory leaks, thereby improving the efficiency of the alarm.

[0026] For example, the terminal device may input 1800 CPU utilization, 1800 physical memory utilization, 1800 swap space utilization, 1800 disk I / O throughput, 1800 GPU utilization, 1800 single-process CPU occupancy, 1800 physical memory, 1800 exclusive memory, and 1800 event response delay into the abnormal data detection model to obtain normal anomaly detection results.

[0027] Step S50: If the abnormality detection result is normal, the alarm level is determined based on the preset judgment strategy, the target resource data, and the target threshold corresponding to each type of target resource data; Among them, it can be seen from the above that the present application performs anomaly detection on multiple different types of target resource data obtained by sampling to obtain anomaly detection results; the anomaly detection results can be normal and abnormal. Here we must first explain that when the anomaly detection result is normal, the terminal device does not interrupt the alarm on the resource usage of the Linux desktop system, but continues to further monitor the resource usage of the Linux desktop system according to the preset judgment strategy, target resource data and the target threshold corresponding to each type of target resource data, and determines the alarm level according to the monitoring results.

[0028] It should be noted that the preset determination strategy can be a basis for determining the alarm level according to the user's demand, the historical resource usage of the linux desktop system, the configuration requirement, and the like. For example, the preset determination strategy can be set based on Boolean logic. For example, the preset determination strategy is that the alarm level is level one when CPU > 90 OR memory usage > 80; the alarm level is level two when CPU > 90 AND memory usage > 80; and the alarm level is level three when CPU > 90 AND memory usage > 80 AND event response delay > 5.

[0029] It can be understood that, according to the above-described preset determination strategy, the determination strategy needs to be implemented according to the target resource data and the target threshold corresponding to each kind of target resource data, that is, the target resource data and the target threshold corresponding thereto need to be compared, and the alarm level is determined according to the comparison result and the preset determination strategy.

[0030] Since the types of the target resource data include multiple types, different types of target resource data represent different meanings, and therefore one target threshold cannot be set to compare with different types of target resource data. Here, different target thresholds need to be set for different types of target resource data. For example, the present application can determine the corresponding target threshold for each target resource data according to the historical data corresponding to each target resource data, and store the multiple target thresholds in the memory address of the terminal device. When the target resource data is obtained by sampling, the target threshold corresponding to the type of the target resource data is read from the corresponding memory address for comparison.

[0031] For example, the terminal device can compare the usage rates of 1800 CPUs, the usage rates of 1800 physical memories, the usage rates of 1800 swap spaces, and the I / O throughputs of 1800 disks with the first threshold, the second threshold, the third threshold, and the fourth threshold, respectively, and obtain the result that there is a usage rate of a CPU greater than the first threshold in the usage rates of the 1800 CPUs, there is a usage rate of a physical memory greater than the second threshold in the usage rates of the 1800 physical memories, there is no usage rate of a swap space greater than the third threshold in the usage rates of the 1800 swap spaces, and there is no I / O throughput of a disk greater than the fourth threshold in the I / O throughputs of the 1800 disks.

[0032] Then, according to the determination strategy that the alarm level is level two when CPU usage rate > first threshold AND physical memory usage rate > second threshold, it is determined that the alarm level is level two.

[0033] The alarm level represents the severity and urgency of the event, and is usually divided into multiple levels (such as severe, major, general, and the like). The present application determines the alarm level to perform targeted alarm according to different alarm strategies as follows.

[0034] Step S60, according to the alarm policy corresponding to the alarm level, the alarm is given.

[0035] Among them, the alarm policy in the present application is the response rule preset for each alarm level. The system automatically matches the alarm policy according to the alarm level, ensures that the response is adapted to the severity, and the combination of the two ensures that the alarm processing is efficient and accurate. For example, the alarm policy can be determined according to the following way: The memory address of the terminal device can be stored with the corresponding relationship information of the alarm level and the alarm policy. When the alarm level is determined according to the above determination process, the corresponding alarm policy is obtained by matching the alarm level with the corresponding relationship information, and the alarm is given according to the alarm policy.

