System monitoring method and apparatus, computer program product and electronic device

Abstract

This disclosure relates to the field of computer technology, specifically a system monitoring method and apparatus, a computer program product, and an electronic device. The system monitoring method includes: constructing a background information dataset based on historical system indicator data, wherein each piece of background information data in the dataset includes at least an application dimension, an interface dimension, and a data dimension; extracting semantic description information for each dimension of each piece of background information data, and constructing an initial background template based on the semantic description information corresponding to each piece of background information data; constructing a reference background template based on system indicator data within a target time period based on a preset time interval, and performing semantic matching between the reference background template and the initial background template to monitor system operation based on the matching results. This disclosure can improve the accuracy of system monitoring and enhance the efficiency of system monitoring and maintenance.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and more specifically, to a system monitoring method, a system monitoring device, a computer program product, and an electronic device. Background Technology

[0002] In large-scale software systems with current distributed software architectures, system interactions are becoming increasingly complex. Typically, trace IDs or performance metrics are used to monitor inter-system calls. Routine system monitoring and maintenance can only be achieved by aggregating various monitoring metrics and log information, and then relying on manual processing.

[0003] However, personnel changes or system handovers can easily lead to difficulties in troubleshooting system alarms and cause online issues that result in losses. Therefore, current system monitoring methods cannot quickly perceive detailed information across the entire system chain. They rely on developers' familiarity with the entire chain, requiring collaboration between developers of different systems to troubleshoot and locate problems. This results in a long troubleshooting process, making it difficult to pinpoint problems accurately and preventing timely damage control.

[0004] It should be noted that the information in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this disclosure is to provide a system monitoring method, system monitoring device, computer program product, and electronic device, thereby improving the accuracy of system monitoring and enhancing the efficiency of system monitoring and maintenance.

[0006] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0007] According to one aspect of this disclosure, a system monitoring method is provided, comprising: constructing a background information dataset based on historical system indicator data, wherein each background information data in the background information dataset includes at least an application dimension, an interface dimension, and a data dimension; extracting semantic description information for each dimension of each background information data, and constructing an initial background template based on the semantic description information corresponding to each background information data; constructing a reference background template based on system indicator data within a target time period based on a preset time interval, and performing semantic matching between the reference background template and the initial background template to monitor system operation based on the matching result.

[0008] In one exemplary embodiment of this disclosure, matching a reference background template with an initial background template to monitor system operation based on the matching result includes: performing semantic matching between the reference background template and the initial background template, determining the relevance score between the reference background template and each initial background template based on the semantic matching result, reordering the initial background templates based on the relevance score to obtain a reordering result; if there is a relevance score greater than or equal to a first threshold, invalid information is removed from the reordering result using the reference background template to obtain a historical background template based on the processed reordering result; wherein, the first threshold is used to evaluate the validity of the template; and interaction information is determined from the historical background template, and interaction is performed with a target interaction model based on the interaction information to obtain system operation monitoring results.

[0009] In one exemplary embodiment of this disclosure, invalid information is removed from the re-ranking result using a reference background template to obtain a historical background template based on the processed re-ranking result. This includes: obtaining an initial background template with the lowest semantic relevance as a target initial background template based on a relevance score; and replacing the target initial background template with the reference background template to obtain a historical background template based on the replaced re-ranking result.

[0010] In one exemplary embodiment of this disclosure, the method further includes: triggering a monitoring alert if a correlation score is greater than or equal to a second threshold; wherein the second threshold is greater than the first threshold, and the second threshold is used to assess whether there is an abnormal risk.

[0011] In one exemplary embodiment of this disclosure, after triggering a monitoring alert, the method further includes: obtaining link tracing identification information based on a reference background template; aggregating all system indicator data within the target time period and adjacent time periods based on the link tracing identification information to obtain an indicator dataset; and providing the indicator dataset as interactive information to the target interactive model for interaction to obtain system operation monitoring results.

[0012] In one exemplary embodiment of this disclosure, the method further includes: providing a reference background template and an initial background template as interactive information to a target interactive model for interaction, and verifying the monitoring and early warning based on the obtained interaction results.

[0013] In one exemplary embodiment of this disclosure, the method further includes: if a correlation score is less than a first threshold, then based on a preset time interval, reconstructing a reference background template according to system indicator data in the next target time period, and returning to the execution step of semantic matching between the reference background template and the initial background template.

