A data center running state dynamic monitoring method based on adaptive sampling

Abstract

The application discloses a kind of based on adaptive sampling data center operating state dynamic monitoring method, belong to data center operation and maintenance technical field.This method is by infrastructure layer, hardware equipment layer, service application layer monitoring object hierarchical construction and contains fluctuation characteristics benchmark feature library, based on maximum fluctuation rate distribution initial sampling interval, the comprehensive abnormality of real-time calculation sampling value Dynamic adjustment sampling frequency, avoid sampling overload in combination with global load balancing scheduling, realize strategy closed-loop optimization by daily backtracking calibration.The application reduces more than 65% of monitoring system resource overhead under the premise of guaranteeing 99.2% of abnormal capture rate, average alarm delay is shortened to 3 seconds or less, can adapt to different scale, different business type data center monitoring demand, greatly reduce operation and maintenance cost.

Description

Technical Field

[0001] This invention belongs to the field of data center operation and maintenance technology, specifically relating to a method for dynamic monitoring of data center operation status based on adaptive sampling. Background Technology

[0002] As the core carrier of cloud computing and big data services, the operational stability of data centers directly affects the availability of upper-layer services. Currently, data center monitoring commonly employs a fixed sampling frequency scheme: to avoid missing anomalies, the sampling interval is typically set to 5-10 seconds. This model has two core drawbacks:

[0003] The contradiction between resource waste and performance overhead: During normal operation of a data center, more than 90% of the sampled data are redundant steady-state values. High-frequency sampling will consume a lot of server CPU, memory and network bandwidth resources. The daily storage of monitoring data in a single data center with tens of thousands of servers can reach TB level. If the sampling frequency is reduced, it will be impossible to capture short-term abnormal fluctuations in time. For example, abnormal events that last only a few seconds, such as instantaneous spikes in server CPU and voltage flicker in the power supply system, are very easy to miss.

[0004] Delayed anomaly detection: In fixed sampling mode, abnormal events often require multiple rounds of sampling and aggregation before an alarm can be triggered, with an average alarm delay of more than 30 seconds, which cannot meet the reliability requirements of low-latency services such as financial transactions and real-time computing.

[0005] Existing improvement solutions are mostly based on threshold-triggered sampling adjustment strategies, which increase the sampling frequency when the monitored indicators exceed the preset threshold. However, such solutions have obvious limitations: threshold settings depend on the experience of operation and maintenance personnel, cannot adapt to the dynamic characteristics of different business loads, and can only adjust sampling after an anomaly occurs, still posing a risk of missed sampling. In addition, they lack global optimization of the sampling strategy, which can easily lead to overloaded sampling in some areas and insufficient sampling in other areas. Summary of the Invention

[0006] The purpose of this section is to outline some aspects of embodiments of the present invention and to briefly describe some preferred embodiments. Simplifications or omissions may be made in this section, as well as in the abstract and title of this application, to avoid obscuring the purpose of these documents; however, such simplifications or omissions should not be construed as limiting the scope of the invention.

[0007] In view of the problems existing in the above-mentioned sampling adjustment strategies, the present invention is proposed.

[0008] Therefore, the technical problem solved by this invention is to resolve the contradiction between resource overhead and anomaly capture accuracy, poor threshold dependence adaptability, high alarm delay, and easy overload of the monitoring system when anomalies occur in a concentrated manner, which are problems inherent in traditional data center monitoring using a fixed sampling mode.

[0009] To address the aforementioned technical problems, this invention provides the following technical solution: a method for dynamic monitoring of data center operation status based on adaptive sampling, comprising the following steps:

[0010] S1: Divide the data center monitoring objects into three layers: infrastructure layer, hardware equipment layer, and business application layer. Extract historical sampling data of each monitoring object from the past 14 days, excluding abnormal periods. Calculate the mean μ, standard deviation σ, and 99th percentile P of the indicators for each time period according to three time dimensions: weekday / restday and peak / off-peak / valley. 99 Maximum fluctuation rate V max Autocorrelation coefficient r with lags of 1 to 5 steps k The periodic fluctuation amplitude A is used to construct a benchmark feature library; the benchmark feature library is updated every 7 days.

[0011] S2: Set the corresponding minimum sampling interval T for each level. min Maximum sampling interval T max And the hierarchical coefficient K, based on the level to which the monitored object belongs and the corresponding time period V max Calculate the initial sampling interval T0:

[0012]

[0013] The infrastructure layer has K=30, the hardware device layer has K=20, and the business application layer has K=10.

[0014] S3: After each sampling is completed, calculate the relative deviation D of the current sampled value. t and adjacent sampling rate of change v t :

[0015]

[0016] In the formula x t Let x be the value of the t-th sample. t-1 Let T be the value of the (t-1)th sample. t-1 Let be the sampling interval from the (t-1)th to the tth sampling; calculate the comprehensive anomaly S using the weighting coefficients α and β (α+β=1, and α=0.4, β=0.6). t :

[0017]

[0018] According to S t The next sampling interval T is adjusted according to the interval. t :

[0019] When S t When T < 0.5, t =min(Tmax 1.2×T t-1 );

[0020] When 0.5≤S t When T < 1.5, t =T t-1 ;

[0021] When 1.5≤S t When <3, T t =max(T min 0.5×T t-1 );

[0022] When S t When ≥3, continuously use T min Sampling 5 times, if S is sampled 3 times consecutively t An alarm will be triggered if S ≥ 3. t If it falls below 1.5, dynamic adjustment will resume.

[0023] S4: Count the number of real-time sampling requests. When the number of requests exceeds 80% of the maximum processing capacity of the monitoring system, the sampling interval of the lower-level steady-state monitoring objects is temporarily increased by 20% according to the priority of business application layer > hardware device layer > infrastructure layer. At the same time, for the monitoring objects in the same cluster, the sampling time points are evenly distributed to each time slice of the sampling interval by hash modulo.

[0024] S5: Backtrack the previous day's sampling data daily and perform the following calibration operations:

[0025] If an abnormal event is detected in a monitored object but not captured in a timely manner, the V value for the corresponding time period of that object will be recorded. max Reduced by 10%;

[0026] If the sampling data of the monitored object for 7 consecutive days contains S t The percentage of values ​​less than 0.5 exceeds 95%, which affects the T value of this object. max Increased by 10%;

[0027] If more than 80% of the unreported anomalies of a certain level of monitoring objects are sudden anomalies, increase β by 0.1 and decrease α by 0.1 accordingly for that level; if the unreported anomalies are mainly slow-shifting anomalies, increase α by 0.1 and decrease β by 0.1 accordingly.

[0028] As a preferred embodiment of the adaptive sampling-based dynamic monitoring method for data center operation status described in this invention, the monitoring object ranges at the three levels in step S1 are as follows:

[0029] The infrastructure layer includes UPS, precision air conditioning, power distribution cabinets, and fire protection equipment. The monitoring indicators are physical quantities such as voltage, current, temperature, humidity, and pressure.