[0036] For example, the corresponding relationship information is, for example:

[0037] The present application not only classifies the alarm, but also sets different alarm policies for different levels of alarm, separates the resource usage of different linux desktop systems, and ensures that urgent problems are handled first. In addition, it can also reduce the disposal errors caused by human operation differences, and realize the transition from "manual fire fighting" to "intelligent prevention and control".

[0038] In an optional embodiment, the present application divides the load into three intervals, and sets different target sampling strategies according to different intervals, specifically: If the load is higher than the first threshold, the first sampling strategy is determined as the target sampling strategy; If the load is lower than the second threshold, the second sampling strategy is determined as the target sampling strategy, the sampling frequency of the second sampling strategy is higher than that of the first sampling strategy, and the sampling quantity of the second sampling strategy is greater than that of the first sampling strategy; If the load is between the second threshold and the first threshold, the third sampling strategy is determined as the target sampling strategy, the sampling frequency of the third sampling strategy is between the sampling frequency of the first sampling strategy and the sampling frequency of the second sampling strategy, and the sampling quantity of the third sampling strategy is between the sampling quantity of the first sampling strategy and the sampling quantity of the second sampling strategy.

[0039] Among them, the first threshold and the second threshold can be preset values for determining the degree of load according to historical load data. The first sampling strategy, the second sampling strategy and the third sampling strategy are sampling strategies matched for different loads in order to realize the balance of resource efficiency, data quality and system stability. When the load of the target desktop system is different at different times, the system can select different sampling strategies to implement sampling, so as to achieve the purpose of energy saving and consumption reduction, improving data precision and effectiveness.

[0040] The present application achieves the above purpose by sampling with a lower sampling frequency and a smaller number of samples when the load of the target desktop system is high; sampling with a higher sampling frequency and a larger number of samples when the load of the target desktop system is low; and sampling with a sampling frequency and a sampling number between higher and lower when the load of the target desktop system is neither high nor low.

[0041] For example, if the load of the target system is higher than the first threshold, the target sampling strategy is to sample once every five seconds, and 15 resource data are sampled each time; if the load of the target system is lower than the second threshold, the target sampling strategy is to sample five times per second, and 60 resource data are sampled each time; if the load of the target system is between the second threshold and the first threshold, the target sampling strategy is to sample once per second, and 40 resource data are sampled each time.

[0042] In an optional embodiment, if Figure 2 As shown, Figure 2 An optional method embodiment of performing anomaly detection on target resource data provided by an exemplary embodiment of the present application includes the following steps: Step S201, performing corresponding feature extraction processing according to the type of target resource data to obtain multiple feature data; The type of target resource data is used to distinguish different resource data. Different types of target resource data require differentiated feature extraction methods.

[0043] For example, if the target resource data is the CPU usage rate, the first-order derivative of the resource usage rate can be calculated as the characteristic data corresponding to the CPU usage rate; if the target resource data is process-type resource data, the statistical process correlation can be used as the characteristic data; if the target resource data is time-type data, the time period (such as working days and non-working days) can be recorded as the characteristic data.

[0044] This application converts raw data into machine-understandable quantitative indicators through feature engineering, retaining key patterns in the data (such as periodicity and abnormal fluctuations), which facilitates anomaly detection by anomaly data detection models.

[0045] In step S202 , the plurality of feature data are input into an abnormal data detection model to perform abnormality detection and obtain an abnormality detection result.

[0046] Among them, after obtaining multiple different feature data through the above process, the present application inputs the extracted multi-dimensional feature data into a pre-trained anomaly data detection model for anomaly detection; the anomaly data detection model can, for example, output abnormal or normal detection results by comparing historical normal patterns or preset thresholds.

[0047] This application obtains anomaly detection results through the above method, replacing manual rule design with automated feature extraction, which can adapt to target resource data of multiple data types; in addition, the anomaly detection of this application integrates multi-feature detection, which is more capable of capturing complex anomalies than single-indicator detection, and this method supports dynamically adding new resource types, and only requires adapting the feature extraction logic, which is scalable.

