Health degree monitoring method of server storage system

Abstract

The invention relates to the technical field of computers, and discloses a health degree monitoring method for a server storage system, and the method comprises the steps: collecting a multi-source heterogeneous operation index; constructing a dynamic causal inference graph based on system topology and driving specifications; an anti-factual reasoning algorithm is adopted to trace an abnormal propagation path so as to identify a root cause; performing mode matching in combination with a historical fault case library, and calculating a comprehensive health degree score of the storage unit; and triggering grading early warning according to the score. According to the invention, through explicit modeling of the physical and logic dependency relationship and fusion of causal reasoning and historical experience, the fault positioning accuracy and early warning effectiveness are significantly improved, and the operation and maintenance noise is reduced.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, specifically relating to a method for monitoring the health of server storage systems. Background Technology

[0002] With the continuous expansion of data center scale and the increasing complexity of business workloads, the stability and reliability of server storage systems have become a critical foundation for ensuring the continuity of enterprise-level services. Modern storage systems generally adopt a multi-tiered architecture, encompassing heterogeneous components such as solid-state drives (SSDs), hard disk drives (HDDs), cache units, and network interfaces. Their operating status is affected by multiple factors, including hardware aging, I / O pressure fluctuations, firmware defects, and environmental interference. To ensure system health, existing monitoring systems widely deploy alarm mechanisms based on indicator thresholds or statistical correlations, collecting observable signals such as temperature, read / write latency, and error rate to build anomaly detection models.

[0003] Server storage system health monitoring focuses on the early identification and root cause localization of potential failures. Its core objective is to infer the degradation trend of the system's internal state through multi-source observation data. Current mainstream methods rely on Pearson correlation coefficients, sliding window means, or machine learning classifiers between indicators, simplifying anomaly detection into an outlier detection problem in a high-dimensional feature space. However, such methods are essentially based on the assumption of statistical associations between variables, ignoring the true causal dependencies between storage components.

[0004] The existing technology has the following problems in practical applications: The correlation of indicators is easily affected by common factors or indirect paths, resulting in a large number of false alarms. For example, the increase in read and write latency caused by network congestion is misjudged as disk failure. Traditional observability frameworks lack the ability to explicitly model causal chains, making it difficult to distinguish between symptoms and root causes, leading to "alarm fatigue" among operations and maintenance personnel. Although graph structures are used to represent component topology, most solutions only provide static displays and do not deeply integrate them with dynamic causal reasoning, thus failing to achieve accurate tracing of cross-level fault propagation paths.

[0005] In high-concurrency, multi-tenant data center scenarios, the above-mentioned problems severely undermine the accuracy and timeliness of health assessments. Summary of the Invention

[0006] This invention provides a health monitoring method for server storage systems. It explicitly models the physical dependencies and logical call chains between various hardware units and software services within the storage system by constructing a causal inference graph model based on multi-source heterogeneous indicators, thereby replacing the traditional threshold alarm mechanism based on statistical correlation. The method first collects full operational indicator data of the server storage system, including but not limited to CPU utilization, memory usage, disk I / O operation latency, network throughput, file system metadata operation frequency, and solid-state drive controller chip temperature. Then, based on preset system architecture topology rules and device driver layer interface specifications, it automatically derives the causal dependency direction and strength weights between each indicator, generating a dynamically updated causal graph structure. On this basis, it employs an anomaly propagation path analysis algorithm based on counterfactual reasoning to identify the root cause nodes triggering observed anomalies, and calculates a comprehensive health score for each storage unit by combining pattern matching results from a historical fault repair record database. Finally, it triggers a graded early warning mechanism based on the quantified level of the health score, achieving accurate location of potential faults in the server storage system and suppression of false alarms.