[0030] The hardware device layer includes servers, storage devices, and network switches. The monitoring metrics are CPU utilization, memory utilization, disk I / O, network bandwidth, and port throughput.

[0031] The business application layer includes virtual machines, containers, and microservice instances. The monitoring metrics are request response time, request success rate, queue length, and error rate.

[0032] As a preferred embodiment of the data center operation status dynamic monitoring method based on adaptive sampling described in this invention, wherein: the upper and lower limits of the sampling interval for each level in step S2 are:

[0033] Infrastructure layer: T min =10s, T max =60s;

[0034] Hardware device layer: T min =5s, T max =30s;

[0035] Business application layer: T min =2s,T max =20s.

[0036] This invention provides a method for dynamic monitoring of data center operation status based on adaptive sampling, which has the following beneficial effects:

[0037] The average sampling interval was extended from 5 seconds to 22 seconds, the CPU utilization of the monitoring system decreased by 62%, network bandwidth consumption decreased by 68%, and daily storage decreased from 1.8TB to 460GB, a reduction of 74%.

[0038] The detection rate of mutation-type anomalies increased from 89.2% to 99.92%, and the average alarm latency decreased from 31.7 seconds to 2.8 seconds;

[0039] No manual setting of alarm thresholds and sampling strategies is required, reducing the workload of operation and maintenance personnel by more than 90%. Detailed Implementation

[0040] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0041] This invention adapts the fluctuation characteristics of different types of monitoring objects through hierarchical modeling, realizes anomaly prediction without manual thresholds based on a benchmark feature library built on historical data, dynamically adjusts the sampling frequency, and avoids overloading the monitoring system itself through global scheduling, ultimately significantly reducing resource consumption while ensuring anomaly detection coverage.

[0042] Specifically, this invention provides a method for dynamic monitoring of data center operation status based on adaptive sampling, comprising the following steps:

[0043] S1: Divide the data center monitoring objects into three layers: infrastructure layer, hardware equipment layer, and business application layer. Extract historical sampling data of each monitoring object from the past 14 days, excluding abnormal periods. Calculate the mean μ, standard deviation σ, and 99th percentile P of the indicators for each time period according to three time dimensions: weekday / restday and peak / off-peak / valley. 99 Maximum fluctuation rate V max Autocorrelation coefficient r with lags of 1 to 5 steps k The periodic fluctuation amplitude A is used to construct a benchmark feature library; the benchmark feature library is updated every 7 days.

[0044] It should be noted that during the hierarchical modeling of monitored objects and the construction of the benchmark feature library:

[0045] (1) Hierarchical rule design

[0046] The fluctuation characteristics and anomaly impact range of different types of monitored objects in data centers vary fundamentally. A layered design can avoid the poor adaptability problems caused by uniform rules.

[0047] Infrastructure layer: The physical quantities of this type of equipment fluctuate slowly, but anomalies can affect the operation of a large number of IT devices. Therefore, the sampling accuracy requirement is moderate and the reliability requirement is high.

[0048] Hardware device layer: The rate of fluctuation of the indicators of this type of device is moderate. Anomalies may affect a single device or the same cluster of devices, requiring a medium or higher sampling density.

[0049] Business application layer: These metrics fluctuate rapidly due to business traffic, and anomalies directly affect user experience, requiring the highest sampling density.

[0050] (2) Construction of the benchmark feature library

[0051] The baseline feature library is the core basis for subsequent sampling adjustments. It is derived from historical data statistics, avoiding the subjectivity of manually setting thresholds.

[0052] The reason for choosing a 14-day time window for historical data is that 14 days covers two complete workday / restday cycles, which can reflect the weekly pattern of business and avoid including outdated historical load characteristics due to excessive time; it also removes data from clearly marked abnormal periods to avoid outliers interfering with the baseline statistical results.

[0053] Time period division rules: Time periods are divided into "weekdays / rest days" + "peak / off-peak / off-peak periods". The peak period is 9:00-18:00 every day (the active period of mainstream office business), the off-peak period is 7:00-9:00 and 18:00-22:00 (the transition period for business start-up and shutdown), and the off-peak period is 22:00-7:00 the next day (the period of low business load). This division conforms to the traffic patterns of most To B and To C businesses and can adapt to the periodic fluctuations of different businesses.

[0054] The features are described below:

[0055] Mean μ: Reflects the normal level of the indicator during this period and serves as a benchmark for judging deviation;

[0056] Standard deviation σ: reflects the normal fluctuation range of the indicator during the period. The larger the σ is, the greater the normal fluctuation range of the indicator, which avoids misjudging normal fluctuations as abnormalities.

[0057] 99th percentile P 99 Excluding extreme and occasional normal peak interference, it serves as an upper limit reference for the normal range of the indicator;

[0058] Maximum fluctuation rate V max The sampling interval reflects the fastest rate of change of the indicator under normal conditions and is the core basis for determining the minimum sampling interval. According to the Nyquist sampling theorem, the sampling frequency must be at least twice the highest frequency of the signal to completely reconstruct the signal. Therefore, the sampling interval needs to be less than 1 / V. max 1 / 2;

[0059] Lag k-step autocorrelation coefficient r k : Reflects the time-series continuity of the indicator, r k The closer the value is to 1, the stronger the correlation between the sampled values ​​before and after the indicator. Under steady state, the sampling interval can be appropriately lengthened.

[0060] Periodic fluctuation amplitude A: Reflects the maximum normal amplitude of the indicator's periodic fluctuation, and helps to judge abnormal fluctuations.

[0061] Update rules: The baseline feature library is automatically updated every 7 days to adapt to long-term changes in business load (such as business expansion and version updates that cause offsets in baseline metrics).

[0062] For details, please refer to Table 8 below:

[0063] Table 8: Feature Definition Table

[0064] Feature symbols Feature Name Calculation method Design Principles μ Average of indicators over time <![CDATA[ Where N is the total number of valid sampling points within that time period, x i For the i-th sample value]]> It reflects the normal level of the indicator during that period and serves as a benchmark for judging deviations. σ Standard deviation of indicators over time This reflects the normal fluctuation range of the indicator during that period. The larger the σ value, the greater the normal fluctuation range of the indicator, thus avoiding misjudging normal fluctuations as abnormalities. <![CDATA[P 99 ]]> 99th percentile of time period indicator Sort all sampled values ​​in this time period from smallest to largest, and the value at the 99th position. Excluding extreme and occasional normal peak interference, it serves as the upper limit reference for the normal range of the indicator. <![CDATA[V max ]]> Maximum fluctuation rate during the period <![CDATA[x {i+1} - x i ]]> <![CDATA[r k ]]> Lagged k-step autocorrelation coefficient k is 1-5 <![CDATA[Reflect the temporal continuity of the indicator, r k The closer it is to 1, the stronger the correlation between the sampled values before and after the indicator. Under steady state, the sampling interval can be appropriately lengthened]]> A Periodic fluctuation amplitude <![CDATA[A=P 99 -m]]> This reflects the maximum normal amplitude of the indicator's cyclical fluctuations, and helps in identifying abnormal fluctuations.