[0014] In one exemplary embodiment of this disclosure, interactive information is determined from a historical background template, and interaction is performed with a target interactive model based on the interactive information to obtain system operation monitoring results. This includes: responding to a touch operation on system indicator data, determining the target historical background template corresponding to the time range of the touch operation as interactive information; and providing the interactive information to the target interactive model so that the target interactive model performs system operation monitoring analysis based on the interactive information to obtain system operation monitoring results.

[0015] In one exemplary embodiment of this disclosure, after constructing an initial background template based on the semantic description information corresponding to each background information data, the method further includes: storing the background information data for each background information data in a manner that uses the unique identifier corresponding to the background information data as the key and the background information data as the index; and storing the initial background template corresponding to the background information data in a manner that uses the unique identifier as the key and the semantic description information corresponding to the background information data as the index.

[0016] According to one aspect of this disclosure, a system monitoring device is provided, comprising: a data processing module, configured to construct a background information dataset based on historical system indicator data, wherein each background information data in the background information dataset includes at least an application dimension, an interface dimension, and a data dimension; an information extraction module, configured to extract semantic description information for each dimension of each background information data, and construct an initial background template based on the semantic description information corresponding to each background information data; and a monitoring processing module, configured to construct a reference background template based on system indicator data within a target time period based on a preset time interval, and perform semantic matching between the reference background template and the initial background template to monitor system operation based on the matching result.

[0017] According to one aspect of this disclosure, a computer program product is provided, comprising a computer program that, when executed by a processor, implements any of the above methods.

[0018] According to one aspect of this disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform any of the above methods by executing the executable instructions.

[0019] The system monitoring method in the exemplary embodiments of this disclosure constructs a background information dataset based on historical system indicator data. Each piece of background information data in this dataset includes at least an application dimension, an interface dimension, and a data dimension. Semantic description information is extracted from each dimension of each piece of background information data, and an initial background template is constructed based on the semantic description information corresponding to each piece of background information data. Based on a preset time interval, a reference background template is constructed based on system indicator data within a target time period. The reference background template is then semantically matched with the initial background template to monitor system operation based on the matching results. On the one hand, constructing the initial background template of the system using existing historical system indicator data provides accurate semantic expression for semantic matching retrieval because the initial background template is based on more semantic monitoring description information (semantic description information). This facilitates accurate location of system problems through matching with the reference background template, thereby improving the accuracy of system operation monitoring. On the other hand, it eliminates the need for manual intervention to query multi-dimensional data monitoring, enabling monitoring of complex software systems. Furthermore, the method of constructing background templates and performing template matching reduces the cost of manual monitoring.

[0020] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0021] The above and other objects, features, and advantages of this disclosure will become readily apparent from the following detailed description of exemplary embodiments, taken in conjunction with the accompanying drawings. Several embodiments of this disclosure are illustrated in the drawings by way of example and not limitation, in which:

[0022] Figure 1 A flowchart of a system monitoring method according to an exemplary embodiment of the present disclosure is shown.

[0023] Figure 2 A flowchart illustrating a method for monitoring system operation by matching a reference background template with an initial background template, according to an exemplary embodiment of the present disclosure, is shown.

[0024] Figure 3 A flowchart illustrating an interactive system monitoring process for acquiring aggregates according to an exemplary embodiment of the present disclosure is shown.

[0025] Figure 4 A schematic diagram of the composition of a system monitoring device according to an exemplary embodiment of the present disclosure is shown.

[0026] Figure 5 A schematic diagram of an electronic device according to an exemplary embodiment of the present disclosure is shown.

[0027] In the accompanying drawings, the same or corresponding reference numerals indicate the same or corresponding parts. Detailed Implementation

[0028] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar structures, and therefore their detailed description will be omitted.

[0029] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced without one or more of the specific details described, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known structures, methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0030] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, or in one or more software-hardened modules, or in different network and / or processor devices and / or microcontroller devices.

[0031] As software systems become increasingly complex, relying on historical experience to observe metrics such as JVM (Java Virtual Machine), containers, data centers, and networks, and tracing inter-system call information like trace IDs from single-machine error logs during daily operations and troubleshooting presents the following problems: It's impossible to quickly perceive detailed information about the entire system chain during daily operations. It depends on the developers' familiarity with the entire chain. In reality, the interaction logic of the application system connects dozens of systems of varying sizes, and this complex interaction logic makes monitoring data intricate. Even with various tools to obtain metrics and monitoring data, developers cannot immediately identify problems through the monitoring data. If a problem occurs at the lower level of the system chain, it usually indicates an anomaly in an upstream system, making such problems even more difficult to trace and locate.