[0007] As one embodiment of the present invention, the full operational index data of the server storage system specifically includes: real-time reading of the central processing unit's context switching count, cache miss rate, and interrupt handling latency per unit time through the operating system kernel module; obtaining the physical memory page error frequency, swap partition read / write rate, and non-consistent memory access latency deviation through the memory controller register; collecting disk queue depth, average service time, histogram of read / write command completion time distribution, and bad block count change slope through the block device driver layer interface; monitoring the packet loss rate, retransmission interval standard deviation, and connection establishment failure count of received and sent data packets through the network protocol stack buffer; recording the inode allocation rate, directory entry lookup time, and log write synchronization latency through the virtual file system hook function; and polling the main control chip junction temperature, reserved space utilization, wear leveling index, and uncorrectable error bit rate through the solid-state drive intelligent information interface.

[0008] As one embodiment of the present invention, the automatic derivation of the causal dependency direction and strength weight between various indicators based on the preset system architecture topology rules and device driver layer interface specifications, and the generation of a dynamically updated causal graph structure specifically includes: taking the southbridge chip on the server motherboard as the root node, taking the various storage controllers connected to it as first-level child nodes, and taking the physical disks or logical volumes managed by each controller as second-level child nodes, forming a hierarchical physical topology skeleton; at the same time, taking the storage service process running on the operating system as a logical node, and establishing bidirectional association edges between logical nodes and physical nodes based on the device file descriptors, mount point paths, and direct memory access channel mapping relationships opened by it; for any two nodes with data flow or control flow interaction, if the state change of the first node precedes that of the second node and satisfies the Granger causality test condition, then a directed causal edge is established between the two, and its strength weight is determined by the mutual information entropy reduction value of the indicator changes between the two; the causal graph structure triggers a reconstruction process when a system configuration change event or a new device hot-plug event occurs, ensuring the consistency between the graph model and the actual operating environment.

[0009] As one embodiment of the present invention, the method of using an anomaly propagation path analysis algorithm based on counterfactual reasoning to identify the root cause node causing the observation anomaly specifically includes: when an observation index exceeds its adaptive baseline threshold, it is marked as an anomaly leaf node; starting from the anomaly leaf node, all possible upstream parent nodes are traced upwards along the reverse edges in the causal graph, and the probability contribution of each counterfactual path is calculated, wherein the probability contribution is equal to the product of the strength weights of each edge on the path and the weighted sum of the degree to which the current state of each intermediate node deviates from the normal range; the top N paths with the highest probability contribution are selected to form a candidate root cause set, where N is a preset upper limit for the number of paths; further, using a Bayesian network inference engine, combined with the typical index combination features corresponding to various hardware failure modes in the prior fault knowledge base, the nodes in the candidate root cause set are corrected for posterior probability, and finally the root cause node with the highest confidence is output.

[0010] As one embodiment of the present invention, the calculation of the comprehensive health score of each storage unit by combining the pattern matching results in the historical fault repair record library specifically includes: constructing a knowledge base containing historical fault cases, where each case records a complete snapshot of the indicators at the time of the fault occurrence, the root cause node identifier confirmed by manual verification, the type of repair measures taken, and the duration of system stability after repair; comparing the similarity between the state feature vector of each storage unit in the current causal graph and the cases in the knowledge base, wherein the state feature vector is composed of the mean, variance, skewness, and kurtosis of all indicators associated with the unit within the most recent sliding time window; using a dynamic time warping algorithm to calculate the minimum cumulative distance between the current feature sequence and the feature sequence of historical cases, and assigning different influence weights to the matching cases accordingly; substituting the root cause labels and influence weights of all matching cases into a weighted voting mechanism to obtain the probability score of the storage unit being in a sub-healthy state; and linearly fusing the probability score with a hard risk score based on the absolute value of the current indicator to generate the final comprehensive health score, the value of which is normalized to between 0 and 100.

[0011] As one embodiment of the present invention, the tiered early warning mechanism triggered based on the quantitative level of the health score specifically includes: setting three health threshold ranges, namely a green safe zone, a yellow warning zone, and a red alarm zone; when the comprehensive health score is greater than or equal to 90, it is determined to be in the green safe zone, and no notification is generated; when the score is between 70 and 90, it is determined to be in the yellow warning zone, and a low-priority operation and maintenance prompt is generated, suggesting the execution of preventive maintenance operations such as cleaning up temporary files, optimizing the index structure, or adjusting the load balancing strategy; when the score is below 70, it is determined to be in the red alarm zone, and a high-priority fault work order is immediately triggered, along with the root cause node identifier, an abnormal propagation path visualization map, and a recommended emergency response plan; the threshold boundaries of the tiered early warning mechanism can be dynamically configured according to the service level agreement requirements of the data center, and each early warning event is recorded in the audit log for data augmentation in subsequent model training.

