Server early warning method, device, equipment and medium

Abstract

The invention provides a server early warning method and device, equipment and a medium. The method comprises the steps of obtaining current inspection data of a target server, performing time sequence processing on the current inspection data and historical inspection data of the target server, determining target time sequence inspection data of the target server, inputting the target time sequence inspection data into a fault prediction model for prediction processing, and obtaining a fault prediction result of the target server, and when the fault probability is greater than the preset probability threshold, early warning information is sent to the terminal equipment, so that possible faults of the server can be predicted in advance, a user can eliminate fault hidden dangers before the server fails, and the use stability of the server is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and particularly relates to a server early warning method and device, equipment and medium. BACKGROUND

[0002] With the rapid development of the Internet, a large number of servers are deployed in various industries as infrastructure support, and it is a basic requirement to ensure the normal operation of these servers.

[0003] In the prior art, the running state of the server is usually inspected, and when it is found that the server has a problem, a professional technician is arranged to make specific maintenance according to the on-site fault.

[0004] However, when the server fails, it will cause the problem that the server cannot be normally used. SUMMARY

[0005] The present application provides a server early warning method, device, equipment and medium to solve the problem of unstable server operation in the prior art.

[0006] In a first aspect, the present application provides a server early warning method, comprising:

[0007] obtaining current inspection data of a target server, the current inspection data comprising at least one of CPU usage data, memory usage data, disk I / O data, network bandwidth data, hardware temperature data, and hardware health state data;

[0008] performing time sequence processing on the current inspection data and historical inspection data of the target server to determine target time sequence inspection data of the target server, the historical inspection data being inspection data in a preset time period before the current time, and the preset time period being continuous with the current time;

[0009] inputting the target time sequence inspection data into a fault prediction model for prediction processing to obtain a fault prediction result of the target server, wherein the fault prediction model is obtained by training according to time sequence inspection data samples and corresponding fault labels of the time sequence inspection data samples, and the fault prediction result represents a fault type of the target server and a fault probability of the fault type;

[0010] when the fault probability is greater than a preset probability threshold, sending early warning information to a terminal device, the early warning information comprising the fault type.

[0011] In the present application, the current inspection data of the target server is obtained, comprising:

[0012] determining a target protocol interface of the target server;

[0013] determining a target conversion interface of the target protocol interface according to the target protocol interface;

[0014] According to the target conversion interface and host information of the target server, current inspection data of the target server is acquired, wherein the host information comprises an IP address, a username and a password.

[0015] In the present application, the target protocol interface of the target server is determined, comprising:

[0016] First response information of the redfish protocol interface of the target server is acquired.

[0017] If the first response information meets preset response requirements, the redfish protocol interface is determined as the target protocol interface.

[0018] In the present application, the method further comprises:

[0019] If the first response information does not meet preset response requirements or the redfish protocol interface does not respond, second response information of the IPMI protocol interface of the target server is acquired.

[0020] If the second response information meets preset response requirements, the IPMI protocol interface is determined as the target protocol interface.

[0021] In the present application, the current inspection data and historical inspection data of the target server are subjected to time sequence processing to determine target time sequence inspection data of the target server, comprising:

[0022] The historical inspection data of the target server within a preset time period is acquired from a database.

[0023] According to the record time of each time of data collection in the historical inspection data and the record time of the current inspection data, the historical inspection data and the current inspection data are sorted according to the chronological order to obtain the target time sequence inspection data.

[0024] In the present application, before the target time sequence inspection data is input into the fault prediction model for prediction processing to obtain the prediction result of the target server, the method further comprises:

[0025] A time sequence inspection data sample set of a sample server is acquired, the time sequence inspection data sample set comprising a plurality of groups of time sequence inspection data samples, each group of time sequence inspection data sample comprising time sequence inspection data within a period of time and a fault type after the period of time, the fault type comprising any one of a power supply fault, a CPU fault, a memory fault, a hard disk fault, a network card fault, a mainboard fault and a fan fault.

[0026] According to the time sequence inspection data sample set, a pre-acquired training model is subjected to model training to obtain the fault prediction model.

[0027] In the present application, the early warning information is sent to the terminal device, comprising:

[0028] According to the fault probability in the fault prediction result and the preset probability threshold, the early warning level and the early warning form corresponding to the early warning level are determined;

[0029] According to the early warning form, the early warning information is sent to the terminal device, and the early warning information further includes the early warning level.

[0030] In a second aspect, the present application provides a server early warning device, comprising:

[0031] The acquisition module is configured to acquire current inspection data of the target server, wherein the current inspection data includes at least one of CPU usage data, memory usage data, disk I / O data, network bandwidth data, hardware temperature data, and hardware health state data;

[0032] The determination module is configured to perform time sequence processing on the current inspection data and historical inspection data of the target server to determine target time sequence inspection data of the target server, wherein the historical inspection data is inspection data in a preset time period before the current time, and the preset time period is continuous with the current time;

[0033] The prediction module is configured to input the target time sequence inspection data into a fault prediction model for prediction processing to obtain a fault prediction result of the target server, wherein the fault prediction model is obtained by training a time sequence inspection data sample and a fault label corresponding to the time sequence inspection data sample, and the fault prediction result represents a fault type of the target server and a fault probability of the fault type;

[0034] The sending module is configured to send early warning information to the terminal device when the fault probability is greater than the preset probability threshold, and the early warning information includes the fault type.