[0032] In view of this, an exemplary embodiment of the present disclosure provides a system monitoring method that uses existing interfaces to obtain system monitoring data and uses it to construct a background template. The method determines abnormal fluctuations in indicators during system operation by semantic matching of the template, thereby achieving monitoring of system operation.

[0033] refer to Figure 1The diagram shown is a flowchart of a system monitoring method according to an exemplary embodiment of this disclosure, as follows: Figure 1 The system monitoring method of an exemplary embodiment of this disclosure may include steps S110 to S130:

[0034] In step S110, a background information dataset is constructed based on historical system indicator data. Each piece of background information data in the background information dataset includes at least an application dimension, an interface dimension, and a data dimension.

[0035] In the exemplary embodiments of this disclosure, historical system indicator data of the system to be monitored can be collected through existing interfaces. It should be understood that historical system indicator data refers to monitoring indicator data generated by the system in the past. This can be starting from the current time point and obtaining monitoring indicator data generated by the system in the past, such as monitoring indicator data generated by the system in the past week or month; no specific limitation is made. System logs can be obtained through asynchronous MQ (Message Queue), and system indicator data can be obtained by periodically scanning the system.

[0036] The background information dataset is a collection of background information data, containing data and information reflecting the overall system operation. It is established using application and interface methods as dimensions; that is, historical system indicator data is organized into background information data according to {application dimension, interface dimension, and data dimension}. Each piece of background information data includes at least three dimensions: application, interface, and data. The data dimension can include indicator data and log information.

[0037] Call chain information can be extracted from historical system indicator data, and all monitoring data can be associated with timestamps, thereby obtaining all data of each call chain, and then constructing a background information dataset based on the obtained data. The exemplary embodiments of this disclosure do not limit the method of extracting indicator data.

[0038] In step S120, semantic description information is extracted from each dimension of each background information data, and an initial background template is constructed based on the semantic description information corresponding to each background information data.

[0039] In an exemplary embodiment of this disclosure, background information data is used as the object, and the various dimensions contained in the background information data are input in parallel into a pre-trained semantic extraction model to obtain semantic description information corresponding to each dimension. For example, semantic description information AM corresponding to the application dimension, semantic description information IM corresponding to the interface dimension, and semantic description information DM corresponding to the data dimension are obtained.

[0040] The pre-trained semantic extraction model can be constructed using lightweight neural networks, such as CNNs (Convolutional Neural Networks), RNNs (Recurrent Neural Networks), and DNNs (Deep Neural Networks). Alternatively, it can employ a more complex target model, such as a heavyweight neural network like BERT (Bidirectional Encoder Representation from Transformers), Transformer (a language processing model), or any heavyweight neural network capable of extracting semantic description information. Furthermore, the pre-trained semantic extraction model can also be a large-scale model with hundreds of millions of records. LLMs (Large Language Models) refer to deep learning models trained on massive amounts of data, capable of generating natural language text or understanding the meaning of language text. This disclosure uses a large-scale model as an example for illustration.

[0041] After obtaining the semantic description information (such as application description information, method description information, indicator description information, and log description information) corresponding to each background information data, an initial background template can be formed based on the semantic description information. This initial background template describes the background information data with more semantic monitoring description information, more accurately reflects the changing trend of system indicator data, and provides a template basis for subsequent template matching.

[0042] In step S130, a reference background template is constructed based on the system indicator data within the target time period according to a preset time interval, and semantic matching is performed between the reference background template and the initial background template to monitor the system operation based on the matching results.

[0043] In the exemplary embodiments of this disclosure, the preset time interval refers to the time interval used for updating the background template and monitoring analysis. It can be set according to the actual task requirements. For example, for scenarios with high monitoring requirements, the preset time interval can be set to 10 seconds, and for scenarios with slightly lower monitoring requirements, the preset time interval can be set to 10 minutes. There is no limitation on the specific value of the preset time interval.

[0044] System indicator data for a given time period is acquired at preset time intervals to construct a reference background template. The target time period refers to the currently being processed period. The reference background template is constructed based on the system indicator data for the target time period. The method for constructing the reference background template is similar to that for constructing the initial background template, i.e., multiple background information data for the system indicator data are determined using {application dimension, interface dimension, data dimension}. Then, semantic description information is extracted from each dimension of each background information data to construct the reference background template.