[0012] As one embodiment of the present invention, the method for determining the adaptive baseline threshold specifically includes: establishing an independent time series prediction model for each type of operational indicator. This model adopts a seasonal autoregressive integral moving average structure, and its parameters are fitted online using the maximum likelihood estimation method. The model input consists of historical observations of the same day of the week and the same time period within the past 7 days, and the output consists of the predicted mean and predicted variance at the current moment. The predicted mean plus three times the predicted variance is used as a dynamic upper limit threshold, and the predicted mean minus three times the predicted variance is used as a dynamic lower limit threshold. When the indicator value exceeds the range of the dynamic threshold for 5 consecutive sampling periods, it is considered a valid abnormal event to avoid misjudgment caused by instantaneous fluctuations. The time series prediction model is fully retrained once every morning to adapt to the long-term drift of the system load pattern.

[0013] As one embodiment of the present invention, the method for calculating the mutual information entropy reduction value specifically includes: for any pair of indicators with a potential causal relationship... and Calculate respectively in the given Under the conditions conditional entropy and unconditional entropy The difference between the two is the information gain of X on Y. Divide the information gain by Normalization is performed to obtain normalized mutual information coefficients; these coefficients serve as the initial values ​​for the causal edge strength weights and are updated by Bayes in subsequent counterfactual reasoning; all mutual information calculations are based on the joint probability distribution estimation within a sliding time window, with the window length fixed at 30 minutes to balance computational overhead and response sensitivity.

[0014] As one embodiment of the present invention, the process of constructing the state feature vector specifically includes: associating each storage unit with... Using 12 original indicators, a sliding sampling method was used within a recent 60-minute time window, with a step size of 5 minutes, to obtain a sequence of 12 sampling points. For each sequence, its arithmetic mean, sample variance, third central moment, and fourth central moment were calculated. These four statistics were then concatenated in sequence to form a 4-dimensional statistical measure. The feature vector is then subjected to dimensionality reduction by principal component analysis, retaining the principal component components with a cumulative variance contribution rate of over 95%, which are used as the final state feature vector for pattern matching.

[0015] As one embodiment of the present invention, the specific implementation steps of the dynamic time warping algorithm include: processing the time sequence of the current state feature vector. Reference sequences in the historical case library Perform alignment; define a two-dimensional grid, where the horizontal axis represents the sequence. The index, with the vertical axis representing the sequence. The index is used to find the optimal path from the top left corner to the bottom right corner in the grid, such that the sum of the distances of all corresponding point pairs on the path is minimized, where the point pair distances are measured using Euclidean distance; the path is allowed to move in the horizontal, vertical and diagonal directions, but backtracking is prohibited; the cumulative distance matrix is ​​filled by dynamic programming, and the minimum cumulative distance value is finally obtained by backtracking; the reciprocal of this distance value is mapped by an exponential decay function and used as the influence weight of the historical case.

[0016] Compared with the prior art, the advantages and positive effects of the present invention are as follows: 1. This invention abandons the traditional method of relying solely on statistical correlation between indicators in the health monitoring of server storage systems, and instead constructs an explicit causal reasoning graph model, which fundamentally solves the problem of false alarms caused by covariance of indicators rather than causation.

[0017] 2. By integrating physical topology rules and logical call chain information, the system's internal dependencies are accurately characterized, making the analysis of anomaly propagation paths interpretable and traceable in engineering.

[0018] 3. The introduction of a counterfactual reasoning mechanism effectively distinguishes between symptom indicators and root cause indicators, significantly improving the accuracy of fault location. Pattern matching, combined with a historical fault case database, ensures that the health score not only reflects the current state but also incorporates the wisdom of historical experience, enhancing the system's ability to identify complex and multifaceted faults.