[0035] In a third aspect, the present application provides an electronic device, comprising a processor and a memory in communication connection with the processor;

[0036] The memory stores computer execution instructions;

[0037] The processor executes the computer execution instructions stored in the memory to implement the method provided by the present application.

[0038] In a fourth aspect, the present application provides a computer readable storage medium, wherein the computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the method provided by the present application.

[0039] The server early warning method, device, equipment and medium provided by the application, by obtaining the current inspection data of the target server. Then the current inspection data and the historical inspection data of the target server are time series processed to obtain the target time series inspection data of the target server, and then the target time series inspection data is input into the fault prediction model for prediction processing to obtain the fault prediction result of the target server. When the fault probability in the fault prediction result is greater than the preset probability threshold, the user is sent the early warning information, reminding the user to pay attention to the fault type in the fault prediction result, so that the user can eliminate the server fault hidden danger before the server fails, and improve the running stability of the server. BRIEF DESCRIPTION OF DRAWINGS

[0040] The accompanying drawings, which are incorporated herein and constitute part of the specification, illustrate embodiments consistent with the application and, together with the description, further serve to explain the principles of the application.

[0041] Figure 1 The schematic diagram of the server early warning application scenario provided by the embodiment of the application is shown in the following figure.

[0042] Figure 2 The flowchart of the server early warning method embodiment one provided by the application is shown in the following figure.

[0043] Figure 3 The flowchart of the server early warning method embodiment two provided by the application is shown in the following figure.

[0044] Figure 4 The structural diagram of the server early warning device provided by the embodiment of the application is shown in the following figure.

[0045] Figure 5 The structural diagram of the electronic device provided by the embodiment of the application is shown in the following figure.

[0046] Through the above drawings, the specific embodiments of the application have been shown, and more detailed description will be given in the following. These drawings and textual descriptions are not intended to limit the scope of the concept of the application by any means, but to illustrate the concept of the application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0047] The exemplary embodiments will be described in detail herein with reference to the accompanying drawings. Unless otherwise indicated, the same numbers on different drawings represent the same or similar elements. The following exemplary embodiments are described in detail with reference to the accompanying drawings. The embodiments described in the following exemplary embodiments do not represent all the embodiments consistent with the application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the application as detailed in the appended claims.

[0048] In order to clearly understand the technical solutions of the application, the prior art solutions are first described in detail.

[0049] With the rapid development of the Internet, a large number of servers are deployed in various industries as infrastructure support, and the normal operation of these servers is a basic requirement. Server hardware inspection is a sub-item in many inspection tasks, and a simple and efficient tool is needed to complete the inspection of a large number of servers. When doing hardware inspection, the health status of each hardware device of the server needs to be monitored.

[0050] In the prior art, the running state of the server is usually periodically inspected, and when the server has a problem, a professional technician is arranged to do specific maintenance according to the on-site fault.

[0051] However, when the server fails to maintain, it will cause the problem that the server cannot be normally used.

[0052] To solve the above problems, the inventors have found in research that the target time sequence inspection data can be constructed through the inspection data of the server each time, and then the target time sequence inspection data of the server is analyzed through a preset fault prediction model to obtain a fault prediction result, and finally the fault type and fault probability in the fault prediction result are used for early warning, so that the possible fault of the server can be predicted in advance, so that the user can eliminate the hidden danger before the server fails, and the use stability of the server is improved.

[0053] The application scenario of the server early warning method provided by the embodiments of the present application is introduced below.

[0054] Figure 1 The application scenario of the server early warning provided by the embodiments of the present application is shown in the figure. The server early warning device 101 inspects the server 102, obtains the current inspection data of the server 102, and obtains the time sequence inspection data according to the current inspection data and the historical inspection data of the server 102. Then the server early warning device 101 predicts according to the time sequence inspection data to obtain a fault prediction result, and finally sends early warning information to the terminal device 103 according to the fault prediction result.

[0055] It should be noted that the server early warning device can be realized by software, or by the combination of software and hardware, and the present application does not limit this.

[0056] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below with the server early warning device as the execution subject and with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0057] Figure 2A flowchart of an embodiment of a server warning method provided in the present application is shown in FIG. 1. As shown in FIG. 1, the method comprises the following steps. Figure 2

[0058] S201, obtaining current inspection data of a target server.

[0059] In this step, the server warning device can be connected to the target server through a target protocol interface of the target server, so as to obtain the current inspection data of the target server.

[0060] The target server can refer to a server capable of communicating with the server warning device, so that the server warning device can obtain the inspection data.

[0061] The target protocol interface can refer to a protocol interface preset on the target server, and the target protocol interface can include at least one of an IPMI (Intelligent Platform Management Interface) protocol interface and a redfish (a kind of remote management and monitoring interface) protocol interface.

[0062] The current inspection data can refer to the inspection data obtained by the server warning device from the target server at the current time.

[0063] The current inspection data can include at least one of CPU (Central Processing Unit) usage data, memory usage data, disk I / O data, network bandwidth data, hardware temperature data, and hardware health status data.

[0064] The CPU usage data can include user CPU usage rate, system CPU usage rate, idle CPU usage rate, interrupt CPU usage rate, real-time CPU usage rate, average CPU usage rate, etc.