[0045] Specifically, the initial background template typically reflects the normal state of system indicator data. If the system is sufficiently stable, fluctuations in the initial background template are unlikely or within a certain tolerance range. Semantic matching between the reference background template and the initial background template serves two purposes. First, significant fluctuations in the reference background template compared to the initial background template may indicate system instability and potential anomalies. Second, a high semantic correlation between the reference and initial background templates suggests the presence of invalid background information in the initial template. In such cases, the reference background template can be used to update the initial background template, ensuring its accuracy for semantic matching. Details will be discussed later.

[0046] The system monitoring method in the exemplary embodiments of this disclosure, on the one hand, utilizes existing historical system indicator data to construct an initial background template for the system. Because the initial background template is constructed based on more semantic monitoring description information (semantic description information), it provides accurate semantic expression for semantic matching retrieval, which is beneficial for accurately locating system problems through matching with a reference background template, thereby improving the accuracy of system operation monitoring. On the other hand, it eliminates the need for manual intervention to query multi-dimensional data monitoring, enabling the monitoring of complex software systems, and reduces the cost of manual monitoring by constructing a background template and performing template matching.

[0047] In one exemplary embodiment, such as Figure 2 As shown, matching a reference background template with an initial background template to monitor system operation based on the matching results can include:

[0048] Step S210: Perform semantic matching between the reference background template and the initial background template, and determine the relevance score between the reference background template and each initial background template based on the semantic matching result, so as to re-rank the initial background templates based on the relevance score and obtain the re-ranking result.

[0049] A semantic matching algorithm model can be used to semantically match a reference background template with an initial background template to determine the relevance score between the reference background template and each initial background template. Optionally, a pre-trained semantic matching model can be used for semantic matching processing, which can be pre-trained using a set of background template samples. Optionally, an existing re-ranking algorithm can be used, such as the Rerank algorithm, which can calculate the relevance score between the reference background template and the initial background template. The exemplary embodiments of this disclosure can select the semantic matching method according to actual needs.

[0050] The process involves reordering the initial background templates based on relevance scores, specifically from highest to lowest. The initial background templates are constructed based on semantic description information. Reordering them based on semantic relevance involves using a natural language processing model to re-rank the initial background templates, ensuring that the most relevant ones are presented first. This reordering evaluates the relevance between the reference and initial background template texts (semantic description information) by calculating the similarity between vectors, thereby optimizing the initial background template ranking. Each background template can be vectorized for semantic matching.

[0051] Step S220: If there is a correlation score greater than or equal to the first threshold, invalid information is removed from the re-ranking results using the reference background template, so as to obtain the historical background template based on the processed re-ranking results.

[0052] The first threshold is used to evaluate the validity of the template. If the obtained relevance scores are all greater than or equal to the first threshold, it indicates that the reference background template is valid. The semantic description information of the reference background template can be used to update the initial background template. Then, the reference background template can be used to remove invalid information from the re-ranking results, so as to obtain the historical background template based on the processed re-ranking results. It should be understood that "historical" here means that the initial background template can be updated successively during the system monitoring process, so each update result is called the historical background template.

[0053] In an exemplary embodiment, the invalid information removal process performed on the re-ranking result using a reference background template to obtain a historical background template based on the processed re-ranking result may include:

[0054] First, based on the relevance score, the initial background template with the lowest semantic relevance is obtained as the target initial background template. Then, the target initial background template is replaced with a reference background template to obtain the historical background template based on the reordering result after replacement.

[0055] The lower the relevance score, the more likely there is invalid information. Therefore, the target initial background template with the lowest semantic relevance can be obtained. Then, the target initial background template can be replaced with the reference background template, so that the obtained historical background template is consistent with the current system operation. That is, by semantic matching and filtering out invalid information, the contextual relevance and accurate matching ability are enhanced, providing accurate background template support for subsequent system operation monitoring.

[0056] Step S230: Determine the interaction information from the historical background template, and interact with the target interaction model based on the interaction information to obtain the system operation monitoring results.

[0057] After continuously updating and obtaining the historical background template, interactive information can be determined based on the historical background template. This interactive information is then used to interact with the target interactive model to obtain system operation monitoring results.

[0058] The target interaction model refers to a large model that can answer questions or fulfill user requests based on provided information. Exemplary embodiments of this disclosure can utilize a general interface to externally introduce various large models for multi-source data processing to obtain system operation monitoring results.

[0059] Specifically, in response to touch operations targeting system indicator data, the target historical background template corresponding to the time range of the touch operation can be determined as the interaction information, and the interaction information can be provided to the target interaction model so that the target interaction model can perform system operation monitoring and analysis based on the interaction information to obtain system operation monitoring results.

