A memory failure prediction method, device, equipment, medium and product

Abstract

The application discloses a memory fault prediction method, device, equipment, medium and product, relates to the field of memory fault prediction, and the method comprises the following steps: receiving stream log data in real time; the stream log data comprises a stream MCE log, a stream physical address log and a stream kernel log; according to the stream log data, a log source aggregation item, a physical address aggregation item and a kernel aggregation item are extracted based on a frequency quantization operator, a space distribution operator and an intensity weight operator by using a multi-level time quantization operator; a quantization feature vector is constructed according to the log source aggregation item, the physical address aggregation item and the kernel aggregation item; and according to the quantization feature vector, a probability mapping model trained is used for prediction, so as to obtain a probability value of server failure in a set time period. The application can improve the prediction accuracy of memory faults.

Description

Technical Field

[0001] This application relates to the field of memory fault detection, and in particular to a method, apparatus, device, medium and product for predicting memory faults. Background Technology

[0002] Memory failure is one of the core factors leading to server downtime and data loss. To ensure high availability in data centers, the industry typically relies on memory failure prediction mechanisms to replace components before hardware failure occurs. Currently, memory failure monitoring mainly depends on threshold-triggered mechanisms based on single-source logs such as Machine Check Exception (MCE). However, due to the complex spatiotemporal evolution of memory failure processes, these methods have significant limitations and low accuracy in predicting the evolution trend of memory failures. Summary of the Invention

[0003] The purpose of this application is to provide a method, apparatus, device, medium, and product for predicting memory failures, which can improve the accuracy of memory failure prediction.

[0004] To achieve the above objectives, this application provides the following solution: Firstly, this application provides a memory fault prediction method, including: Real-time reception of streaming log data; the streaming log data includes streaming MCE logs, streaming physical address logs, and streaming kernel logs; Based on the streaming log data, a multi-level time quantization operator is used to extract log source aggregation items, physical address aggregation items, and kernel aggregation items using frequency quantization, spatial distribution, and intensity weighting operators, respectively; the expression for the multi-level time quantization operator is: ; in, For multi-level time quantization operators, For second-level operators, For minute-level operators, For hourly operators; For feature fusion function; Construct a quantized feature vector based on the log source aggregation item, the physical address aggregation item, and the kernel aggregation item; Based on the quantized feature vector, a trained probability mapping model is used to predict the probability of the server failing within a set time period.

[0005] In one embodiment, based on the streaming log data, a multi-level time quantization operator is used to extract log source aggregation items, physical address aggregation items, and kernel aggregation items based on frequency quantization operators, spatial distribution operators, and intensity weighting operators, respectively. Specifically, this includes: Using a multi-level time quantization operator, based on the streaming log data and the frequency quantization operator, the cumulative occurrence count of each log source within the time window and the number of unique values ​​of the log source are counted according to type, and the occurrence counts are summed to obtain the log source aggregation item; Using a multi-level time quantization operator, the total number of physical addresses, the number of unique values, and the most frequently occurring value are counted based on the streaming physical address log and the spatial distribution operator to obtain a physical address aggregation item; The kernel aggregate term is obtained by weighting and summing the set hardware error flags of the streaming kernel log based on the intensity weighting operator using a multi-level time quantization operator.

[0006] In one embodiment, the trained probability mapping model is a LightGBM model.

[0007] In one embodiment, the probability mapping model is trained using F1-Score as the optimization target and the model parameters are optimized through cross-validation.

[0008] In one embodiment, the memory fault prediction method further includes: Determine whether the probability value of the server failing within a set time period is greater than a set threshold; If so, trigger an alert and output the time interval; If not, it will return "Receiving streaming log data in real time".

[0009] Secondly, this application provides a memory fault prediction device, comprising: The receiving module is used to receive streaming log data in real time; the streaming log data includes streaming MCE logs, streaming physical address logs, and streaming kernel logs. The extraction module is used to extract log source aggregation items, physical address aggregation items, and kernel aggregation items based on the streaming log data using a multi-level time quantization operator based on a frequency quantization operator, a spatial distribution operator, and an intensity weighting operator, respectively; the expression of the multi-level time quantization operator is: ; in, For multi-level time quantization operators, For second-level operators, For minute-level operators, For hourly operators; For feature fusion function; The construction module is used to construct a quantized feature vector based on the log source aggregation item, the physical address aggregation item, and the kernel aggregation item; The prediction module is used to predict the probability of the server failing within a set time period based on the quantized feature vector using a trained probability mapping model.