[0065] The memory usage data can include used memory amount, free memory amount, cache memory amount, etc.

[0066] The disk I / O data can include read / write byte number, I / O operation number per second, etc.

[0067] The network bandwidth data can include inbound and outbound data transmission rate.

[0068] The hardware temperature data can include temperature of CPU, GPU (Graphics Processing Unit), hard disk, etc.

[0069] ​The hardware health status data can include fan rotating speed, power supply status, disk SMART (Self-Monitoring Analysis and Reporting Technology) data, and the like.

[0070] S202, time sequence processing is performed on the current inspection data and the historical inspection data of the target server to determine target time sequence inspection data of the target server.

[0071] In this step, the server early warning device obtains the historical inspection data of the target server from the database, and sorts the current inspection data and the historical inspection data according to time to obtain the target time sequence inspection data of the target server, so as to represent the change of the inspection data of the target server in a continuous time period, and facilitate the analysis of the hardware state of the target server.

[0072] The historical inspection data can refer to the inspection data in a preset time period before the current time, and the preset time period is continuous with the current time.

[0073] The preset time period can be preset according to the number requirement of the input sequence data of the fault prediction model and the time period of the inspection.

[0074] For example, the number requirement of the input of the fault prediction model is 10 groups of sequence data, the inspection period is 1 hour inspection once, and the current time is X month X day 12 o'clock, and the preset time period can be a time period of 10 hours before X month X day 12 o'clock.

[0075] Optionally, in order to make the time interval between the sequence inspection data consistent, the preset time period and the current time can be continuous.

[0076] For example, the current time is X month X day 12 o'clock, and the preset time period is 10 hours before X month X day 12 o'clock, and the preset time period is X month X day 2 o'clock-X month X day 11 o'clock, so that the preset time period and the current time are continuous.

[0077] Optionally, the historical inspection data can be stored in the database, and the database can include the name of the server, the host information of the server, the inspection data of the server and the recording time. The server early warning device can read the recording time of the inspection data of the target server from the database based on the preset time period, then select the recording time meeting the preset time period and the historical inspection data corresponding to the recording time, and sort the historical inspection data and the current inspection data according to the time sequence to obtain the target time sequence inspection data.

[0078] S203, inputting the target time sequence inspection data into the fault prediction model for prediction processing to obtain the fault prediction result of the target server.

[0079] In this step, the server early warning device inputs the target timing inspection data into the fault prediction model for prediction processing to obtain a fault prediction result of the target server. The fault prediction result can include a fault type of the target server and a fault probability of the fault type.

[0080] The fault type can include any one of a power supply fault, a CPU fault, a memory fault, a hard disk fault, a network card fault, a mainboard fault, and a fan fault.

[0081] The power supply fault can refer to a fault such as a damaged power supply, poor power supply line contact, or internal capacitor aging of the power supply.

[0082] The CPU fault can refer to a fault such as CPU overheating, unstable CPU voltage, or physical damage to the CPU.

[0083] The memory fault can refer to a fault such as poor memory contact, damaged memory, incompatible memory, or BIOS setting error.

[0084] The hard disk fault can refer to a fault such as physical damage to the hard disk (such as head failure, disk scratch), circuit failure, firmware damage, and logical error (such as partition table damage).

[0085] The network card fault can refer to a fault such as network card driver problem, network card hardware damage, poor network line connection, or network setting error.

[0086] The mainboard fault can refer to a fault such as capacitor aging, chip damage, poor slot contact, short circuit, or BIOS damage.

[0087] The fan fault can refer to a fault such as fan not rotating or rotating at too low a speed.

[0088] The fault probability can refer to a value in the range of 0%-100%.

[0089] For example, the fault prediction result: power supply fault (fault type), 50% (fault probability).

[0090] Optionally, the fault prediction model can be obtained by model training on a pre-acquired to-be-trained model according to a timing inspection data sample and a fault label corresponding to the timing inspection data sample.

[0091] The timing inspection data sample can refer to timing inspection data of a sample server in a period of time and a fault type after the period of time.

[0092] The fault label can include any one of a power supply fault, a CPU fault, a memory fault, a hard disk fault, a network card fault, a mainboard fault, and a fan fault.

[0093] The to-be-trained model can map the predicted result to the interval of 0-1, so that the fault probability of a certain fault type of the target server can be obtained, and the fault type can be pre-alerted according to the fault probability, different pre-alerting manners are determined, and the pre-alerting effect is improved.

[0094] The to-be-trained model can include any one of a logistic regression model, a decision tree, a random forest, a gradient boosting machine, a neural network, a Bayesian network, and a support vector machine.

[0095] In S204, when the fault probability is greater than the preset probability threshold, pre-alerting information is sent to the terminal device, and the pre-alerting information includes the fault type.

[0096] In this step, after the fault prediction model outputs the fault prediction result, the fault probability in the fault prediction result is compared with the preset probability threshold, and when the fault probability is greater than the preset probability threshold, pre-alerting information is sent to the user to remind the user to pay attention to the fault type in the fault prediction result.

[0097] Optionally, in order to avoid frequent sending of pre-alerting information to the user, the fault probability can be screened by the preset probability threshold.

[0098] The preset probability threshold can refer to a requirement for pre-alerting according to the fault probability.