[0060] The touch operation of system indicator data can be achieved through human intervention. Users can select or input the time range of the desired historical background template via an interactive interface, thus responding to the touch operation and defining the target historical background template within the corresponding time range as the interactive information. This interactive information is provided as a prompt to the target interaction model, enabling the model to perform corresponding system operation monitoring upon being aware of the interactive information.

[0061] For example, a target background history template within a week can be provided to the target interaction model, and the target interaction model can be asked "Is a certain system indicator legal?", so that the target interaction model can perform relevant monitoring and troubleshooting operations based on the target background history template within a week.

[0062] By specifying specific interaction information from historical background templates for interaction with the target interaction model, direct interaction between R&D and the system can be achieved, enabling system monitoring and troubleshooting.

[0063] In one exemplary embodiment, a monitoring alert is triggered if a correlation score is greater than or equal to a second threshold. The second threshold is greater than the first threshold and is used to assess whether an anomaly risk exists.

[0064] Specifically, if the relevance score is greater than or equal to the first threshold and less than the second threshold, the target initial background template is replaced using a reference background template to filter out invalid information in the initial background template. However, considering that the smaller the semantic distance between the reference background template and each initial background template, the greater the system sensitivity indicated by the reference background template, and the greater the relevance between the reference background template and the initial background template, in practical implementation, when the relevance score between the reference background template and each initial background template is greater than or equal to the second threshold, it can be determined that the system part involved in the reference background template needs to be protected against system sensitivity, that is, it indicates that there is an abnormal risk in the system part related to the reference background template. At this time, an early warning message can be generated to prompt the system part involved in the reference background template to be monitored for abnormal risks.

[0065] Based on the foregoing exemplary embodiments, such as Figure 3 As shown, after a monitoring alert is triggered, it may also include:

[0066] Step S310: Obtain link tracing identification information based on the reference background template.

[0067] Step S320: Based on the link tracing identification information, aggregate all system indicator data within the target time period and adjacent time periods to obtain the indicator dataset.

[0068] The trace ID is a globally unique identifier used to identify the entire tracing process of a single user request or transaction in a distributed system. To further locate and troubleshoot problems, since the reference background information is a semantic description of system metric data, the trace ID can be obtained from the reference background template. Using this trace ID as a single request identifier, all system metric data within the target time period and adjacent time periods can be aggregated. The aggregation method can still be {application dimension, interface dimension, data dimension}.

[0069] By referencing the link tracing identification information obtained from the background information, the scope of problem investigation can be further narrowed down, ensuring the accuracy of problem location.

[0070] Step S330: Provide the indicator dataset as interactive information to the target interactive model for interaction, and obtain the system operation monitoring results.

[0071] After obtaining the indicator dataset through link tracing identification information, the indicator dataset can also be provided to the target interaction model as interactive information, so that the target interaction model can perform monitoring operations such as analysis and troubleshooting on the system operation when it knows the indicator dataset.

[0072] At this point, the system monitoring results obtained from the target interaction model can also be output as a snapshot as a historical operation report, so that R&D can conduct further analysis and problem tracing.

[0073] Link tracing can provide a dataset of metrics within a specified range to the target interaction model, improving the accuracy of anomaly location, enhancing system stability, and enabling timely loss mitigation.

[0074] In an exemplary embodiment, a reference background template and an initial background template may also be provided as interactive information to the target interactive model for interaction, and the monitoring and early warning may be verified based on the obtained interaction results.

[0075] To further verify the accuracy of monitoring and early warning, the initial background template and the reference background template that triggers the monitoring and early warning can be provided as interactive information to the target interaction model. Knowing the initial background template and the reference background template that triggers the monitoring and early warning, the target interaction model can analyze and investigate the system monitoring operation. The reliability of the current monitoring and early warning is determined by the output of the target interaction model. For example, if the target interaction model also outputs that there is a risk anomaly, then the monitoring and early warning is reliable.

[0076] Interactive monitoring and troubleshooting with the target interaction model can help quickly locate and / or verify risk anomalies by providing interactive information to the target interaction model, thereby achieving interactive system monitoring, reducing the cost of manual monitoring, and facilitating continuous system monitoring.

[0077] In an exemplary embodiment, if a relevance score is less than a first threshold, a reference background template is reconstructed based on system indicator data for the next target time period, and the process returns to the execution step of semantic matching between the reference background template and the initial background template.

[0078] Specifically, when all relevance scores are less than the first threshold, it indicates that the reference background template contains a lot of invalid information and the effectiveness of the reference background template is low. Therefore, the reference background template and related system indicator data can be filtered out, and the process can proceed to the next round of obtaining the reference background template. That is, the reference background template is reconstructed based on the system indicator data in the next target time period, and semantic matching is performed between the reference background template and the initial background template. The corresponding steps are then continued.