[0048] In another optional embodiment, as Figure 3 As shown, Figure 3 This application provides another resource usage alarm method for Linux desktop systems, which includes the following steps: Step S301: If the abnormality detection result is abnormal, determine the target alarm level according to the abnormality detection result; Among them, if the anomaly detection result is abnormal, it indicates that there are abnormal target resource data in different types of target resource data. At this time, the system does not need to continue to determine the alarm level based on the subsequent preset judgment strategy, target resource data and the target threshold corresponding to each type of target resource data; the alarm level can be directly determined and an alarm can be issued.

[0049] Optionally, the present application can determine the target alarm level based on indicators such as the number of abnormal target resource data, the type of abnormal target resource data, and the degree of abnormality of the abnormal target resource data. Therefore, it is understandable that during the process of performing anomaly detection using the abnormal data detection model, the number of abnormal target resource data, the type of abnormal target resource data, the degree of abnormality of the abnormal target resource data, etc. can be further determined using the abnormal data detection model. In this case, the requirements for the abnormal data detection model are relatively high, and corresponding training factors need to be added during the training process to obtain the required abnormal data detection model. The model training process is a conventional training process and will not be described in detail here.

[0050] Step S302: determining a target alarm strategy based on the target alarm level and the corresponding relationship information, where the corresponding relationship information includes multiple alarm levels and the alarm strategy corresponding to each alarm level; The corresponding relationship information here can be the same as the corresponding relationship information described above, or it can be a new corresponding relationship information re-planned based on the abnormal detection results. This is not described in detail here. It is understandable that considering the rational use of resources, only one corresponding relationship information can be set. Examples of corresponding relationship information are described above and are not described in detail here.

[0051] Step S303: Issue an alarm according to the target alarm strategy.

[0052] As mentioned above, after obtaining the target alarm strategy according to the above steps, the alarm can be issued according to the target alarm strategy. For example, the system can issue an alarm every 5 minutes through desktop notification + icon flashing.

[0053] In another optional embodiment, Figure 4 As shown, Figure 4 An exemplary embodiment of the present application provides an optional method embodiment for determining an alarm level based on a preset determination strategy, target resource data, and a target threshold corresponding to each type of target resource data. The method embodiment includes the following steps: Step S401, comparing each target resource data with the corresponding target threshold to obtain multiple target comparison results; For each different target resource data, the present application sets a different target threshold value. The present application may determine the alarm level based on the result of comparing each target resource data with the corresponding target threshold value and a preset judgment strategy.

[0054] It should be noted here that for each type of target resource data, there may be only one target comparison result or multiple target comparison results, and this application does not limit this.

[0055] For example, 180 CPU usage rates may be compared with 90% respectively, and a comparison result may be obtained that there is no CPU usage rate greater than 90% among the 180 CPU usage rates; or 180 CPU usage rates may be compared with 90% respectively, and a comparison result may be obtained that 20% of the 180 CPU usage rates have CPU usage rates greater than 90%; or 180 CPU usage rates may be compared with 90% respectively, and 180 comparison results may be obtained that the first CPU usage rate is greater than 90%, the second CPU usage rate is less than 90%, the third CPU usage rate is less than 90%, ... and the 180th CPU usage rate is greater than 90%.

[0056] Step S402: determining the alarm level according to a preset determination strategy and multiple target comparison results.

[0057] As described above, the preset determination strategy can be a basis for determining the alarm level based on user needs, historical resource usage of the Linux desktop system, configuration requirements, etc. Exemplarily, the preset determination strategy can be based on Boolean logic. For example, the preset determination strategy is: CPU > 90 OR memory usage > 80 (alarm level 1); CPU > 90 AND memory usage > 80 (alarm level 2); CPU > 90 AND memory usage > 80 AND event response delay > 5 (alarm level 3).

[0058] For example, the application can determine the alarm level as level three according to the preset determination strategy in the case that there are more than 90% of 180 CPU usage rates, more than 80% of 180 memory usage rates, and more than 5 seconds of 180 event response delays.