[0099] For example, the preset probability threshold is 60%, and when the fault probability is greater than 60%, pre-alerting information is sent to the user.

[0100] Optionally, the server pre-alerting apparatus can send the pre-alerting information to the terminal device of the user.

[0101] The user can be a worker using the server pre-alerting apparatus, a maintenance person of the server, or a server inspection person, etc.

[0102] The terminal device can refer to a desktop computer, a notebook computer, an all-in-one machine, a smart phone, a tablet computer, a wearable device, or a smart television, etc.

[0103] In the embodiments of the present application, the server pre-alerting apparatus obtains the current inspection data of the target server. Then, the current inspection data and the historical inspection data of the target server are time-series processed to obtain target time-series inspection data of the target server, and the target time-series inspection data is input into the fault prediction model for prediction processing to obtain the fault prediction result of the target server. When the fault probability in the fault prediction result is greater than the preset probability threshold, pre-alerting information is sent to the user, so that the possible fault of the server can be predicted in advance, and the user can eliminate the fault hidden danger before the server fails, and the use stability of the server is improved.

[0104] Figure 3A flowchart of a server warning method embodiment two provided in the present application is shown in FIG. 2. As shown in FIG. 2, the method comprises the following steps. Figure 3

[0105] S301, determining a target protocol interface of a target server.

[0106] In this step, when the server warning device needs to perform an inspection on the target server, the target protocol interface of the target server can be determined, and the target server can be connected through the target protocol interface.

[0107] Optionally, before determining the target protocol interface of the target server, the protocol compatibility of the server to be inspected can be detected to determine whether the server to be inspected supports the redfish protocol interface or the redfish protocol interface. If the server to be inspected passes the protocol compatibility detection, the server to be inspected is determined as the target server, and the target protocol interface of the target server is further determined.

[0108] In some embodiments, determining the target protocol interface of the target server comprises:

[0109] obtaining first response information of a redfish protocol interface of the target server;

[0110] If the first response information meets the preset response requirement, the redfish protocol interface is determined as the target protocol interface.

[0111] The first response information can be obtained by sending a heartbeat packet or a lightweight query.

[0112] In this step, since the redfish protocol interface has a wider coverage, the first response information of the redfish protocol interface of the target server is obtained first, and if the first response information meets the preset response requirement, the redfish protocol interface is determined as the target protocol interface.

[0113] Optionally, the first response information of the redfish protocol interface of the target server can be obtained by a heartbeat packet.

[0114] The heartbeat packet is a small data packet sent periodically to detect the online status and connection health of a remote system or service. Before the inspection, a heartbeat packet can be sent to the target server to obtain the first response information, wherein the first response information can include the response time of the target server to the heartbeat packet.

[0115] The heartbeat packet can be sent to the target server through the redfish protocol interface. This packet usually does not contain important business data and is only used for connection detection. ​

[0116] Optionally, the first response information of the redfish protocol interface of the target server is obtained through a lightweight query.

[0117] The lightweight query can refer to performing a query operation with less consumption of system resources to check the function and performance of the protocol interface. Such a query usually contains more information than a heartbeat packet, but is still lightweight to avoid unnecessary burden on the production environment. Before the inspection, a lightweight query request is sent to the server through the redfish protocol interface to obtain the first response information, wherein the first response information can include the response data volume of the protocol interface of the target server.

[0118] Optionally, in order to evaluate the performance and availability of the redfish protocol interface, the first response information needs to be filtered to determine whether the redfish protocol interface is applicable. The first response information can be compared with a preset response requirement. If the first response information meets the preset response requirement, it is determined that the redfish protocol interface is applicable and can be used as the target protocol interface.

[0119] When the first response information is obtained through the heartbeat packet, the preset response requirement can be a requirement for response time, for example, the preset response requirement is that the response time is less than 3 seconds.

[0120] When the first response information is obtained through the lightweight query, the preset response requirement can be a requirement for response data volume, for example, the preset response requirement is that the response data volume is 90% of the data volume sent by the lightweight query.

[0121] In some embodiments, if the first response information does not meet the preset response requirement or the redfish protocol interface does not respond, the second response information of the IPMI protocol interface of the target server is obtained.

[0122] If the second response information meets the preset response requirement, the IPMI protocol interface is determined as the target protocol interface.

[0123] Optionally, the second response information of the IPMI protocol interface of the target server can be obtained through a heartbeat packet or a lightweight query.

[0124] When the second response information is obtained through the heartbeat packet, the second response information can include the response time of the target server to the heartbeat packet, and the preset response requirement can be a requirement for response time, for example, the preset response requirement is that the response time is less than 3 seconds.

[0125] When the second response information is obtained through the lightweight query, the second response information can include response data amount of the protocol interface of the target server, and the preset response requirement can be a requirement on the response data amount, for example, the preset response requirement is that the response data amount is 90% of the data amount sent by the lightweight query.

[0126] S302, determine a target conversion interface of the target protocol interface according to the target protocol interface.

[0127] In this step, since the target protocol interface is a redfish protocol interface or an IPMI protocol interface, in order to unify the interface layer, the target conversion interface is configured for the target protocol interface, so that the server warning device can determine the target conversion interface of the target protocol interface through the target protocol interface, and then obtain the current inspection data of the target server through the target conversion interface. In this way, the server warning device interacts with each target server through a unified target conversion interface, without needing to care about specific protocol details, realizes decoupling of the server warning device and the target protocol interface, and improves the flexibility of inspection.