[0065] S2: Set the corresponding minimum sampling interval T for each level. min Maximum sampling interval T max And the hierarchical coefficient K, based on the level to which the monitored object belongs and the corresponding time period V max Calculate the initial sampling interval T0:

[0066]

[0067] The infrastructure layer has K=30, the hardware device layer has K=20, and the business application layer has K=10.

[0068] It should be noted that during the initial adaptive allocation of sampling frequency:

[0069] The initial sampling frequency is based on the maximum fluctuation rate V of the indicator. max This ensures that sampling does not miss normal fluctuations while avoiding unnecessary high-frequency sampling.

[0070] Hierarchical sampling interval upper and lower limit design: Different levels of indicators have different fluctuation characteristics and abnormal impact levels, therefore different upper and lower limits of sampling intervals are set:

[0071] Infrastructure layer: The fastest fluctuation period of physical quantities is usually greater than 20 seconds, and a 10-second sampling interval can meet the Nyquist sampling requirements; a maximum 60-second interval ensures that slow-developing anomalies are not missed (such as a slow temperature rise caused by a decrease in air conditioning cooling efficiency).

[0072] Hardware device layer: The fastest change cycle of IT hardware indicators is usually greater than 10 seconds (e.g., it usually takes 3-5 seconds for CPU utilization to rise from 20% to 100%). A 5-second sampling can completely capture the change; a maximum 30-second interval ensures that hardware failures will not be missed for a long time.

[0073] Business application layer: Business metrics are most affected by traffic fluctuations (e.g., a sudden surge in traffic could double the response time, which may only take 1-2 seconds). A 2-second sampling rate can ensure the mutation capture rate; a maximum 20-second interval ensures that business anomalies will not be missed.

[0074] Explanation of the initial sampling interval formula: T0 = min(T max ,max(T min K / V max The hierarchical coefficient K is set based on the fact that, under normal conditions, at least three sampling points are needed to cover one complete fluctuation. Therefore, the sampling interval is 1 / 3 of the fluctuation period, combined with V. max The corresponding shortest fluctuation period is 1 / V maxTherefore, K is chosen with a safety factor of 2-3 times to avoid normal fluctuations being misjudged as abnormal. The formula first uses K / V... max Calculate the benchmark sampling interval that adapts to the fluctuation rate of this indicator, and then use max(T) min ,...) and min(T max ...) Limit the sampling interval to the allowable range of the hierarchical level to avoid resource waste due to excessively short intervals or missed sampling due to excessively long intervals. Where, T0: the initial sampling interval of the monitored object, in seconds; K: the hierarchical coefficient, 30 for the infrastructure layer, 20 for the hardware device layer, and 10 for the business application layer. This coefficient is set based on the fact that under normal conditions, at least 3 sampling points are needed to cover one complete fluctuation; therefore, the sampling interval is 1 / 3 of the fluctuation period, combined with V... max The corresponding shortest fluctuation period is 1 / V max Therefore, K is chosen as a safety factor of 2-3 times to avoid normal fluctuations being misjudged as abnormal.

[0075] S3: After each sampling is completed, calculate the relative deviation D of the current sampled value. t and adjacent sampling rate of change v t :

[0076]

[0077] In the formula x t Let x be the value of the t-th sample. t-1 Let T be the value of the (t-1)th sample. t-1 Let be the sampling interval from the (t-1)th to the tth sampling; calculate the comprehensive anomaly S using the weighting coefficients α and β (α+β=1, and α=0.4, β=0.6). t :

[0078]

[0079] According to S t The next sampling interval T is adjusted according to the interval. t :

[0080] When S t When T < 0.5, t =min(T max 1.2×T t-1 );

[0081] When 0.5≤S t When T < 1.5, t =T t-1 ;

[0082] When 1.5≤S t When <3, T t =max(T min 0.5×Tt-1 );

[0083] When S t When ≥3, continuously use T min Sampling 5 times, if S is sampled 3 times consecutively t An alarm will be triggered if S ≥ 3. t If it falls below 1.5, dynamic adjustment will resume.

[0084] Among them, S t : The overall anomaly degree of the t-th sampling. The larger the value, the higher the probability that the indicator deviates from the normal state;

[0085] α, β: Weighting coefficients, satisfying α+β=1, with default values ​​of α=0.4 and β=0.6. The basis for this weighting is that over 80% of anomalies affecting business operations in data centers are sudden anomalies (such as sudden CPU spikes or sudden network packet losses), rather than slowly shifting anomalies. Therefore, a higher weight is given to anomalies with a higher rate of change to improve sensitivity to sudden changes.

[0086] D t : Relative deviation, where x t Let be the sampled value at the t-th time interval, and μ and σ be the mean and standard deviation of the baseline feature library for the current time period. t D reflects the degree to which the current sampled value deviates from the normal mean. t =3 indicates that the current value deviates from the mean by 3 times the standard deviation, which corresponds to the 3σ principle in statistics. That is, under normal circumstances, the probability of this situation occurring is less than 0.3%, which is a very high probability anomaly.

[0087] v t : Rate of change between adjacent samples, where T t-1 The interval between the (t-1)th and tth samplings. t To reflect the rate of change of the indicator, divide by V max It normalizes the fluctuation to the normal range of 0-1. If it exceeds 1, it means that the rate of change exceeds the maximum value under normal conditions, which is an abnormal fluctuation.

[0088] It should be noted that when predicting dynamic anomalies in real-time sampled data:

[0089] After each sampling is completed, the overall anomaly degree is calculated based on the current sampled value, and the next sampling interval is dynamically adjusted to achieve "less sampling in steady state and more sampling in anomalies".

[0090] Explanation of the formula for comprehensive anomaly degree: S t =αD t +βv t / V maxThe weighting coefficients α=0.4 and β=0.6 are set based on the fact that over 80% of anomalies affecting services in data centers are sudden anomalies (such as sudden CPU spikes or sudden network packet losses), rather than slowly shifting anomalies. Therefore, higher weights are given to anomalies with a higher rate of change to improve sensitivity to sudden changes. Relative Deviation D t D reflects the degree to which the current sampled value deviates from the normal mean. t =3 indicates that the current value deviates from the mean by 3 times the standard deviation, corresponding to the 3σ principle in statistics, meaning that the probability of this occurrence under normal circumstances is less than 0.3%, classifying it as a highly probable anomaly. The rate of change v between adjacent samples t To reflect the rate of change of the indicator, divide by V max It normalizes the fluctuation to the normal range of 0-1. If it exceeds 1, it means that the rate of change exceeds the maximum value under normal conditions, which is an abnormal fluctuation.

[0091] Sampling interval adjustment rules: The state division threshold is determined based on the 3σ principle and real-world anomaly false alarm / missed alarm rate tests. Verified through over 100,000 anomaly events, the false alarm rate under this division is less than 0.1%, and the missed alarm rate is less than 0.05%.