[0079] In other words, through the above exemplary embodiments, system indicator data needs to be continuously acquired at preset time intervals to either update the initial background template, trigger monitoring alerts, or reacquire system indicator data. By executing this cyclically, dynamic monitoring of the monitoring system can be achieved, ensuring the accuracy of the initial background template while providing timely risk warnings. This effectively improves the efficiency of system monitoring and maintenance, and enhances the accuracy of system monitoring.

[0080] In one exemplary embodiment, a data storage method is also provided. After constructing an initial background template based on the semantic description information corresponding to each background information data, the method may further include:

[0081] For each piece of background information data, the background information data is stored using its unique identifier as the key and the background information data itself as the index. Similarly, for the initial background template corresponding to the background information data, the initial background template is stored using its unique identifier as the key and the semantic description information corresponding to the background information data as the index.

[0082] Storing background information data and initial background templates using a key-value pair approach eliminates the need for complex query and indexing operations, as the data is accessed directly through a unique key. This allows key-value storage to provide extremely high read and write speeds, especially when processing large amounts of data, reducing latency and increasing throughput. Therefore, when determining indicator data or historical background templates for a specified time range in the exemplary embodiments described above, this storage method can quickly retrieve relevant data, improving data processing efficiency. At the same time, it avoids problems such as semantic similarity, multilingual conflicts, and identifier retrieval. This concise data storage method reduces the complexity of development and maintenance and improves the fault tolerance of semantic matching.

[0083] The system monitoring method in the exemplary embodiments of this disclosure, on the one hand, utilizes existing historical system indicator data to construct an initial background template for the system. Because the initial background template is constructed based on more semantic monitoring description information (semantic description information), it provides accurate semantic expression for semantic matching retrieval, which is beneficial for accurately locating system problems through matching with a reference background template, thereby improving the accuracy of system operation monitoring. On the other hand, it eliminates the need for manual intervention to query multi-dimensional data monitoring, enabling monitoring of complex software systems. Furthermore, the method of constructing a background template and performing template matching reduces the cost of manual monitoring. In addition, by continuously updating the initial background template, the accuracy of template matching and the relevance of context are improved, avoiding the illusion of large models and vertical domain problems. Through semantic matching and reordering of templates, it can be applied to system operation monitoring capabilities in complex scenarios.

[0084] Furthermore, embodiments of this disclosure also provide a system monitoring device, such as... Figure 4 As shown, the system monitoring device 400 may include:

[0085] The data processing module 410 is used to construct a background information dataset based on historical system indicator data. Each background information data in the dataset includes at least an application dimension, an interface dimension, and a data dimension. The information extraction module 420 is used to extract semantic description information from each dimension of each background information data and construct an initial background template based on the semantic description information corresponding to each background information data. The monitoring processing module 430 is used to construct a reference background template based on system indicator data within a target time period based on a preset time interval, and to perform semantic matching between the reference background template and the initial background template to monitor the system operation based on the matching results.

[0086] In one exemplary embodiment of this disclosure, the monitoring processing module 430 is configured to perform: semantic matching between a reference background template and an initial background template, and determine the relevance score between the reference background template and each initial background template based on the semantic matching result, so as to re-rank the initial background templates based on the relevance score to obtain a re-ranking result; if there is a relevance score greater than or equal to a first threshold, invalid information is removed from the re-ranking result using the reference background template to obtain a historical background template based on the processed re-ranking result; wherein, the first threshold is used to evaluate the validity of the template; interaction information is determined from the historical background template, and interaction is performed with the target interaction model based on the interaction information to obtain the system operation monitoring result.

[0087] In one exemplary embodiment of this disclosure, the monitoring processing module 430 is configured to perform: based on the relevance score, obtain the initial background template with the lowest semantic relevance as the target initial background template; replace the target initial background template with a reference background template to obtain a historical background template based on the reordering result after replacement.

[0088] In one exemplary embodiment of this disclosure, the monitoring processing module 430 is further configured to execute: if a correlation score is greater than or equal to a second threshold, a monitoring alert is triggered; wherein the second threshold is greater than the first threshold, and the second threshold is used to assess whether there is an abnormal risk.