[0128] The target conversion interface can be a restful interface.

[0129] Specifically, the target conversion interface corresponding to the target protocol interface can be configured according to the target protocol interface.

[0130] When the target protocol interface is a redfish protocol interface, a restful interface is configured for the redfish protocol interface, and when the target protocol interface is an IPMI protocol interface, a restful interface is configured for the IPMI protocol interface.

[0131] S303, obtain the current inspection data of the target server according to the target conversion interface and host information of the target server.

[0132] In this step, after the interface for communicating with the target server is determined, the server warning device obtains the host information of the target server from the database, obtains the authorization permission of the target server according to the host information, and obtains the current inspection data.

[0133] Optionally, the host information can include an IP address, a username and a password.

[0134] Further, according to the range of inspection, the server that needs to be inspected is determined, and then the IP address, the username and the password of the server are obtained, and the IP address, the username and the password of the server are stored in the database.

[0135] S304, obtain the historical inspection data of the target server in a preset time period from the database.

[0136] In this step, according to the preset time period, the recording time corresponding to the preset time period is determined, and then the inspection data corresponding to the recording time of the target server is found from the database to obtain the historical inspection data.

[0137] For example, the preset time period is from 1:00 on X month X day to 10:00 on X month X day, and the inspection data corresponding to the recording time of 1:00 on X month X day, 2:00 on X month X day, …, 10:00 on X month X day of the target server needs to be found from the database to obtain the historical inspection data.

[0138] S305, according to the recording time of each collection data in the historical inspection data and the recording time of the current inspection data, the historical inspection data and the current inspection data are sorted according to the time sequence to obtain the target time sequence inspection data.

[0139] In this step, according to the recording time of each collection data in the historical inspection data and the recording time of the current inspection data, the recording time is sorted according to the time sequence to obtain the time sequence, and then the inspection data corresponding to the recording time is sorted according to the time sequence, so as to obtain the target time sequence inspection data, which represents the state change of the target server in a period of time, which is beneficial to fault prediction.

[0140] S306, inputting the target time sequence inspection data into the fault prediction model for prediction processing to obtain the prediction result of the target server.

[0141] In some embodiments, before the target time sequence inspection data is input into the fault prediction model for prediction processing to obtain the prediction result of the target server, the method further comprises:

[0142] Obtaining a time sequence inspection data sample set of a sample server, the time sequence inspection data sample set comprising a plurality of time sequence inspection data samples, each time sequence inspection data sample comprising time sequence inspection data within a period of time and a fault type after the period of time, the fault type comprising any one of power supply failure, CPU failure, memory failure, hard disk failure, network card failure, mainboard failure and fan failure;

[0143] According to the time sequence inspection data sample set, a pre-obtained training model is trained to obtain a fault prediction model.

[0144] The time sequence inspection data sample set can refer to a sample set used for training the training model and meeting the model training sample quantity requirement.

[0145] Optionally, the acquisition of the time-series inspection data sample can be achieved by first determining each fault type, obtaining the fault type and fault record time of the sample server from the database, then obtaining the time-series inspection data of the server within a period of time before the fault record time according to the fault record time, then performing data cleaning, and finally taking the cleaned time-series inspection data and the fault type as a set of time-series inspection data samples.

[0146] Data cleaning can refer to removing outliers, filling in missing values, standardizing or normalizing data, and ensuring data quality.

[0147] The period of time and the preset time period can satisfy a constraint condition, and the constraint condition can be that the length of the period of time and the preset time period is the same; or the difference between the length of the period of time and the preset time period and the length of the shorter one of the period of time and the preset time period is less than or equal to a preset difference threshold. For example, the preset difference threshold is 10%.

[0148] For example, the period of time is from 1:00 on X month to 10:00 on X month, the length is 10 hours, and the preset time period is from 1:00 on X month 2 to 11:00 on X month 2, the length is 11 hours. The ratio is (11-10) / 10=10%.

[0149] Optionally, according to the set of time-series inspection data samples, the set of time-series inspection data samples is divided into a training set, a validation set and a test set, a to-be-trained model is trained, and a fault prediction model is obtained.

[0150] Specifically, the to-be-trained model is trained using the training set data, and the hyperparameters are adjusted to optimize the model performance. Cross-validation can be used to select the best combination of hyperparameters.

[0151] The model performance is evaluated using the validation set, and the evaluation indicators can include at least one of accuracy, recall, F1 score, AUC-ROC curve, mean square error (MSE), root mean square error (RMSE), or mean absolute error (MAE). According to the performance of the model on the validation set, the model structure or parameters can be adjusted by an ensemble learning method (such as bagging, boosting), and the training and evaluation process is repeated until a satisfactory performance is achieved.

[0152] The final model is finally evaluated using the test set data, and after confirming that there is no overfitting, the fault prediction model is obtained.

[0153] S307, according to the fault probability in the fault prediction result and the preset probability threshold, determining the warning level and the warning form corresponding to the warning level.

[0154] In this step, the fault probability and the preset probability threshold are compared, and according to the difference between the fault probability and the preset probability threshold, the corresponding warning level is determined, and then the warning form is determined according to the warning level, so as to improve the warning effect.