[0019] 4. The synergistic effect of adaptive baseline thresholds and tiered early warning mechanisms significantly reduces the noise level of operation and maintenance alarms while ensuring high sensitivity, thus alleviating the cognitive load on operation and maintenance personnel. The overall solution does not require manual pre-setting of a large number of static rules, has good self-learning and environmental adaptability, and is suitable for large-scale, heterogeneous modern data center storage infrastructures. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the overall technical solution architecture of the health monitoring method for server storage systems proposed in this invention; Figure 2 This is a schematic diagram of the core principle framework of the causal inference graph model based on multi-source heterogeneous indicators in this invention; Figure 3 This is a logical flowchart of the full-scale operation indicator data collection and adaptive baseline threshold construction in this invention; Figure 4 This is a logical flow framework diagram of the dynamic generation and updating of the cause-effect graph structure in this invention; Figure 5This is a logical flowchart of the anomaly propagation path analysis and root cause identification based on counterfactual reasoning in this invention. Figure 6 This is a flowchart illustrating the logical flow of the integrated health score calculation and the triggering of the graded early warning mechanism in this invention. Detailed Implementation

[0021] Please refer to the attached document. Figures 1 to 6 This invention provides a health monitoring method for server storage systems. Its core lies in constructing a causal inference graph model based on multi-source heterogeneous indicators to replace the traditional threshold alarm mechanism that relies on statistical correlation. This method explicitly models the physical dependencies and logical call chains between various hardware units and software services within the storage system, enabling precise tracking of anomaly propagation paths and identification of root causes. This effectively suppresses false alarms and improves the accuracy of fault location. The specific implementation process of this method will be described in detail below with reference to the accompanying drawings.

[0022] The method first executes step S1: collecting full operational metrics data of the server storage system. This step acquires operational status parameters covering multiple dimensions, including computing, memory, storage, network, and file system, in real time through the operating system kernel module, device driver layer interface, and dedicated sensor interface. Specifically, metrics related to CPU utilization include context switching count per unit time, cache miss rate, and interrupt handling latency; metrics related to memory usage include physical memory page fault frequency, swap partition read / write rate, and non-consistent memory access latency deviation; metrics related to disk I / O operation latency include disk queue depth, average service time, histogram of read / write command completion time distribution, and bad block count change slope; metrics related to network throughput include packet loss rate of received and sent data packets, standard deviation of retransmission interval, and number of connection establishment failures; metrics related to file system metadata operation frequency include inode allocation rate, directory entry lookup time, and log write synchronization latency; and metrics related to SSD controller chip temperature include controller chip junction temperature, reserved space utilization, wear leveling index, and uncorrectable error bit rate. All metrics are collected at a fixed sampling period, with the sampling frequency dynamically adjusted according to the metric type. High-frequency metrics, such as interrupt handling delay, have a sampling period of 10 milliseconds, while low-frequency metrics, such as bad block count change slope, have a sampling period of 5 minutes. The collected data is timestamped to form a unified multi-dimensional time-series data stream, which serves as the basic input for subsequent causal graph construction.

[0023] After completing the full collection of metrics, step S2 is executed: based on the preset system architecture topology rules and device driver layer interface specifications, the causal dependency direction and strength weight between each metric are automatically derived, generating a dynamically updated causal graph structure. This step first constructs the physical topology skeleton, using the southbridge chip on the server motherboard as the root node, the storage controllers directly connected to it (such as SATA controllers and NVMe controllers) as first-level child nodes, and the physical disks or logical volumes managed by each controller as second-level child nodes, forming a hierarchical tree structure. Simultaneously, the logical topology structure is constructed, using storage service processes running on the operating system (such as iSCSI target services and CephOSD processes) as logical nodes, and establishing bidirectional association edges between logical nodes and physical nodes based on their opened device file descriptors, mount point paths, and direct memory access channel mapping relationships.