[0089] In one exemplary embodiment of this disclosure, the monitoring processing module 430 is further configured to perform the following: after triggering a monitoring alert, obtain link tracing identification information based on a reference background template; based on the link tracing identification information, aggregate all system indicator data within the target time period and adjacent time periods to obtain an indicator dataset; and provide the indicator dataset as interactive information to the target interactive model for interaction to obtain system operation monitoring results.

[0090] In one exemplary embodiment of this disclosure, the monitoring processing module 430 is further configured to perform: providing a reference background template and an initial background template as interactive information to the target interactive model for interaction, and verifying the monitoring warning based on the obtained interaction results.

[0091] In one exemplary embodiment of this disclosure, the monitoring processing module 430 is further configured to perform the following steps: if a correlation score is less than a first threshold, then based on a preset time interval, reconstruct a reference background template according to the system indicator data in the next target time period, and return to the execution step of semantic matching between the reference background template and the initial background template.

[0092] In one exemplary embodiment of this disclosure, the monitoring and processing module 430 is further configured to perform: responding to a touch operation on system indicator data, determining the target historical background template corresponding to the time range of the touch operation as interactive information; providing the interactive information to the target interactive model so that the target interactive model performs system operation monitoring and analysis based on the interactive information to obtain system operation monitoring results.

[0093] In one exemplary embodiment of this disclosure, the information extraction module 420 is further configured to perform the following: after constructing an initial background template based on the semantic description information corresponding to each background information data, storing the background information data for each background information data in a manner that uses the unique identifier corresponding to the background information data as the key and the background information data as the index; and storing the initial background template corresponding to the background information data in a manner that uses the unique identifier as the key and the semantic description information corresponding to the background information data as the index.

[0094] Since the functional modules of the system monitoring apparatus in the exemplary embodiments of this disclosure are the same as those in the inventive embodiments of the system monitoring method described above, they will not be described again here.

[0095] It should be noted that although several modules or units of the system monitoring device have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0096] Exemplary embodiments of this disclosure also provide a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the system monitoring method described above.

[0097] In one embodiment, the computer program product can be a tangible product containing a computer program, such as a computer-readable storage medium storing the computer program. The readable storage medium can be a storage medium based on electrical, magnetic, optical, electromagnetic, infrared, or other signals, including but not limited to: random access memory (RAM), read-only memory (ROM), magnetic tape, floppy disk, flash memory, hard disk drive (HDD), solid-state drive (SSD), etc. For example, the computer program product can be implemented as a non-volatile storage medium storing the computer program, such as read-only memory, NAND flash memory, etc.

[0098] In one implementation, the computer program product can be an intangible product containing a computer program. For example, the computer program product can be implemented as a virtual digital product, such as an executable file, installation package, or other digital file storing the computer program.

[0099] Computer program code can be written in one or more programming languages. The program code can execute entirely on the user's computing device, or partially on the user's computing device, or as a standalone software package, or partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device through any type of network, such as a local area network (LAN), a wide area network (WAN), etc., or it can be connected to an external computing device (e.g., through an internet connection provided by a mobile network operator).

[0100] Computer programs can be carried or transmitted via signals such as electricity, magnetism, light, electromagnetic radiation, and infrared rays. Electronic devices can convert signals carrying computer programs into digital signals, thereby running the computer programs. When a computer program runs on an electronic device, its code is used to cause the electronic device to execute (more specifically, to execute by the processor of the electronic device) the method steps of various exemplary embodiments of this disclosure, such as the steps of the system monitoring method described above.

[0101] Furthermore, in exemplary embodiments of this disclosure, an electronic device capable of implementing the above-described methods is also provided. Those skilled in the art will understand that various aspects of this disclosure can be implemented as systems, methods, or program products. Therefore, various aspects of this disclosure can be specifically implemented as entirely hardware embodiments, entirely software embodiments (including firmware, microcode, etc.), or embodiments combining hardware and software aspects, collectively referred to herein as "circuit," "module," or "system."

[0102] The following reference Figure 5 To describe an electronic device 500 according to such an embodiment of the present disclosure. Figure 5 The electronic device 500 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0103] like Figure 5 As shown, the electronic device 500 is manifested in the form of a general-purpose computing device. The components of the electronic device 500 may include, but are not limited to: at least one processing unit 510, at least one storage unit 520, a bus 530 connecting different system components (including storage unit 520 and processing unit 510), and a display unit 540.

[0104] The storage unit stores program code that can be executed by the processing unit 510, causing the processing unit 510 to perform the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of this disclosure.

[0105] Storage unit 520 may include readable media in the form of volatile storage units, such as random access memory (RAM) 521 and / or cache memory 522, and may further include read-only memory (ROM) 523.