[0155] For example, the preset probability threshold is 60%, when 60% < fault probability ≤ 80%, the warning level is low warning; when 80% < fault probability ≤ 90%, the warning level is medium warning; when 90% < fault probability ≤ 100%, the warning level is high warning.

[0156] The warning form can refer to the way of sending the warning information to the terminal device of the specific user.

[0157] For example, when the warning level is low warning, the warning information can be sent to the mailbox or specific platform on the terminal device of the operation and maintenance personnel.

[0158] When the warning level is medium warning, the warning information can be sent to the instant messaging tool on the terminal device of the operation and maintenance personnel.

[0159] When the warning level is high warning, the warning information can be sent to the short message, telephone or instant messaging tool on the terminal device of the operation and maintenance personnel and the operation and maintenance person in charge.

[0160] S308, according to the warning form, the warning information is sent to the terminal device, and the warning information also includes the warning level.

[0161] In this step, after determining the warning form, the fault type and the warning level in the prediction result are sent to the terminal device as the warning information to inform the user that there is a fault hidden danger in the target server, so that the user can maintain the target server in advance.

[0162] Optionally, the warning information can include warning time, target server name, fault type, warning level, fault probability, maintenance personnel information, etc.

[0163] In some possible embodiments, the server warning device further comprises a proxy component for improving the security of remote management and monitoring of the server, preventing unauthorized access, data leakage and other network threats.

[0164] The proxy component comprises:

[0165] 1. Encryption communication enhancement

[0166] For implementing TLS1.3 (Transport Layer Security Protocol version 1.3, Transport Layer Security Protocol) mandatory encryption channel, ensuring all communication data of IPMI and Redfish to be encrypted and transmitted.

[0167] Integrated certificate management supports self-signed certificates and third-party CA certificates, enabling client and server identity verification.

[0168] 2. Access control and authentication mechanisms

[0169] Introduce multi-factor authentication (MFA) including passwords, hardware tokens, biometrics, etc., to enhance user identity verification security.

[0170] Implement fine-grained permission management and role-based access control (RBAC) to ensure users can only access resources within their scope of responsibility.

[0171] 3. Activity audit and log analysis

[0172] Automatically record and analyze all IPMI and Redfish interaction logs, including login attempts, configuration changes, etc.

[0173] 4. Malicious behavior detection and defense

[0174] Integrate an intrusion detection system (IDS) to identify potential attacks through behavior pattern analysis.

[0175] Implement IP black / white lists to limit access from specific IP addresses and prevent DDoS (Distributed Denial of Service Attack).

[0176] 5. Firmware and protocol update management:

[0177] Automatically detect and push the latest security patches for IPMI controllers and Redfish servers.

[0178] Support version control of security policies to ensure compatibility and security during upgrades.

[0179] 6. Isolation and firewall policies

[0180] Implement network micro-segmentation to ensure IPMI and Redfish are logically isolated from production networks.

[0181] Configure dedicated firewall rules to only open necessary ports and block irrelevant traffic from entering the management network.

[0182] In some possible implementations, the embodiments of the present application also include a technical architecture.

[0183] The technical architecture can include:

[0184] Front-end interface: Internet management interface for configuring security policies, viewing audit logs, and managing user permissions.

[0185] Middleware layer: API (Application Programming Interface) gateway handling encryption and decryption, identity verification, access control, and other logic.

[0186] Backend services: Distributed microservices architecture including authentication services, logging services, policy management services, etc., ensuring high availability.

[0187] Data storage: Using encrypted databases to store sensitive information such as user credentials, audit logs, etc.

[0188] Hardware interface: Tight integration with IPMI and Redfish hardware platforms to ensure seamless implementation of security policies.

[0189] In some possible implementations, the embodiments of the present application also include a patrol center.

[0190] The patrol center includes:

[0191] 1. Host entry: Provides a friendly interface or API interface to allow users to manually or in batches import host information, organize server resources, and classify servers into categories according to domains (based on project, business, or geographical location, etc.).

[0192] 2. Host storage: Design an efficient and reliable database system to store all entered host information and various data generated by subsequent patrols. Use sharding, indexing optimization, and other technologies to ensure efficient data retrieval.

[0193] 3. Host detection: Real-time or scheduled detection of hardware status (such as CPU temperature, memory usage, hard disk health status, etc.) and software status (such as system logs, service status) of the host. In the event of manual errors, mismatched account passwords, connection timeouts, or abnormal indicator acquisition, etc., it needs to be detected in a timely manner.

[0194] 4. Patrol management: Allows administrators to define patrol strategies such as patrol period, patrol content (full patrol or specific components), threshold settings, etc. Supports multi-dimensional patrol plan configuration, including by host, business line, geographical location, etc.

[0195] 5. Patrol task: Automatically generates patrol tasks according to patrol strategies, supports task scheduling and execution monitoring, ensures timely execution of patrol operations, and has task priority management to handle unexpected situations.

[0196] 6. Inspection report: automatically generate detailed inspection reports, including inspection time, test items, test results, abnormal details, etc., support multiple formats such as PDF (Portable Document Format), HTML (HyperText Markup Language), etc. Export, easy to share and archive.

[0197] 7. Index data storage: build a time series database to store the index data of the previous inspection, facilitate historical data analysis and trend prediction, support large data storage and efficient query.