[0024] For any two nodes that interact with each other through data flow or control flow, if the state change of the first node precedes that of the second node in time and satisfies the Granger causality test condition, then a directed causal edge is established between them. The strength weight of the causal edge is determined by the mutual information entropy reduction value of the changes in the indices between the two nodes. The calculation method for the mutual information entropy reduction value is as follows: for indices... and Calculate respectively in the given Under the conditions conditional entropy and unconditional entropy The difference between the two is the information gain of X on Y. Divide the information gain by Normalization is performed to obtain normalized mutual information coefficients, which serve as the initial values ​​for the causal edge strength weights. All mutual information calculations are based on the joint probability distribution estimation within a sliding time window, with a fixed window length of 30 minutes. The causal graph structure triggers a reconstruction process upon system configuration change events (such as RAID level adjustments) or new device hot-plug events, ensuring consistency between the graph model and the actual operating environment.

[0025] The S3 step then proceeds: An anomaly propagation path analysis algorithm based on counterfactual reasoning is used to identify the root cause node triggering the observed anomaly. This step presupposes that at least one indicator exceeds its adaptive baseline threshold. The adaptive baseline threshold is determined as follows: For each type of operational indicator, an independent time series prediction model is established. This model employs a seasonal autoregressive integral moving average structure, and its parameters are fitted online using maximum likelihood estimation. The model input consists of historical observations from the same day of the week and the same time period within the past 7 days, and the output is the predicted mean and predicted variance at the current moment. The predicted mean plus three times the predicted variance is used as the dynamic upper limit threshold, and the predicted mean minus three times the predicted variance is used as the dynamic lower limit threshold. Only when the indicator value exceeds the dynamic threshold range for 5 consecutive sampling periods is it considered a valid anomaly event.

[0026] Once an indicator is marked as an anomalous leaf node, all possible upstream parent nodes are traced upwards along the reverse edges of the causal graph from that node, and the probability contribution of each counterfactual path is calculated. The probability contribution is equal to the weighted sum of the product of the strength weights of each edge on the path and the degree to which the current state of each intermediate node deviates from the normal range, where the degree of deviation is represented by the standardized distance between the current indicator value and the median of the adaptive baseline. The top N paths with the highest probability contributions are selected to form a candidate root cause set, where N is a preset upper limit for the number of paths, usually set to 5. Further, using a Bayesian network inference engine, combined with the typical indicator combination features corresponding to various hardware failure modes in the prior fault knowledge base, the posterior probability of the nodes in the candidate root cause set is corrected. The prior fault knowledge base stores the typical response patterns and their joint probability distributions of each indicator under different fault types (such as disk bad sectors, memory bit flips, network congestion). The posterior probability correction formula is:

[0027] in, The prior probability of the root cause node is derived from the statistics of historical failure frequencies; The likelihood of observing current anomalous evidence given the root cause is obtained from the conditional probability table in the knowledge base; This is a normalization constant. The final output is the root cause node with the highest posterior probability.

[0028] Next, step S4 is executed: Combining the pattern matching results from the historical fault repair record library, a comprehensive health score is calculated for each storage unit. This step first constructs a knowledge base containing historical fault cases. Each case records a complete snapshot of the indicators at the time of the fault occurrence, the manually confirmed root cause node identifier, the type of repair measures taken, and the duration of system stability after the repair. For each storage unit in the current cause-effect graph, the statistical characteristics of all its associated indicators within the most recent sliding time window are extracted to construct a state feature vector.

[0029] The process of constructing the state feature vector is as follows: For each storage unit associated with... Using 12 original indicators, a sliding sampling method was used within a recent 60-minute time window, with a step size of 5 minutes, to obtain a sequence of 12 sampling points. For each sequence, its arithmetic mean, sample variance, third central moment, and fourth central moment were calculated. These four statistics were then concatenated in sequence to form a 4-dimensional statistical measure. The feature vector is then processed by principal component analysis to reduce its dimensionality, retaining principal component components with a cumulative variance contribution rate of over 95%, which serve as the final state feature vector for pattern matching. Subsequently, the current state feature vector is compared with cases in the knowledge base for similarity.