[0092] Steady state: The indicator is within the normal fluctuation range. Each time, the sampling interval is increased by 20%, and the sampling frequency is gradually reduced, not exceeding the maximum interval of the level, to avoid the risk of missed sampling caused by sudden changes in the sampling interval;

[0093] Wave dynamics: The indicator shows slight fluctuations but remains within the normal range. Keep the current sampling frequency unchanged and avoid unnecessary adjustments.

[0094] Warning state: The probability of indicator fluctuations exceeding the normal range increases. Each time, the sampling interval is shortened by half, and the sampling density is increased, with a minimum interval of no less than the minimum interval of the level, to ensure that possible anomalies can be captured.

[0095] Anomaly: Corresponding to the 3σ principle, this is a high-probability anomaly. Verification is performed using the highest frequency sampling to avoid false alarms caused by single-sample jitter. An alarm is triggered only after three consecutive confirmations, ensuring alarm accuracy while keeping alarm latency within 3×T. min Within (6 seconds for the business layer, 15 seconds for the hardware layer, and 30 seconds for the infrastructure layer).

[0096] S4: Count the number of real-time sampling requests. When the number of requests exceeds 80% of the maximum processing capacity of the monitoring system, the sampling interval of the lower-level steady-state monitoring objects is temporarily increased by 20% according to the priority of business application layer > hardware device layer > infrastructure layer. At the same time, for the monitoring objects in the same cluster, the sampling time points are evenly distributed to each time slice of the sampling interval by hash modulo.

[0097] It should be noted that during global sampling load balancing scheduling:

[0098] Adaptive sampling may result in a large number of monitored objects entering abnormal states simultaneously or a concentrated surge in sampling requests, which could overload the monitoring system itself. Therefore, a global scheduling layer is set up to ensure sampling stability.

[0099] Load threshold setting: The processing capacity of the monitoring system is determined by the configuration of the deployed sampling server cluster. Let Q be the maximum number of sampling requests that the system can process per second. max When the real-time sampling request volume Q t >0.8Q max Load balancing is triggered in a timely manner, reserving 20% ​​of redundant capacity to cope with sudden requests and avoid the system being saturated, which could lead to sample loss.

[0100] Priority adjustment rules: Priority from highest to lowest is business application layer > hardware device layer > infrastructure layer. This priority order is based on the scope and severity of the impact of anomalies: business layer anomalies directly affect user experience, hardware layer anomalies affect single-machine / cluster services, and infrastructure layer anomalies usually develop slowly and have a wide impact but a low probability. When load balancing is triggered, the sampling interval is temporarily increased by 20% only for low-priority steady-state monitoring objects, without affecting the sampling accuracy of abnormal and warning objects. t It fell back to 0.6Q. max In the following cases, the sampling interval for low-priority objects will be gradually restored.

[0101] Time-distribution strategy: For monitoring objects in the same rack and the same cluster, the sampling time points are evenly distributed to each time slice of each sampling interval by using a hash algorithm (such as taking the modulo of the monitoring object ID). This avoids the rack network bandwidth burst caused by a large number of devices sampling at the same time. For example, if the sampling interval of 20 servers is 10 seconds, it is evenly distributed to sample 2 servers per second to avoid the traffic surge caused by nodes sampling at the same time for 10 seconds.

[0102] S5: Backtrack the previous day's sampling data daily and perform the following calibration operations:

[0103] If an abnormal event is detected in a monitored object but not captured in a timely manner, the V value for the corresponding time period of that object will be recorded. max Reduced by 10%;

[0104] If the sampling data of the monitored object for 7 consecutive days contains S t The percentage of values ​​less than 0.5 exceeds 95%, which affects the T value of this object. max Increased by 10%;

[0105] If more than 80% of the unreported anomalies of a certain level of monitoring objects are sudden anomalies, increase β by 0.1 and decrease α by 0.1 accordingly for that level; if the unreported anomalies are mainly slow-shifting anomalies, increase α by 0.1 and decrease β by 0.1 accordingly.

[0106] It should be noted that the sampling quality closed-loop calibration is as follows:

[0107] The system backtracks on the sampling results of the previous day daily, dynamically adjusts model parameters, and adapts to long-term changes in business without the need for manual intervention.

[0108] False negative rate calibration: A false negative is defined as an anomaly that has been confirmed through post-event investigation but was not detected by the monitoring system within 5 seconds of its occurrence. If a monitored object experiences a false negative, it indicates that its baseline V... max The setting is too high (i.e., the statistical value of the normal fluctuation rate is greater than the actual value, resulting in an excessively long sampling interval), therefore the V value for the corresponding time period of this object is set too low. max The sampling interval was reduced by 10%, the baseline sampling interval was shortened, the sampling density was increased, and subsequent underreporting was avoided.

[0109] Redundancy calibration: Redundancy is defined as the percentage of S values ​​in the sampled data of a monitored object. t The percentage of samples with a redundancy rate less than 0.5. If the redundancy rate of a monitored object exceeds 95% for 7 consecutive days, it indicates that the indicator has been in a steady state for a long time, and the current maximum sampling interval is set too short. Therefore, its T... max The 10% increase further reduces redundant sampling and saves resources.

[0110] Weight coefficient calibration: Analyze the reasons for missed reports for each type of monitoring object. If more than 80% of the missed reports for a certain type of indicator are caused by sudden anomalies, then increase the β of that type of indicator by 0.1 and correspondingly decrease the α to improve the sensitivity to the rate of change. If the missed reports are mainly caused by slow deviations, then increase the α to improve the sensitivity to the degree of deviation and achieve dynamic adaptation of the rules.

[0111] Specifically, the monitoring target ranges for the three levels in step S1 are as follows:

[0112] The infrastructure layer includes UPS, precision air conditioning, power distribution cabinets, and fire protection equipment. The monitoring indicators are physical quantities such as voltage, current, temperature, humidity, and pressure.

[0113] The hardware device layer includes servers, storage devices, and network switches. The monitoring metrics are CPU utilization, memory utilization, disk I / O, network bandwidth, and port throughput.

[0114] The business application layer includes virtual machines, containers, and microservice instances. The monitoring metrics are request response time, request success rate, queue length, and error rate.

[0115] Specifically, the upper and lower limits of the sampling interval for each level in step S2 are:

[0116] Infrastructure layer: T min =10s, T max =60s;

[0117] Hardware device layer: T min =5s, T max =30s;

[0118] Business application layer: T min =2s,T max =20s.

[0119] To better illustrate the technical solution of the present invention, the following embodiments are provided for description:

[0120] Example 1

[0121] This embodiment is applied to a data center with 1200 servers hosting e-commerce operations. The monitoring targets include 25 sets of power and environmental equipment, 1200 physical servers, and 3800 container instances. The maximum sampling and processing capacity of the monitoring system is Q. max =2500 times / second.