[0198] 8. Data intelligent analysis: use machine learning and data mining techniques to analyze inspection data in depth, identify abnormal patterns, predict hardware failures, and optimize resource allocation recommendations.

[0199] 9. Data warning: set warning rules, when the detected index exceeds the preset threshold, immediately send warning notifications through multiple channels such as email, SMS, enterprise IM (Instant Messaging), etc. Ensure timely response.

[0200] In the embodiment of the application, when the server warning device needs to inspect the target server, the current inspection data of the target server can be obtained through the target conversion interface of the target protocol interface, and then the target time sequence inspection data is obtained according to the current inspection data and the historical inspection data of the preset time period obtained from the database., input the target time sequence inspection data into the fault prediction model for prediction processing to obtain the fault prediction result of the target server, according to the fault probability in the fault prediction result and the preset probability threshold, determine the warning level and the warning form corresponding to the warning level, finally, according to the warning form, send the warning information to the terminal device, so that the possible faults of the server can be predicted in advance, so that the user can eliminate the hidden danger before the server fails, and improve the stability of the server.

[0201] Figure 4 The structure diagram of the server warning device provided in the embodiment of the application is shown in Figure 1. As shown in Figure 1, the device 40 includes: an acquisition module 401, a determination module 402, a prediction module 403, and a sending module 404, wherein: Figure 4

[0202] The acquisition module 401 is configured to acquire current inspection data of a target server, wherein the current inspection data includes at least one of CPU usage data, memory usage data, disk I / O data, network bandwidth data, hardware temperature data, and hardware health state data.

[0203] ​The determining module 402 is configured to perform time sequence processing on the current inspection data and historical inspection data of the target server to determine target time sequence inspection data of the target server, the historical inspection data being inspection data in a preset time period before a current time, and the preset time period being continuous with the current time.

[0204] The predicting module 403 is configured to input the target time sequence inspection data into a fault prediction model to perform prediction processing, to obtain a fault prediction result of the target server, wherein the fault prediction model is obtained by training according to time sequence inspection data samples and fault labels corresponding to the time sequence inspection data samples, and the fault prediction result represents a fault type of the target server and a fault probability of the fault type.

[0205] The sending module 404 is configured to send early warning information to a terminal device when the fault probability is greater than a preset probability threshold, the early warning information including the fault type.

[0206] In a possible implementation, the obtaining module 401 is further configured to:

[0207] determine a target protocol interface of the target server;

[0208] determine a target conversion interface of the target protocol interface according to the target protocol interface;

[0209] obtain the current inspection data of the target server according to the target conversion interface and host information of the target server, wherein the host information includes an IP address, a username, and a password.

[0210] In a possible implementation, the obtaining module 401 is further configured to:

[0211] obtain first response information of a redfish protocol interface of the target server;

[0212] if the first response information meets a preset response requirement, determine the redfish protocol interface as the target protocol interface.

[0213] In a possible implementation, the obtaining module 401 is further configured to:

[0214] if the first response information does not meet the preset response requirement or the redfish protocol interface does not respond, obtain second response information of an IPMI protocol interface of the target server;

[0215] if the second response information meets the preset response requirement, determine the IPMI protocol interface as the target protocol interface.

[0216] In a possible implementation, the determining module 402 is further configured to:

[0217] Obtain historical inspection data of the target server in a preset time period from a database;

[0218] According to the record time of each collection of the historical inspection data and the record time of the current inspection data, the historical inspection data and the current inspection data are sorted in chronological order to obtain target time sequence inspection data.

[0219] In a possible implementation, the sending module 404 is further configured to:

[0220] According to the fault probability in the fault prediction result and a preset probability threshold, determine a warning level and a warning form corresponding to the warning level;

[0221] According to the warning form, send warning information to the terminal device, and the warning information further includes the warning level.

[0222] Figure 5 The electronic device provided in the embodiments of the present application is shown in a structural schematic diagram of an electronic device. As shown in the figure, Figure 5 The electronic device 50 includes:

[0223] The electronic device 50 can include a processor 501 with one or more processing cores, a memory 502 with one or more computer-readable storage media, a communication component 503, and the like. Among them, the processor 501, the memory 502 and the communication component 503 are connected through the bus 504.

[0224] In the specific implementation process, the at least one processor 501 executes the computer execution instructions stored in the memory 502, so that the at least one processor 501 executes the server warning method as described above.

[0225] The specific implementation process of the processor 501 can refer to the method embodiments described above, which has similar implementation principles and technical effects, and will not be described here.

[0226] In the above Figure 5 In the embodiments shown in the figure, it should be understood that the processor can be a central processing unit (English: Central Processing Unit, abbreviated: CPU), and can also be other general-purpose processors, digital signal processors (English: Digital Signal Processor, abbreviated: DSP), application specific integrated circuits (English: Application Specific Integrated Circuit, abbreviated: ASIC) and the like. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the application can be directly embodied as the execution of the hardware processor, or executed by the combination of hardware and software modules in the processor.

[0227] The memory can include a random access memory (RAM) and can also include a non-volatile memory (NVM), such as at least one disk memory.

[0228] The bus can be an industry standard architecture (ISA) bus, a peripheral component (PCI) bus, an extended industry standard architecture (EISA) bus, or the like. The bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, the bus in the drawings of the present application does not limit to only one bus or one type of bus.