[0030] Similarity calculation employs a dynamic time warping algorithm, the specific implementation steps of which include: processing the time series of the current state feature vector. Reference sequences in the historical case library Perform alignment; define a two-dimensional grid, where the horizontal axis represents the sequence. The index, with the vertical axis representing the sequence. The index is used to find the optimal path from the top left corner to the bottom right corner in the grid, such that the sum of the distances of all corresponding point pairs on the path is minimized, where the point pair distances are measured using Euclidean distance; the path is allowed to move in the horizontal, vertical and diagonal directions, but backtracking is prohibited; the cumulative distance matrix is ​​filled by dynamic programming, and the minimum cumulative distance value is finally obtained by backtracking; the reciprocal of this distance value is mapped by an exponential decay function and used as the influence weight of the historical case.

[0031] The root cause labels and their impact weights for all matching cases are substituted into a weighted voting mechanism to obtain a probability score indicating that the storage unit is in a sub-healthy state. This probability score is then linearly fused with a hard risk score based on the absolute value of the current indicator to generate a final comprehensive health score. The hard risk score is obtained by weighted summation of the degree to which each indicator exceeds the safety threshold, with weights set by expert experience. The comprehensive health score is normalized to a range of 0 to 100, and the calculation formula is as follows:

[0032] in, To assess overall health, For hard risk scoring, Score the likelihood of being in a sub-healthy state. The fusion coefficient has a value of 0.6, indicating that hard risks dominate.

[0033] Finally, step S5 is executed: A tiered early warning mechanism is triggered based on the quantified level of the health score. This step sets three health threshold ranges: a green safe zone, a yellow warning zone, and a red alert zone. When the overall health score is greater than or equal to 90, it is classified as a green safe zone, and no notification is generated. When the score is between 70 and 90, it is classified as a yellow warning zone, generating a low-priority maintenance prompt and suggesting preventative maintenance operations such as cleaning temporary files, optimizing the index structure, or adjusting the load balancing strategy. When the score is below 70, it is classified as a red alert zone, immediately triggering a high-priority fault ticket, along with the root cause node identifier, a visualization of the abnormal propagation path, and a recommended emergency response plan. The threshold boundaries of the tiered early warning mechanism can be dynamically configured according to the data center's service level agreement requirements; for example, the red alert threshold for a financial transaction system can be raised to 75. Each early warning event is recorded in the audit log, including the trigger time, health score, root cause node, list of abnormal indicators, and maintenance personnel response records, for data augmentation in subsequent model training.

[0034] The implementation of the above method relies on a complete software system architecture. This system includes a data acquisition agent module, a cause-effect graph construction engine, an anomaly detection and root cause analysis module, a health score calculation module, and an early warning triggering module. The data acquisition agent module is deployed in the operating system kernel space of each server, capturing low-level metrics in real time through eBPF programs or kernel module hook functions, avoiding the performance overhead of user-space polling. The cause-effect graph construction engine runs on a central management node, receiving metric streams and topology description information from each server, and executing graph structure generation and update algorithms.

[0035] The anomaly detection and root cause analysis module integrates a time series forecasting model and a Bayesian inference engine, responsible for executing all the logic of step S3. The health score calculation module maintains a historical fault case knowledge base, implementing dynamic time warping and weighted voting mechanisms. The early warning triggering module interfaces with the existing ITSM system, automatically creating work orders and pushing notifications. All modules communicate asynchronously via message queues, ensuring high availability and scalability. Data storage adopts a hybrid architecture of time series database and graph database. The time series database stores raw indicator data, while the graph database stores the causal graph structure and its attributes, supporting efficient graph traversal and pattern matching queries.

[0036] Throughout the implementation process, the system continuously monitors the operational status of the server storage system, dynamically adjusts the causal graph structure, updates the health score in real time, and triggers alerts when necessary. This method, through explicit causal modeling and counterfactual reasoning, fundamentally solves the false alarm problem caused by traditional correlation analysis, achieving accurate, interpretable, and traceable monitoring of the storage system's health status.