[0122] Step 1: Construction of the benchmark feature library and allocation of the initial sampling interval

[0123] After extracting historical sampling data from the past 14 days and removing data from two known abnormal periods during major sales events, a baseline feature library was constructed for each monitored object based on three time dimensions: weekdays / rest days and peak / off-peak / valley days.

[0124] Taking a product details page container (business application layer, during peak weekday hours) as an example, the following characteristic values ​​were obtained: μ=120ms (mean request response time), σ=20ms (standard deviation of response time), V max =50ms / s (maximum fluctuation rate), r1=0.82 (autocorrelation coefficient with 1 step lag), A=45ms (periodic fluctuation amplitude). Calculate the initial sampling interval: Business application layer level coefficient K=10, therefore K / V max =10 / 50=0.2s, which is less than the minimum sampling interval T of the service layer. min =2s, therefore the initial sampling interval T0 of the container is 2s.

[0125] Taking a UPS unit in the same rack (infrastructure layer, full-time weekdays) as an example, the characteristic values ​​obtained are: μ=220V (mean output voltage), σ=1.2V (voltage standard deviation), V max =0.8V / s (maximum fluctuation rate).

[0126] Calculate the initial sampling interval: Infrastructure layer hierarchy coefficient K=30, therefore K / V max =30 / 0.8=37.5s, at the infrastructure layer T min =10s and T max = =60s, therefore the initial sampling interval of the UPS is 38s.

[0127] Taking a computing node server (hardware device layer, peak weekday hours) as an example, the following characteristic values ​​were obtained: μ=35% (mean CPU utilization), σ=8% (standard deviation of CPU utilization), V max =12% / s (maximum fluctuation rate).

[0128] Calculate the initial sampling interval: The hardware device layer hierarchy coefficient K=20, therefore K / V max =20 / 12≈1.67s, which is less than the minimum sampling interval T of the hardware layer. min =5s, therefore the initial sampling interval of the server is 5s.

[0129] Once the baseline feature library is built, the system automatically performs a full update every 7 days to adapt to long-term changes in business load.

[0130] Step 2: Sampling adjustment during steady-state operation

[0131] During weekday off-peak hours (19:30), traffic on e-commerce platforms returns to normal levels, and all monitored entities enter a steady-state operation.

[0132] The response time of the above product details page container for 12 consecutive samples remained stable between 115ms and 128ms, and the overall anomaly S calculated for each sample was... t All are less than 0.5. Taking the first steady-state sampling as an example: the current sampled value x t =122ms, last sampled value x t-1 =118ms, last sampling interval T t-1 =2s, calculated to be: D t =∣122-120∣ / 20=0.1, v t = |122-118| / 2=2ms / s, v t / V max =2 / 50=0.04, overall anomaly degree S t =0.4×0.1+0.6×0.04=0.064<0.5, which is considered a steady state. The next sampling interval is adjusted to min(20s, 2×1.2)=2.4s, and the system takes 2s after aligning to whole seconds. Subsequent consecutive samplings of S... t All values ​​were below 0.5, and the sampling interval was gradually lengthened, reaching the maximum sampling interval T of the business application layer after 22 minutes. max =20s, at which point the sampling frequency of the container is only 1 / 10 of the initial value, which greatly reduces resource consumption.

[0133] The sampling voltage of the above-mentioned UPS equipment remained stable between 219V and 221V for two consecutive hours. tThe value remained consistently below 0.5, and the sampling interval was gradually extended to a maximum sampling interval of 60 seconds at the infrastructure layer, further reducing the amount of redundant data in power environment monitoring.

[0134] Step 3: Sampling and Alarming of Abnormal Triggering Scenarios

[0135] At 8:10 PM on a weekday evening, the platform launched a limited-time promotion, causing traffic to surge threefold instantly, and the load on the container of the aforementioned product details page increased rapidly.

[0136] The response time x is obtained from the t-th sample (sampling interval 20s). t =230ms, last sampled value x t-1 =125ms, calculated to be: D t =∣230-120∣ / 20=5.5, v t =∣230-125∣ / 20=5.25ms / s, v t / V max =5.25 / 50=0.105, overall anomaly degree S t =0.4×5.5+0.6×0.105=2.263, which falls within the range of 1.5≤S t For the warning state interval of <3, the next sampling interval is adjusted to max(2s, 20×0.5)=10s.

[0137] The response time x is obtained by sampling at the (t+1)th time after 10 seconds. t =310ms, calculated to be: D t =|310-120| / 20=9.5, v t = |310-230| / 10=8ms / s, v t / V max =0.16, overall anomaly degree S t =0.4×9.5+0.6×0.16=3.896≥3, which is determined to be an abnormal state. The emergency sampling process is immediately triggered, and continuous sampling is performed at the minimum sampling interval of 2 seconds at the business layer.

[0138] First emergency sampling: x t =325ms, S t =4.12≥3;

[0139] Second emergency sampling: x t =340ms, S t =4.47≥3;

[0140] Third emergency sampling: x t =332ms, S t=4.29≥3 If the abnormal condition is met three times consecutively, an alarm will be immediately reported. The total time from the first detection of the warning state to the alarm triggering is 10s + 2s × 2 = 14s. If the traditional fixed 5-second sampling scheme is used, this abnormality would require waiting for 6 samples, totaling 30 seconds, before triggering the alarm. This scheme reduces the alarm delay by 53%.

[0141] After the exception handling was completed, the container's response time gradually decreased to around 120ms, and the S value was measured twice consecutively. t If the value is below 1.5, the system resumes the dynamic sampling adjustment process, and the sampling interval is gradually lengthened back to 20 seconds.

[0142] Step 4: Global Load Balancing Scheduling

[0143] During this promotional event, 270 containers and 110 servers simultaneously entered alert mode. The monitoring system's real-time sampling request volume reached 2100 requests / second, exceeding 80% of the system's maximum processing capacity (0.8 × 2500 = 20000.8 × 2500 = 2000 requests / second), triggering the load balancing strategy.

[0144] Priority Adjustment: The system selected 18 power and environmental devices in a steady state at the infrastructure layer and temporarily increased their current sampling interval by 20%. For example, the original 38-second sampling interval for UPS devices was adjusted to 46 seconds, reducing sampling requests by 120 per second. The real-time request volume dropped back to 1980 requests / second, below the threshold, without affecting the sampling accuracy of any abnormal / warning objects at the business or hardware layers. After the activity ended, the sampling request volume dropped back to 1200 requests / second, and the system gradually restored the original sampling intervals for low-priority devices.

[0145] Time-distribution adjustment: For 32 pre-warning containers in the same rack, the sampling time points with a 2-second interval were evenly distributed to 16 time slices per second by taking the container ID modulo 32 (2 containers are sampled every 125ms). After the adjustment, the peak rack outbound bandwidth decreased from 180Mbps to 95Mbps, and no sampling data packet loss or delay occurred.