[0059] Optionally, as shown in Figure 5 Figure 5 An optional method embodiment for obtaining a plurality of target comparison results provided by the application includes the following steps: Step S501, comparing a plurality of target resource data with a target threshold for each kind of target resource data to obtain a plurality of comparison results; As described above, the application sets a corresponding target threshold for different kinds of target resource data, for example, the target threshold for CPU usage rate is 90%, the target threshold for memory usage rate is 80%, and the target threshold for event response delay is 5 seconds.

[0060] Since the application is based on a preset time window for sampling, the number of samples obtained for each kind of target resource data includes a plurality. For example, 180 CPU usage rates are sampled, and then 180 CPU usage rates are compared with 90% to obtain a plurality of comparison results.

[0061] Step S502, if the comparison result is that the number of target resource data exceeding the target threshold reaches a preset number, the target comparison result is that the target resource data exceeds the target threshold; After comparing each kind of target resource data with the corresponding target threshold, a plurality of comparison results can be obtained, for example, the first CPU usage rate is greater than 90%, the second CPU usage rate is less than 90%, the third CPU usage rate is less than 90%, and so on. The number of 180 CPU usage rates is greater than 90%. Here, the application further determines the target comparison result according to the relationship between the number of target resource data exceeding the target threshold and the preset number. Only when the number of target resource data exceeding the target threshold reaches the preset number, the target comparison result is determined as the target resource data exceeding the target threshold.

[0062] Step S503, if the comparison result is that the number of target resource data exceeding the target threshold does not reach the preset number, the target comparison result is that the target resource data does not exceed the target threshold.

[0063] Similarly, the application determines the target comparison result as the target resource data not exceeding the target threshold when the number of target resource data exceeding the target threshold does not reach the preset number. Determining the target comparison result in this way can shield occasional fluctuations and reduce invalid alarms.​

[0064] In another optional embodiment, as shown in Figure 6 Figure 6 An optional method embodiment for updating the target threshold provided by the present application includes the following steps: Step S601, obtaining a plurality of historical resource data of different types; Step S602, updating the target threshold according to the average value and standard deviation of the plurality of historical resource data.

[0065] Among them, the present application can be in the idle time of the system, for each kind of resource data to evaluate whether the corresponding target threshold is the current optimal. The evaluation method is: Collecting a plurality of historical resource data of different types, obtaining a plurality of data sets, calculating the average value and standard deviation for each historical resource data corresponding to the data set; Then the new target threshold can be determined according to the following formula: μ + 3σ; μ is the average value, and σ is the standard deviation.

[0066] Then compare the current target threshold with the new target threshold, when they are consistent, it means that the current target threshold is optimal, when they are inconsistent, the new target threshold can replace the current target threshold to update the target threshold.

[0067] Optionally, the present application sets an upper limit protection for each target resource data corresponding to the target threshold, in order to avoid over-optimization of the target threshold.

[0068] The present application converts the static threshold into a dynamic threshold, and quantifies the historical volatility (standard deviation) to make the target threshold always adapt to the current data distribution, while reducing false positives and improving the detection rate of gradual anomalies (such as resource leakage).

[0069] Optionally, the present application adopts a ring buffer to realize a continuous duration detection verification mechanism for a preset time window. That is, through the way of circular storage and data coverage, the dynamic verification of the continuous duration is realized. The ring buffer structure is a fixed-size storage space connected at the head and tail, and the new data covers the old data (such as a 10-length buffer is full, the 11th data will cover the 1st). Based on the limitation of the ring buffer structure, in the process of alarm, if new resource data enters the time window, the resource data with the earliest timestamp in the time window will be removed from the time window.

[0070] The following describes the continuous duration detection logic: write the timestamp or event marker to the buffer, and calculate the time span through the difference between the current pointer and the historical pointer.

[0071] ​For example, detecting "CPU overload for 5 minutes continuously", only need to verify the time difference between the newest and the oldest overload record in the buffer is ≥ 5 minutes.