Claims

1. A method for monitoring the health of a server storage system, characterized in that, include: Collect full operational metrics data of the server storage system, including CPU utilization, memory usage, disk I / O operation latency, network throughput, file system metadata operation frequency, and solid-state drive controller chip temperature. Based on the preset system architecture topology rules and device driver layer interface specifications, the causal dependency direction and strength weight between each indicator are automatically derived, and a dynamically updated causal graph structure is generated. An anomaly propagation path analysis algorithm based on counterfactual reasoning was used to identify the root cause node that triggered the observed anomaly. By combining the pattern matching results in the historical fault repair record database, a comprehensive health score is calculated for each storage unit; A tiered early warning mechanism is triggered based on the quantitative level of the comprehensive health score.

2. The health monitoring method for a server storage system according to claim 1, characterized in that, Collect all operational metrics data from the server storage system, including: The operating system kernel module reads in real time the number of context switches, cache miss rate, and interrupt handling latency of the central processing unit per unit time. The frequency of physical memory page errors, swap partition read / write rate, and non-consistent memory access latency deviation can be obtained by using the memory controller registers. The disk queue depth, average service time, histogram of read and write command completion time distribution, and slope of bad block count change are collected through the block device driver layer interface. Monitor the packet loss rate, retransmission interval standard deviation, and connection establishment failure number of received and sent data packets through the network protocol stack buffer; The virtual file system hook function records the inode allocation rate, directory entry lookup time, and log write synchronization delay. The system polls the main controller chip's junction temperature, reserved space utilization, wear leveling index, and uncorrectable error bit rate through the solid-state drive's intelligent information interface.

3. The health monitoring method for a server storage system according to claim 2, characterized in that, Based on the preset system architecture topology rules and device driver layer interface specifications, the causal dependency direction and strength weight between various indicators are automatically derived, generating a dynamically updated causal graph structure, including: The southbridge chip on the server motherboard is used as the root node, the various storage controllers connected to it are the first-level child nodes, and the physical disks or logical volumes managed by each controller are the second-level child nodes, forming a hierarchical physical topology skeleton. The storage service process running on the operating system is used as a logical node. Based on the device file descriptors, mount point paths and direct memory access channel mapping relationships opened by the logical node, a bidirectional association edge is established between the logical node and the physical node. For any two nodes that interact with each other through data flow or control flow, if the state change of the first node precedes that of the second node and satisfies the Granger causality test condition, then a directed causal edge is established between the two nodes, and its strength weight is determined by the mutual information entropy reduction value of the index change between the two nodes. The cause-effect graph structure triggers a refactoring process when a system configuration change event or a new device hot-plug event occurs.

4. The health monitoring method for a server storage system according to claim 3, characterized in that, An anomaly propagation path analysis algorithm based on counterfactual reasoning was used to identify the root cause nodes that triggered the observed anomalies, including: When an observed metric exceeds its adaptive baseline threshold, it is marked as an abnormal leaf node; Starting from the abnormal leaf node, trace all possible upstream parent nodes upwards along the reverse edge in the causal graph, and calculate the probability contribution of each counterfactual path. The probability contribution is equal to the product of the strength weights of each edge on the path and the weighted sum of the degree to which the current state of each intermediate node deviates from the normal range. The top N paths with the highest probability contribution are selected to form a candidate root cause set; By using a Bayesian network inference engine and combining typical indicator combinations of various hardware failure modes in the prior fault knowledge base, the nodes in the candidate root cause set are corrected for posterior probability, and finally the root cause node with the highest confidence is output.

5. The health monitoring method for a server storage system according to claim 4, characterized in that, Based on pattern matching results from the historical fault repair record database, a comprehensive health score is calculated for each storage unit, including: Build a knowledge base containing historical failure cases. Each case records a complete snapshot of the indicators at the time of the failure, the root cause node identifier confirmed by humans, the type of remedial measures taken, and the duration of system stability after the remediation. The state feature vectors of each storage unit in the current causal graph are compared with the cases in the knowledge base. The state feature vectors are composed of the mean, variance, skewness and kurtosis of all indicators associated with the unit in the most recent sliding time window. The dynamic time warping algorithm is used to calculate the minimum cumulative distance between the current feature sequence and the feature sequences of historical cases, and different influence weights are assigned to the matching cases accordingly. Substitute the root cause labels and their impact weights of all matching cases into a weighted voting mechanism to obtain the probability score of the storage unit being in a sub-healthy state; The probability score is linearly fused with a hard risk score based on the absolute value of the current indicator to generate a final comprehensive health score, which is normalized to a range of 0 to 100.