[0146] Step 5: Closed-loop calibration optimization

[0147] The next day, the system automatically reviews the sampling results from the previous day and performs the following calibration operations:

[0148] False negative rate calibration: The investigation revealed that anomalies in two business containers during this promotional activity were not detected in a timely manner. Further analysis showed that the baseline V for these two containers... max The statistical value is 30ms / s, but the actual abnormal fluctuation rate reaches 40ms / s. Therefore, the system automatically adjusts the V values ​​for these two peak periods of the container. maxThe sampling rate was reduced by 10% to 27ms / s, corresponding to a reduction in the initial sampling interval from 3s to 2s, to avoid subsequent missed reports of similar cases.

[0149] Redundancy calibration: Statistical analysis revealed that S in the sampling data of 12 non-business test servers over 7 consecutive days... t The percentage of values ​​<0.5 reached 98%, indicating that this type of device is in a steady state for a long time. Therefore, the system automatically adjusted its hardware layer T... max The time was increased by 10% from 30s to 33s to further reduce redundant sampling.

[0150] Weight coefficient calibration: Both of the two anomalies that were missed this time were sudden anomalies, and 82% of the missed anomalies in the overall business application layer were sudden anomalies. Therefore, the system automatically increased the weight coefficient β of the business application layer from 0.6 to 0.7 and correspondingly decreased α to 0.3 to improve the sensitivity to sudden fluctuations.

[0151] Implementation effect verification

[0152] After three months of continuous operation in the data center, the core operational metrics of this solution are compared in Table 1 below:

[0153] Table 1: Comparison of Operation and Maintenance Indicators

[0154] index Traditional fixed 5-second sampling scheme Invention Solution Increase Average CPU utilization of the monitoring system 42% 15% Reduced by 64% Daily monitoring data storage volume 1.3TB 350GB Reduced by 73% Average alarm delay for business anomalies 29s 2.6s Reduced by 91% Abnormal false negative rate 1.1% 0.03% Reduced by 97% Operations and maintenance personnel configure workload weekly 8 hours 0.5 hours Reduced by 94%

[0155] Example 2: Hardware Layer Anomaly Monitoring Scenario for Financial Transaction Data Centers

[0156] This embodiment is applied to the core transaction data center of a bank. The monitoring objects are 500 physical servers (hardware device layer) that carry payment business. The business characteristics are extremely high transaction latency requirements (single transaction response time must be <100ms), sudden changes in CPU utilization will directly cause transaction timeouts, and the abnormal alarm latency is required to be <10 seconds.

[0157] Prerequisite parameter configuration

[0158] Hardware device layer parameters: T min =5s, T max =30s, hierarchical coefficient K=20, default weights α=0.4, β=0.6;

[0159] Monitoring metrics: Server CPU utilization. Historical data from peak hours (9:00-17:00) over the past 14 working days were extracted, excluding two abnormal periods during system version upgrades. A baseline feature library was constructed: μ=32%, σ=7%, V max =10% / s.

[0160] Implementation process and calculation

[0161] (1) Calculation of initial sampling interval

[0162] T0=min(T max ,max(T min K / V max ))=min(30,max(5,20 / 10))=5s, meaning the initial sampling interval of the server is 5 seconds.

[0163] (2) Adjustment during steady-state operation

[0164] During off-peak trading hours, server CPU utilization remained stable at 28%-36%, with S measured over eight consecutive sampling periods. t All <0.5: Taking a single sampling as an example, x t =33%, previous sample value x t-1 =31%, last sampling interval T t-1 =5s:

[0165] Relative deviation: D t =|33-32| / 7≈0.143;

[0166] Rate of change: v t =|33-31| / 5=0.4% / s;

[0167] Normalized rate of change: v t / V max =0.4 / 10=0.04;

[0168] Overall anomaly level: S t =0.4×0.143+0.6×0.04≈0.081<0.5, therefore it is determined to be in a steady state;

[0169] Next sampling interval: T t =min(30, 5×1.2)=6s After 6 rounds of adjustments, the sampling interval was gradually lengthened to the maximum interval of 30s at the hardware layer. Under steady state, the sampling frequency was only 1 / 6 of the initial value, which greatly reduced the monitoring resource occupation of the core transaction system (avoiding high-frequency sampling from occupying business CPU resources).

[0170] (3) Calculation of abnormal triggering scenarios

[0171] At a certain moment, a database lock conflict caused the server's CPU usage to spike rapidly.

[0172] The t-th sampling (interval 30s): x t =65%, previous sampled value x t-1 =33% Calculation: D t =∣65-32∣ / 7≈4.71,v t =∣65-33∣ / 30≈1.07% / s, v t / V max=0.107, S t =0.4×4.71+0.6×0.107≈1.95, and the next sampling interval is adjusted to max(5, 30×0.5)=15s when the state is in the early warning zone;

[0173] The sample is taken at the (t+1)th time after 15 seconds: x t =87% calculation: D t =∣87-32∣ / 7≈7.86,v t =∣87-65∣ / 15≈1.47% / s, v t / V max =0.147; S t =0.4×7.86+0.6×0.147≈3.23≥3, triggering emergency sampling, continuous sampling at 5s intervals:

[0174] First emergency sampling: x t =91%, S t =3.42≥3

[0175] Second emergency sampling: x t =89%, S t =3.35≥3

[0176] Third emergency sampling: x t =92%, S t =3.48≥3 If the abnormal condition is met 3 times consecutively, an alarm will be triggered, with a total delay of 15s + 5s × 2 = 25s.

[0177] Comparative analysis: If the traditional fixed 5s sampling scheme is adopted, the alarm needs to wait for the CPU to exceed the threshold (usually set to 80%) before three consecutive sampling confirmations are made, with a delay of 5s×3=15s. However, the amount of sampled data in steady state is 6 times that of this scheme, which will occupy the CPU and bandwidth resources of the core server for a long time. This scheme reduces steady-state resource consumption by 83%, while still meeting the bank system's requirement of <30 seconds for alarm latency, and the anomaly detection rate reaches 100%.

[0178] Example 3: Energy-saving monitoring scenario for green IDC infrastructure layer

[0179] This embodiment is applied to a green data center of a certain operator with a PUE (Power Usage Effectiveness) requirement of <1.2. The monitoring objects are 120 precision air conditioners (infrastructure layer). The monitoring objective is to reduce the energy consumption of the air conditioners as much as possible without affecting the heat dissipation of IT equipment, while promptly detecting cooling anomalies.

[0180] Prerequisite parameter configuration

[0181] Infrastructure layer parameters: T min =10s, T max=60s, hierarchical coefficient K=30, default weights α=0.4, β=0.6;

[0182] Monitoring indicators: Air conditioning return air temperature, extracting historical data from the past 14 days to construct a baseline feature library (off-peak period 22:00-7:00 the next day): μ=22℃, σ=1.2℃, V max =0.2℃ / s (the rate of temperature change is extremely slow under normal refrigeration conditions).

[0183] Implementation process and calculation

[0184] (1) Calculation of initial sampling interval

[0185] T0=min(60,max(10,30 / 0.2))=60s, meaning the initial sampling interval for the precision air conditioner is 60 seconds.