[0229] In some embodiments, a computer program product is also provided, including a computer program or instructions, which, when executed by a processor, implement the steps of any of the above server warning methods.

[0230] The specific implementation of each operation above can refer to the previous embodiments, which will not be repeated here.

[0231] Those of ordinary skill in the art can understand that all or part of the steps of the various methods of the above embodiments can be completed by instructions, or by relevant hardware controlled by the instructions, which can be stored in a computer readable storage medium and loaded and executed by a processor.

[0232] To this end, an embodiment of the present application provides a computer readable storage medium, which stores a plurality of instructions. The instructions can be loaded by a processor to execute the steps of any of the server warning methods provided by the embodiments of the present application.

[0233] The storage medium can include a read only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like.

[0234] According to an aspect of the present application, a computer program product or a computer program is provided, which includes computer instructions stored in a computer readable storage medium.

[0235] Since the instructions stored in the storage medium can execute the steps in any one of the server warning methods provided by the embodiments of the present application, the beneficial effects that can be achieved by any one of the server warning methods provided by the embodiments of the present application can be achieved, which are described in detail in the foregoing embodiments and will not be described here again.

[0236] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

[0237] It is to be understood that the application is not limited to the precise details of design and construction that have been described and exemplified above and that various modifications and changes can be made by those skilled in the art without departing from the scope of the application. The scope of the application is limited only by the claims that follow.

Claims

1. A server early warning method, characterized in that, include: Obtain the current inspection data of the target server, wherein the current inspection data includes at least one of the following: CPU usage data, memory usage data, disk I / O data, network bandwidth data, hardware temperature data, and hardware health status data; The current inspection data and the historical inspection data of the target server are processed in a time sequence to determine the target time sequence inspection data of the target server. The historical inspection data is the inspection data within a preset time period before the current time, and the preset time period is continuous with the current time. The target time-series inspection data is input into the fault prediction model for prediction processing to obtain the fault prediction result of the target server. The fault prediction model is trained based on the time-series inspection data samples and the fault labels corresponding to the time-series inspection data samples. The fault prediction result represents the fault type of the target server and the fault probability of the fault type. When the probability of a fault exceeds a preset probability threshold, a warning message is sent to the terminal device, and the warning message includes the fault type.

2. The method according to claim 1, characterized in that, The process of obtaining the current inspection data of the target server includes: Determine the target protocol interface of the target server; Based on the target protocol interface, determine the target conversion interface of the target protocol interface; Based on the target conversion interface and the host information of the target server, the current inspection data of the target server is obtained, wherein the host information includes IP address, username and password.

3. The method according to claim 2, characterized in that, The determination of the target protocol interface of the target server includes: Obtain the first response information from the target server's Redfish protocol interface; If the first response information meets the preset response requirements, then the Redfish protocol interface is determined as the target protocol interface.

4. The method according to claim 3, characterized in that, The method further includes: If the first response information does not meet the preset response requirements or the Redfish protocol interface does not respond, then the second response information of the IPMI protocol interface of the target server is obtained; If the second response information meets the preset response requirements, then the IPMI protocol interface is determined as the target protocol interface.

5. The method according to claim 1, characterized in that, The step of performing time-series processing on the current inspection data and the historical inspection data of the target server to determine the target time-series inspection data of the target server includes: Retrieve historical inspection data of the target server within the preset time period from the database; Based on the recording time of each data collection in the historical inspection data and the recording time of the current inspection data, the historical inspection data and the current inspection data are sorted in chronological order to obtain the target time-series inspection data.

6. The method according to claim 1, characterized in that, Before inputting the target time-series inspection data into the fault prediction model for prediction processing to obtain the prediction result of the target server, the method further includes: Obtain a time-series inspection data sample set of the sample server. The time-series inspection data sample set includes multiple sets of time-series inspection data samples. Each set of time-series inspection data samples includes time-series inspection data within a certain period of time and the fault type after the period of time. The fault type includes any one of power supply failure, CPU failure, memory failure, hard disk failure, network card failure, motherboard failure, and fan failure. Based on the time-series inspection data sample set, the pre-acquired training model is trained to obtain the fault prediction model.

7. The method according to claim 1, characterized in that, Sending warning information to the terminal device includes: Based on the fault probability and preset probability threshold in the fault prediction results, the warning level and the warning form corresponding to the warning level are determined. According to the warning format, the warning information is sent to the terminal device, and the warning information also includes the warning level.

8. A server early warning device, characterized in that, include: The acquisition module is used to acquire the current inspection data of the target server. The current inspection data includes at least one of the following: CPU usage data, memory usage data, disk I / O data, network bandwidth data, hardware temperature data, and hardware health status data. The determination module is used to perform time-series processing on the current inspection data and the historical inspection data of the target server to determine the target time-series inspection data of the target server. The historical inspection data is the inspection data within a preset time period before the current time, and the preset time period is continuous with the current time. The prediction module is used to input the target time-series inspection data into the fault prediction model for prediction processing to obtain the fault prediction result of the target server. The fault prediction model is trained based on the time-series inspection data samples and the fault labels corresponding to the time-series inspection data samples. The fault prediction result represents the fault type of the target server and the fault probability of the fault type. The sending module is used to send a warning message to the terminal device when the fault probability is greater than a preset probability threshold, the warning message including the fault type.

9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-7.

Images