6. The health monitoring method for a server storage system according to claim 5, characterized in that, A tiered early warning mechanism is triggered based on the quantitative level of the comprehensive health score, including: Three health threshold ranges are set: green safe zone, yellow warning zone, and red alert zone. When the overall health score is greater than or equal to 90, it is determined to be a green safe zone, and no notification is generated. When the score is between 70 and 90, it is judged as a yellow warning zone, a low-priority operation and maintenance prompt is generated, and preventive maintenance operations are recommended. When the score is below 70, it is judged as a red alarm zone, and a high-priority fault work order is immediately triggered, along with the root cause node identifier, a visualization map of the abnormal propagation path, and a recommended emergency response plan. The threshold boundaries of the tiered early warning mechanism can be dynamically configured according to the service level agreement requirements of the data center.

7. The health monitoring method for a server storage system according to claim 4, characterized in that, The method for determining the adaptive baseline threshold includes: For each type of operational indicator, an independent time series forecasting model is established. This model adopts a seasonal autoregressive integral moving average structure, and its parameters are fitted online using the maximum likelihood estimation method. The model input consists of historical observations of the same day of the week and the same time period within the past 7 days, and the output consists of the predicted mean and predicted variance at the current moment. The predicted mean plus 3 times the predicted variance is used as the dynamic upper limit threshold, and the predicted mean minus 3 times the predicted variance is used as the dynamic lower limit threshold. An event is considered valid only when the indicator value exceeds the dynamic threshold range for five consecutive sampling periods. The time series prediction model undergoes a full retraining once every morning at midnight.

8. The health monitoring method for a server storage system according to claim 3, characterized in that, The method for calculating the mutual information entropy reduction value includes: For any pair of indicators with a potential causal relationship and Calculate respectively in the given Under the conditions conditional entropy and unconditional entropy ; The difference between the two is right Information gain ; Divide the information gain by Normalization is performed to obtain the normalized mutual information coefficients; This coefficient serves as the initial value for the causal edge strength weight and is subsequently updated using Bayesian methods during counterfactual reasoning. All mutual information calculations are based on the estimation of the joint probability distribution within the sliding time window.

9. The health monitoring method for a server storage system according to claim 5, characterized in that, The process of constructing the state feature vector includes: Associated with each storage unit The original index was used to obtain a sequence of 12 sampling points by sliding sampling in 5-minute increments within the most recent 60-minute time window. Calculate the arithmetic mean, sample variance, third central moment, and fourth central moment for each sequence; These four statistics are concatenated in order to form a 4-dimensional array. eigenvectors; The feature vector is subjected to dimensionality reduction by principal component analysis, retaining the principal component components with a cumulative variance contribution rate of over 95%, which are used as the final state feature vector for pattern matching.

10. The health monitoring method for a server storage system according to claim 5, characterized in that, The specific implementation steps of the dynamic time warping algorithm include: Time series of the current state feature vector Reference sequences in the historical case library Align; Define a two-dimensional grid, where the horizontal axis represents a sequence. The index, with the vertical axis representing the sequence. The index; Find the optimal path from the top left corner to the bottom right corner in the grid such that the sum of the distances between all corresponding pairs of points on the path is minimized, where the distance between the pairs of points is measured by Euclidean distance. The path can move horizontally, vertically, and diagonally, but backtracking is prohibited; By dynamically programming the cumulative distance matrix, the minimum cumulative distance value is finally obtained through backtracking. The reciprocal of this distance value, after being mapped by an exponential decay function, serves as the influence weight for this historical case.

Images