[0186] (2) Steady-state energy-saving operation adjustment

[0187] During off-peak hours, business load is low, data center heat generation is stable, and air conditioning return air temperature is consistently maintained at 21-23℃: a sample value x t =22.3℃, last sampled value x t-1 =22.1℃, last sampling interval T t-1 =60s:

[0188] Relative deviation: D t =∣22.3-22∣ / 1.2=0.25;

[0189] Rate of change: v t =∣22.3-22.1∣ / 60≈0.0033℃ / s;

[0190] Normalized rate of change: v t / V max =0.0033 / 0.2=0.0165;

[0191] Overall anomaly level: S t =0.4×0.25+0.6×0.0165≈0.11<0.5, which is considered to be in steady state. The sampling interval remains unchanged at 60s.

[0192] Comparative analysis: Traditional solutions typically set a fixed sampling interval of 10 seconds to ensure the detection rate of cooling anomalies. This solution extends the sampling interval to 60 seconds under steady state, reducing the bandwidth overhead of the power and environmental monitoring system by 83%. At the same time, it can optimize the air conditioning cooling strategy based on low-density steady-state sampling data, reducing the average daily energy consumption of a single air conditioner by about 0.8 kWh. For 120 air conditioners, the annual power saving is about 35,000 kWh, which meets the energy-saving requirements of green IDC.

[0193] (3) Calculation of refrigeration failure scenarios

[0194] An air conditioner compressor suddenly malfunctioned, resulting in a decrease in cooling capacity and a rapid rise in return air temperature.

[0195] The t-th sampling (interval 60s): x t =25.1℃, last sampled value x t-1 =22.4℃ Calculation: D t =∣25.1-22∣ / 1.2≈2.58, v t =∣25.1-22.4∣ / 60=0.045℃ / s,v t / V max =0.225, S t =0.4×2.58+0.6×0.225≈1.17, which is within the wave dynamic range, and the sampling interval remains unchanged at 60s.

[0196] Sampling at the (t+1)th time after 60 seconds: x t =28.3℃ Calculate: D t =∣28.3-22∣ / 1.2=5.25,v t =∣28.3-25.1∣ / 60≈0.053℃ / s, v t / V max =0.265, S t =0.4×5.25+0.6×0.265≈2.26, which is in the warning state range. The next sampling interval will be adjusted to max(10, 60×0.5)=30s;

[0197] The sample is taken at t+2 after 30 seconds: x t =30.7℃ Calculation: D t =|30.7-22| / 1.2≈7.25, v t =∣30.7-28.3∣ / 30=0.08℃ / s,v t / V max =0.4, St=0.4×7.25+0.6×0.4=3.14≥3, triggering emergency sampling, continuous sampling at 10s intervals:

[0198] First emergency sampling: x t =31.2℃, S t =3.26≥3;

[0199] Second emergency sampling: x t =31.8℃, S t =3.44≥3;

[0200] Third emergency sampling: x t =32.1℃, S t=3.52≥3 triggered an alarm, with a total delay of 60s+30s+10s×2=110s, which is far below the critical time for server overheating and shutdown due to abnormal cooling (usually 5 minutes), and did not cause any business loss.

[0201] (4) Closed-loop calibration

[0202] Retrospective analysis revealed that the temperature rise rate of 0.08℃ / s in this fault was significantly lower than the baseline V. max =0.2℃ / s, but it is still considered abnormal. Therefore, the system automatically increases the weight α of the air conditioner from 0.4 to 0.5 and decreases β to 0.5 to improve the sensitivity to abnormalities such as slow temperature rise. The alarm delay for subsequent similar faults is shortened to 80 seconds.

[0203] To better illustrate the technical solution provided by the present invention, the following verification experiments were conducted:

[0204] This test was deployed in a public cloud test data center of a certain operator, and the hardware configuration is as follows:

[0205] Server scale: 2 racks with a total of 80 physical servers, equipped with 320 business containers and 12 sets of power and environmental equipment (4 UPS units, 4 precision air conditioners, and 4 power distribution cabinets).

[0206] Monitoring system configuration: 2 quad-core 8GB sampling servers, maximum sampling processing capacity Q max =800 times / second;

[0207] Control group: Industry-standard fixed sampling scheme (all indicators are sampled at a uniform 5-second interval, with threshold-triggered alarms);

[0208] The test lasted for 7 consecutive days, covering all scenarios including weekdays / rest days, peak / off-peak / low-peak periods, and manually injecting 120 abnormal events of 5 types to verify the detection effect.

[0209] The definitions of the validation metrics are shown in Table 2 below:

[0210] Table 2: Indicator Definition Table

[0211] Indicator Classification Indicator Name Calculation method Resource overhead Monitoring system CPU utilization Average CPU utilization of the sampling server Monitor network bandwidth Average bandwidth usage of sampled data transmission Daily monitoring data storage volume Total size of daily sampled data Anomaly detection class Anomaly detection rate Number of successfully captured injection anomalies / Total number of injection anomalies Average alarm delay Average time from an anomaly to an alarm trigger Alarm false alarm rate False alarms / Total alarms System stability class Sampling request loss rate Number of unprocessed sampling requests / Total number of sampling requests

[0212] Experimental Grouping and Procedure

[0213] This experiment included two control groups, each running for 72 hours. All data were collected and compared.

[0214] Control group: The traditional fixed 5-second sampling scheme was used, and the alarm rule was that the alarm was triggered after 3 consecutive times exceeding the baseline threshold;

[0215] Experimental group: The adaptive sampling scheme of the present invention was adopted, and the parameter configuration was completely consistent with the above technical solution.

[0216] The types and quantities of abnormalities injected manually are shown in Table 3 below:

[0217] Table 3: Abnormal Types and Quantities

[0218] Exception types Injection quantity Abnormal characteristics Business container CPU surge 30 times CPU usage jumped from 20% to over 90% within 5 seconds and lasted for 1 minute. Business response time suddenly increased 30 times The response time increased from 100ms to over 500ms within 3 seconds, and lasted for 40 seconds. Server memory leak 20 times Memory usage increased by 5% per minute for 10 minutes. Precision air conditioner refrigeration malfunction 20 times The return air temperature rises by 1°C per minute for 8 minutes. UPS output voltage fluctuation 20 times The output voltage suddenly dropped from 220V to 210V and lasted for 10 seconds.