[0072] The application can reduce memory consumption and avoid full data scanning by using the ring buffer to implement the continuous duration detection verification, ensure the real-time of data, and avoid the problems of data missing and incorrect cleaning caused by manual cleaning, and improve the accuracy and effectiveness of data.

[0073] In another optional embodiment, as shown in Figure 7 Figure 7 Another alarm method provided by the application includes the following steps: Step S701, after alarm according to the alarm strategy corresponding to the alarm level, if the user's closing instruction is received; Wherein, in the process of executing the corresponding strategy (such as email notification, SMS alarm, log recording) according to the preset alarm level (such as level 1, level 2, level 3), the user can actively send a closing instruction to attempt to terminate the alarm (for example, click the "ignore" button on the operation and maintenance interface).

[0074] Step S702, according to the closing instruction, determine whether the alarm implementation result corresponding to the alarm strategy can be ended; if not, execute step S703; if yes, execute step S704; Step S703, maintain the alarm implementation result; Step S704, hide the alarm implementation result and adjust the target sampling strategy.

[0075] Wherein, after receiving the closing instruction, the system needs to check whether the alarm strategy allows manual closing (that is, whether the alarm implementation result corresponding to the alarm strategy can be ended). If it cannot be ended, it means that the alarm level is high, and if it can be ended, it means that the alarm level is low, so the system can determine whether it can be ended according to the alarm level corresponding to the alarm implementation result. Finally, according to the judgment result, execute the corresponding operation.

[0076] It should be noted here that if the alarm implementation result can be manually closed, from another point of view, the alarm level determined at this time is not high, and it can be determined that the resource usage of the desktop system is maintained well. In order to reduce resource consumption, the sampling frequency and / or sampling quantity can be temporarily reduced (such as from 1 time per second to 1 time per minute).

[0077] The application will be described in the following Figure 8 exemplary description: Step S801, determine the load of the target desktop system, and determine the sampling strategy as sampling once per second according to the load, and sample 30 resource data each time; ​In step S802, 300 CPU usage rates, 300 physical memory usage rates and 300 event response delays are obtained by sampling the three kinds of resource data according to a sampling strategy of sampling once per second and sampling 5 resource data each time within 1 minute. In step S803, 300 first feature data, 300 second feature data and 300 third feature data are obtained by performing feature extraction on the 300 CPU usage rates, 300 physical memory usage rates and 300 event response delays respectively. In step S804, the 300 first feature data, 300 second feature data and 300 third feature data are input into an abnormal data detection model to perform abnormal detection on the target resource data, and an abnormal detection result is obtained. If the abnormal detection result is abnormal, step S805 is performed; if the abnormal detection result is normal, step S806 is performed. In step S805, an alarm strategy is matched from the corresponding relationship information according to an alarm level, and an alarm is performed by a full-screen mask + buzzer sound for every 1 minute, and the alarm strategy is implemented. In step S806, a comparison result is obtained by comparing the 300 CPU usage rates, 300 physical memory usage rates and 300 event response delays with a first threshold value, a second threshold value and a third threshold value respectively. In step S807, if the comparison result is CPU>90 AND memory usage rate>80 AND event response delay>5, a preset determination strategy is used to determine that the alarm level is level three. In step S808, the alarm level of level three is matched with the corresponding relationship information, an alarm strategy is obtained, which is to perform an alarm in a manner of continuously notifying by email + system log recording, and the alarm is performed according to the alarm strategy.

[0078] The application provides a configurable linux desktop system resource use alarm method, which considers that the prior art has a single monitoring method for the resource use of a linux desktop system and poor monitoring effect. In view of this problem, the application determines a target sampling strategy based on the load of a target desktop system, samples different kinds of target resource data in a preset time window, and obtains a plurality of different kinds of target resource data; first, the different kinds of target resource data are detected for abnormalities according to an abnormal data detection model, in a case where it is determined that the different kinds of target resource data have no abnormalities, a preset determination strategy is continued to be used to determine based on a target threshold corresponding to each kind of target resource data, an alarm level is determined, and finally, an alarm is given according to an alarm strategy corresponding to the alarm level. On the one hand, the application detects a plurality of different kinds of target resource data for abnormalities and gives an alarm according to the abnormal detection result; on the other hand, the different kinds of target resource data are determined to give an alarm according to the determination result; it can be seen that, in the process of giving an alarm, the application uses different kinds of resource data as data support, so that the data is diversified, and the resource use of the linux desktop system is alarmed from two different angles of abnormal conditions of the target resource data and the relationship between the target resource data and the corresponding target threshold, which not only avoids the inaccurate alarm caused by a single kind of data, but also avoids the inaccurate monitoring of the resource use of the linux desktop system from a single angle, so that the purpose of improving the alarm accuracy is achieved.