[0106] Storage unit 520 may also include a program / utility 524 having a set (at least one) program module 525, such program module 525 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0107] Bus 530 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0108] Electronic device 500 can also communicate with one or more external devices 600 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 500, and / or with any device that enables electronic device 500 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 550. Furthermore, electronic device 500 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 560. As shown, network adapter 560 communicates with other modules of electronic device 500 via bus 530. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 500, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0109] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0110] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this disclosure and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0111] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

Claims

1. A system monitoring method, characterized in that, include: Based on historical system indicator data, a background information dataset is constructed, wherein each piece of background information data in the background information dataset includes at least an application dimension, an interface dimension, and a data dimension. Semantic description information is extracted from each dimension of each background information data, and an initial background template is constructed based on the semantic description information corresponding to each background information data. Based on a preset time interval, a reference background template is constructed according to system indicator data within the target time period. The reference background template is then semantically matched with the initial background template to monitor system operation based on the matching results.

2. The method according to claim 1, characterized in that, The step of matching the reference background template with the initial background template to monitor system operation based on the matching result includes: The reference background template is semantically matched with the initial background template, and the relevance score between the reference background template and each of the initial background templates is determined based on the semantic matching result. The initial background templates are then reordered based on the relevance score to obtain the reordering result. If the correlation score is greater than or equal to the first threshold, the invalid information of the re-ranking result is removed using the reference background template, so as to obtain the historical background template based on the processed re-ranking result; wherein, the first threshold is used to evaluate the effectiveness of the template. Interaction information is determined from the historical background template, and interaction is performed with the target interaction model based on the interaction information to obtain system operation monitoring results.

3. The method according to claim 2, characterized in that, The step of using the reference background template to remove invalid information from the re-ranking result, so as to obtain a historical background template based on the processed re-ranking result, includes: Based on the relevance score, the initial background template with the lowest semantic relevance is obtained as the target initial background template; The target initial background template is replaced with the reference background template to obtain the historical background template based on the reordering result after replacement.

4. The method according to claim 2, characterized in that, The method further includes: If the correlation score is greater than or equal to the second threshold, a monitoring alert is triggered. The second threshold is greater than the first threshold, and the second threshold is used to assess whether there is an abnormal risk.

5. The method according to claim 4, characterized in that, After triggering the monitoring alert, the method further includes: Based on the reference background template, obtain the link tracing identification information; Based on the link tracing identification information, all system indicator data within the target time period and adjacent time periods are aggregated to obtain an indicator dataset; The aforementioned indicator dataset is provided as interactive information to the target interactive model for interaction, thereby obtaining system operation monitoring results.

6. The method according to claim 4, characterized in that, The method further includes: The reference background template and the initial background template are provided as interactive information to the target interactive model for interaction, and the monitoring and early warning are verified based on the obtained interaction results.

7. The method according to claim 2, characterized in that, The method further includes: If the correlation score is less than the first threshold, then based on the preset time interval, a reference background template is reconstructed according to the system indicator data in the next target time period, and the process returns to the execution step of semantic matching between the reference background template and the initial background template.

8. The method according to claim 2, characterized in that, The step of determining interaction information from the historical background template and interacting with the target interaction model based on the interaction information to obtain system operation monitoring results includes: In response to a touch operation on system indicator data, the target historical background template corresponding to the time range of the touch operation is determined as the interaction information; The interaction information is provided to the target interaction model so that the target interaction model can perform system operation monitoring and analysis based on the interaction information and obtain the system operation monitoring results.

9. The method according to any one of claims 1 to 8, characterized in that, After constructing the initial background template based on the semantic description information corresponding to each of the background information data, the method further includes: For each piece of background information data, the background information data is stored using the unique identifier corresponding to the background information data as the key and the background information data as the index value. For the initial background template corresponding to the background information data, the initial background template is stored using the unique identifier as the key and the semantic description information corresponding to the background information data as the index.

10. A system monitoring device, characterized in that, include: The data processing module is used to construct a background information dataset based on historical system indicator data. Each piece of background information data in the background information dataset includes at least an application dimension, an interface dimension, and a data dimension. The information extraction module is used to extract semantic description information from each dimension of each background information data, and to construct an initial background template based on the semantic description information corresponding to each background information data. The monitoring and processing module is used to construct a reference background template based on system indicator data within a target time period according to a preset time interval, and to perform semantic matching between the reference background template and the initial background template in order to monitor the system operation based on the matching results.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 9.

12. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to perform the method of any one of claims 1 to 9 by executing the executable instructions.

Images