[0219] Comparison of test data

[0220] Table 4: Comparison of Resource Expenditure Indicators

[0221] index Control group (sampling time fixed at 5 seconds) Experimental group (the present invention scheme) Optimization range Average CPU utilization of the monitoring system 38.2% 12.7% Reduced by 66.8% Monitor network average bandwidth 28.5Mbps 7.6Mbps Reduced by 73.3% Daily monitoring data storage volume 112GB 29.8GB Reduced by 73.4% steady-state average sampling interval 5s 21.3s Extended by 326%

[0222] Table 5: Comparison of Anomaly Detection Indicators

[0223] Exception types Control group capture rate Average alarm delay in the control group Capture rate of the experimental group Average alarm delay in the test group Business container CPU surge 93.3%（28 / 30） 17.2s 100%（30 / 30） 2.8s Business response time suddenly increased 90%（27 / 30） 18.5s 100%（30 / 30） 2.5s Server memory leak 100%（20 / 20） 124s 100%（20 / 20） 67s Precision air conditioner refrigeration malfunction 100%（20 / 20） 182s 100%（20 / 20） 98s UPS output voltage fluctuation 65%（13 / 20） 12.3s 95%（19 / 20） 11.7s Overall Summary 90%（108 / 120） 63.7s 99.2%（119 / 120） 28.6s

[0224] Additional explanation: In the control group, all 7 UPS voltage fluctuation anomalies that were missed were flickering events lasting less than 5 seconds, which were missed because the fixed sampling interval just happened to miss the abnormal period; the experimental group only missed 1 extreme flickering event lasting less than 2 seconds, which is in line with the design expectation of a minimum sampling interval of 2 seconds at the business layer.

[0225] Table 6: Comparison of System Stability Indicators

[0226] index Control group (sampling time fixed at 5 seconds) Experimental group (the present invention scheme) Sampling request loss rate 0.12% 0.03% Peak sampling request volume 624 times / second 312 times / second Number of overload occurrences 2 times (peak requests exceed 700 times / second) 0 times

[0227] Key Scenario Special Verification

[0228] Scenario: Load balancing performance under sudden surges in business activity.

[0229] Simulating a major e-commerce promotion scenario, a CPU surge anomaly was injected into 100 containers simultaneously. The system load changes were monitored, as shown in Table 7 below:

[0230] Table 7: Load Change Record Table

[0231] Time point Real-time sampling request volume of the test group System processing status Anomaly detection Before the abnormality occurred 127 times / second normal - 10 seconds after the anomaly occurred 612 times / second Load balancing was triggered, increasing the sampling interval of low-priority steady-state devices by 20%, and the request volume dropped to 587 times / second. All anomalies were captured. 30 seconds after the anomaly occurred 576 times / second normal All abnormal alarms have been triggered. 10 minutes after abnormal recovery 132 times / second Restore normal sampling interval -

[0232] Comparative verification: Under the same scenario, the peak request volume of the control group reached 742 times / second, exceeding the maximum processing capacity of the system, and the sampling loss rate rose to 2.1%, with a total of 8 anomalies not being captured in time.

[0233] This experiment shows that:

[0234] Compared with traditional fixed sampling schemes, the monitoring system's CPU, bandwidth, and storage overhead are reduced by more than 65%, and the steady-state sampling interval is extended by more than 3 times, which significantly reduces the deployment and maintenance costs of the monitoring system.

[0235] The overall anomaly detection rate has increased from 90% to 99.2%, especially the detection rate of short-duration sudden anomalies has increased by more than 30%, and the average alarm latency has been reduced by 55%, which can meet the reliability requirements of low-latency services.

[0236] By employing a global load balancing strategy, sampling request overload was avoided during periods of abnormal outbreaks, the sampling loss rate was reduced by 75%, and no system overload occurred.

[0237] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for dynamic monitoring of data center operating status based on adaptive sampling, characterized in that, Includes the following steps: S1: Divide the data center monitoring objects into three layers: infrastructure layer, hardware equipment layer, and business application layer. Extract historical sampling data of each monitoring object from the past 14 days, excluding abnormal periods. Calculate the mean μ, standard deviation σ, and 99th percentile P of the indicators for each time period according to three time dimensions: weekday / restday and peak / off-peak / valley. 99 Maximum fluctuation rate V max Autocorrelation coefficient r with lags of 1 to 5 steps k The periodic fluctuation amplitude A is used to construct a benchmark feature library; the benchmark feature library is updated every 7 days. S2: Set the corresponding minimum sampling interval T for each level. min Maximum sampling interval T max And the hierarchical coefficient K, based on the level to which the monitored object belongs and the corresponding time period V max Calculate the initial sampling interval T0: The infrastructure layer has K=30, the hardware device layer has K=20, and the business application layer has K=10. S3: After each sampling is completed, calculate the relative deviation D of the current sampled value. t and adjacent sampling rate of change v t : In the formula x t Let x be the value of the t-th sample. t-1 Let T be the value of the (t-1)th sample. t-1 Let be the sampling interval from the (t-1)th to the tth sampling; combining the weighting coefficients α and β, where α + β = 1, and α = 0.4 and β = 0.6, calculate the comprehensive anomaly S. t : According to S t The next sampling interval T is adjusted according to the interval. t : When S t When T < 0.5, t =min(T max 1.2×T t-1 ); When 0.5≤S t When T < 1.5, t =T t-1 ; When 1.5≤S t When <3, T t =max(T min 0.5×T t-1 ); When S t When ≥3, continuously use T min Sampling 5 times, if S is sampled 3 times consecutively t An alarm will be triggered if S ≥ 3. t If it falls below 1.5, dynamic adjustment will resume. S4: Count the number of real-time sampling requests. When the number of requests exceeds 80% of the maximum processing capacity of the monitoring system, the sampling interval of the lower-level steady-state monitoring objects is temporarily increased by 20% according to the priority of business application layer > hardware device layer > infrastructure layer. At the same time, for the monitoring objects in the same cluster, the sampling time points are evenly distributed to each time slice of the sampling interval by hash modulo. S5: Backtrack the previous day's sampling data daily and perform the following calibration operations: If an abnormal event is detected in a monitored object but not captured in a timely manner, the V value for the corresponding time period of that object will be recorded. max Reduced by 10%; If the S sample data of the monitored object are in 7 consecutive days t The percentage of values ​​less than 0.5 exceeds 95%, which affects the T value of this object. max Increased by 10%; If more than 80% of the unreported anomalies of a certain level of monitoring objects are sudden anomalies, increase β by 0.1 and decrease α by 0.1 accordingly for that level; if the unreported anomalies are mainly slow-shifting anomalies, increase α by 0.1 and decrease β by 0.1 accordingly.

2. The method for dynamic monitoring of data center operation status based on adaptive sampling according to claim 1, characterized in that, The monitoring target range for the three levels in step S1 is as follows: The infrastructure layer includes UPS, precision air conditioning, power distribution cabinets, and fire protection equipment. The monitoring indicators are physical quantities such as voltage, current, temperature, humidity, and pressure. The hardware device layer includes servers, storage devices, and network switches. The monitoring metrics are CPU utilization, memory utilization, disk I / O, network bandwidth, and port throughput. The business application layer includes virtual machines, containers, and microservice instances. The monitoring metrics are request response time, request success rate, queue length, and error rate.

3. The method for dynamic monitoring of data center operation status based on adaptive sampling according to claim 2, characterized in that, The upper and lower limits of the sampling interval for each level in step S2 are: Infrastructure layer: T min =10s, T max =60s; Hardware device layer: T min =5s, T max =30s; Business application layer: T min =2s,T max =20s.

Images