[0079] It should be noted that, although the operations of the method of the application are described in a specific order in the accompanying drawings, this does not require or imply that the operations must be performed in this specific order, or that all of the shown operations must be performed to achieve the desired result. On the contrary, the steps depicted in the flowchart can change the order of execution.

[0080] Further reference is made to Figure 9 which shows an exemplary structural block diagram of a configurable linux desktop system resource use alarm device 900 according to an embodiment of the application, the resource use alarm device 900 comprising a first determination module 901, a sampling obtaining module 902, an abnormality detection module 903, a second determination module 904 and an alarm module 905.

[0081] The first determination module 901 is configured to determine the load of a target desktop system and determine a target sampling strategy according to the load; The sampling obtaining module 902 is configured to sample according to the target sampling strategy in a preset time window to obtain target resource data, and the types of the target resource data include a plurality of types; The anomaly detection module 903 is configured to perform anomaly detection on the target resource data based on the target resource data and an anomaly data detection model, and obtain an anomaly detection result. The second determination module 904 is configured to, if the anomaly detection result is normal, determine an alarm level based on a preset determination strategy, the target resource data, and a target threshold corresponding to each type of the target resource data. The alarm module 905 is configured to perform alarm according to an alarm strategy corresponding to the alarm level.

[0082] In an optional embodiment, the first determination module 901 is specifically configured to, if the load is higher than a first threshold, determine a first sampling strategy as the target sampling strategy. If the load is lower than a second threshold, determine a second sampling strategy as the target sampling strategy, where a sampling frequency of the second sampling strategy is higher than a sampling frequency of the first sampling strategy, and a sampling quantity of the second sampling strategy is greater than a sampling quantity of the first sampling strategy. If the load is between the second threshold and the first threshold, determine a third sampling strategy as the target sampling strategy, where a sampling frequency of the third sampling strategy is between the sampling frequency of the first sampling strategy and the sampling frequency of the second sampling strategy, and a sampling quantity of the third sampling strategy is between the sampling quantity of the first sampling strategy and the sampling quantity of the second sampling strategy.

[0083] In an optional embodiment, the anomaly detection module 903 is specifically configured to perform corresponding feature extraction processing according to a type of the target resource data, and obtain a plurality of feature data. The plurality of feature data is input into the anomaly data detection model to perform anomaly detection, and the anomaly detection result is obtained.

[0084] In an optional embodiment, the alarm module 905 is further configured to, if the anomaly detection result is abnormal, determine a target alarm level according to the anomaly detection result. Determine a target alarm strategy according to the target alarm level and corresponding relationship information, where the corresponding relationship information includes a plurality of alarm levels and an alarm strategy corresponding to each alarm level. Perform alarm according to the target alarm strategy.

[0085] In an optional embodiment, the second determination module 904 is specifically configured to compare each type of the target resource data with a corresponding target threshold, and obtain a plurality of target comparison results. Determine the alarm level according to a preset determination strategy and the plurality of target comparison results.

[0086] In an optional embodiment, the second determining module 904 is further configured to compare each of the target resource data with a target threshold, and obtain a plurality of comparison results. If the comparison result is that the number of target resource data exceeding the target threshold reaches a preset number, the target comparison result is that the target resource data exceeds the target threshold. If the comparison result is that the number of target resource data exceeding the target threshold does not reach the preset number, the target comparison result is that the target resource data does not exceed the target threshold.

[0087] In an optional embodiment, the resource usage alarm device 900 further comprises an updating module. The updating module is configured to obtain a plurality of historical resource data of different types. The target threshold is updated according to the average value and the standard deviation of the plurality of historical resource data.

[0088] In an optional embodiment, the resource usage alarm device 900 further comprises a removal module. The removal module is configured to, in the process of the alarm, if new resource data enters the preset time window, remove the resource data with the earliest timestamp in the time window from the time window.

[0089] In an optional embodiment, the resource usage alarm device 900 further comprises a receiving closing module. The receiving closing module is configured to, after the alarm is performed according to the alarm strategy corresponding to the alarm level, if a closing instruction of a user is received; determine whether the alarm implementation result corresponding to the alarm strategy can be ended according to the closing instruction; if not, maintain the alarm implementation result; if yes, hide the alarm implementation result and adjust the sampling frequency in the target sampling strategy.

[0090] It should be understood that the units or modules described in the resource usage alarm device 900 correspond to the respective steps in the method described with reference to Figure 1 The operations and features described above with respect to the method are also applicable to the resource usage alarm device 900 and the units contained therein, and will not be described here. The resource usage alarm device 900 can be pre- implemented in the browser or other security applications of the electronic device, or can be loaded into the browser or security applications thereof of the electronic device by downloading or the like. The corresponding units in the resource usage alarm device 900 can cooperate with the units in the electronic device to realize the schemes of the embodiments of the present application.

[0091] The following will be described with reference to Figure 10which shows a structural diagram of a computer system 1000 of a computer device suitable for use in implementing embodiments of the present application.

[0092] As shown in Figure 10 , the computer system 1000 includes a central processing unit (CPU) 1001 which can perform various appropriate actions and processes in accordance with a program stored in a read only memory (ROM) 1002 or a program loaded from the storage section 1008 into a random access memory (RAM) 1003. In the RAM 1003, various programs and data required for the operation of the system 1000 are also stored. The CPU 1001, the ROM 1002, and the RAM 1003 are connected to each other through a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0093] The following components are connected to the I / O interface 1005: an input section 1006 including a keyboard, a mouse, etc.; an output section 1007 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN card, a modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as necessary. A removable media 1011 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 1010 as necessary, so that a computer program read out therefrom is installed into the storage section 1008 as necessary.

[0094] In particular, in accordance with embodiments of the present disclosure, the processes described above with reference to Figures 1-8 may be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product comprising a computer program tangibly embodied on a machine readable medium, the computer program containing program code for executing Figures 1-8 the methods. In such embodiments, the computer program can be downloaded and installed from a network via the communication section 1009, and / or installed from the removable media 1011.

[0095] The computer program product of the present application can be a computer program embodied on a non-transitory computer readable medium. When the program is executed by a computer, it can carry out described operations, for example, the operations described in connection with the flow charts and block diagrams of the present application. The computer readable medium can be a computer readable signal medium and / or a computer readable storage medium. The computer program product can be a computer program that, when executed by a computer, carries out operations according to the present application; the computer program can be stored in the memory of the computer and executed by the processor of the computer. The computer readable storage medium can be, for example but not limited to, a Read-Only Memory (ROM), a RAM, a flash memory, or a compact disk.

[0096] The units or modules described in the embodiments of the present application can be implemented by software or by hardware. The described units or modules can also be arranged in a processor, for example, a processor can be described as including an XX unit, a YY unit, and a ZZ unit. In some cases, the names of the units or modules do not constitute a limitation on the units or modules themselves, for example, the XX unit can also be described as a "unit for XX".

[0097] As another aspect, the present application also provides a computer readable storage medium, which can be a computer readable storage medium included in the apparatus described in the above embodiments, or can exist separately from the apparatus and not be assembled into the apparatus. The computer readable storage medium stores one or more programs for execution by one or more processors to perform the resource usage warning method of the configurable Linux desktop system described in the present application.

[0098] The above description is merely preferred embodiments of the present application and a description of the principles of the technology used. Those skilled in the art should understand that the scope of the application described in the present application is not limited to the technical solutions formed by the specific combinations of the above technical features, and should also cover other technical solutions formed by any combinations of the above technical features or equivalent features without departing from the inventive concept. For example, the above features can be replaced with technical features disclosed in the present application (but not limited to) having similar functions to form technical solutions.

Claims

1. A configurable resource usage alarm method for a Linux desktop system, characterized in that: The method comprises: Determining a load of a target desktop system and determining a target sampling strategy based on the load; Sampling is performed according to the target sampling strategy within a preset time window to obtain target resource data, where the target resource data may be of multiple types; Performing anomaly detection on the target resource data based on the target resource data and an anomaly data detection model to obtain an anomaly detection result; If the abnormality detection result is normal, determining an alarm level based on a preset judgment strategy, the target resource data, and a target threshold corresponding to each type of the target resource data; An alarm is issued according to the alarm strategy corresponding to the alarm level.

2. The method according to claim 1, characterized in that Determining a target sampling strategy according to the load includes: If the load is higher than a first threshold, determining the first sampling strategy as the target sampling strategy; If the load is lower than a second threshold, a second sampling strategy is determined as the target sampling strategy, wherein a sampling frequency of the second sampling strategy is higher than a sampling frequency of the first sampling strategy, and a sampling quantity of the second sampling strategy is greater than a sampling quantity of the first sampling strategy; If the load is between the second threshold and the first threshold, a third sampling strategy is determined as the target sampling strategy, a sampling frequency of the third sampling strategy is between the sampling frequency of the first sampling strategy and the sampling frequency of the second sampling strategy, and a sampling number of the third sampling strategy is between the sampling number of the first sampling strategy and the sampling number of the second sampling strategy.

3. The method according to claim 1, characterized in that The performing anomaly detection on the target resource data based on the target resource data and the anomaly data detection model includes: Performing corresponding feature extraction processing according to the type of the target resource data to obtain multiple feature data; The plurality of feature data are input into the abnormal data detection model to perform abnormality detection to obtain the abnormality detection result.

4. The method according to claim 1, wherein The method further comprises: If the abnormality detection result is abnormal, determining a target alarm level according to the abnormality detection result; determining a target alarm strategy according to the target alarm level and the correspondence information, wherein the correspondence information includes a plurality of alarm levels and an alarm strategy corresponding to each alarm level; Issue an alarm according to the target alarm strategy.

5. The method according to claim 1, wherein The determining of the alarm level based on a preset determination strategy, the target resource data, and a target threshold corresponding to each type of the target resource data includes: Comparing each target resource data with a corresponding target threshold to obtain multiple target comparison results; The alarm level is determined according to a preset determination strategy and the comparison results of the multiple targets.

6. The method according to claim 5, wherein each of the target resource data comprises a plurality of The step of comparing each target resource data with a corresponding target threshold to obtain multiple target comparison results includes: For each type of target resource data, the plurality of target resource data are respectively compared with a target threshold value to obtain a plurality of comparison results; If the comparison result is that the target resource data exceeds the target threshold by a predetermined number, obtaining the target comparison result as that the target resource data exceeds the target threshold; If the comparison result is that the target resource data exceeds the target threshold by an amount that does not reach a preset amount, then the target comparison result is obtained as that the target resource data does not exceed the target threshold.

7. The method according to any one of claims 5 or 6, characterized in that The method further comprises: Obtain multiple historical resource data of different types; The target threshold is updated according to an average value and a standard deviation of the plurality of historical resource data.

8. The method according to claim 1, characterized in that The method further comprises: During the alarm process, if new resource data enters the preset time window, the resource data with the earliest timestamp in the time window is removed from the time window.

9. The method according to claim 1, characterized in that The method further comprises: After issuing an alarm according to the alarm strategy corresponding to the alarm level, if a shutdown instruction from the user is received; Determining whether the alarm implementation result corresponding to the alarm strategy can be ended according to the closing instruction; If not, then maintain the alarm implementation result; If so, the alarm implementation result is hidden and the sampling frequency in the target sampling strategy is adjusted.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images