[0010] Thirdly, this application provides a computer device, including: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the computer program to implement the memory fault prediction method.

[0011] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the memory fault prediction method described above.

[0012] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the memory fault prediction method.

[0013] According to the specific embodiments provided in this application, the following technical effects are disclosed: This application provides a method, apparatus, device, medium, and product for memory fault prediction. In the data acquisition phase, it receives streaming MCE logs, streaming physical address logs, and streaming kernel logs in real time, using multi-dimensional data to overcome the problem of single data dimensions. Then, based on the streaming log data, it extracts log source aggregation items, physical address aggregation items, and kernel aggregation items according to frequency quantization operators, spatial distribution operators, and intensity weighting operators, respectively. Finally, it uses a trained probability mapping model to make predictions and quantize the fault evolution timeline, thereby improving the accuracy of memory fault prediction. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 This is a flowchart of a memory fault prediction method according to an embodiment of this application; Figure 2 A schematic diagram illustrating a memory fault prediction method provided in an embodiment of this application; Figure 3 This is a schematic diagram of feature extraction based on a multi-level time quantization operator; Figure 4 This is a schematic diagram of the functional modules of a memory fault prediction device provided in an embodiment of this application; Figure 5This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0016] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0017] The relevant solutions have the following defects.

[0018] First, the data dimension is too narrow. Existing solutions focus primarily on the absolute number of errors, neglecting the physical address distribution. The spatial clustering and coupling of hardware error events in the kernel log are considered. Rank represents the physical grouping of the memory chip, and Bank is the logical storage area within each physical group. Bank is organized into a two-dimensional matrix, where Row and Col represent the row address and column address, respectively.

[0019] Secondly, there is a lack of quantitative trend analysis. Existing monitoring mechanisms lack refined quantification of the fault evolution timeline, making it difficult to effectively distinguish between occasional random bit flips (soft errors) and trending hardware degradation (hard errors) at the mathematical level, resulting in a large number of false alarms in the early warning results.

[0020] Finally, the early warning lead time is insufficient. Due to the lack of comprehensive analysis of multi-scale time windows, existing methods often trigger alarms only a very short time before the failure occurs, failing to provide sufficient replacement cycles for server maintenance. This application can integrate multi-source heterogeneous data and quantify spatiotemporal evolution trends to predict Dynamic Random Access Memory (DRAM) failures.

[0021] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0022] In one exemplary embodiment, such as Figures 1-3 As shown, a memory fault prediction method is provided, which includes the following steps.

[0023] Step 101: Receive streaming log data in real time; the streaming log data includes streaming MCE logs, streaming physical address logs, and streaming kernel logs.

[0024] Step 102: Based on the streaming log data, use multi-level time quantization operators to extract log source aggregation items, physical address aggregation items, and kernel aggregation items using frequency quantization operators, spatial distribution operators, and intensity weighting operators, respectively. The statistical results of log source aggregation items, physical address aggregation items, and kernel aggregation items are the quantization features.

[0025] Step 103: Construct a quantized feature vector based on the log source aggregation item, the physical address aggregation item, and the kernel aggregation item.

[0026] Step 104: Based on the quantized feature vector, use the trained probability mapping model to make a prediction and obtain the probability value of the server failing within a set time period.

[0027] In an exemplary embodiment, real-time reception of streaming log data specifically includes the following: constructing a multi-source heterogeneous data acquisition pipeline, synchronously collecting and preprocessing three types of key log data, and constructing a heterogeneous dataset covering underlying hardware, physical space, and system status. Specifically, this includes: 1. MCE log acquisition: extracting mca_id (bank code) and transaction (transaction ID) to quantify the fault triggering intensity at the underlying hardware level. 2. Physical address log acquisition: parsing the detailed physical location coordinates of the fault occurrence. 3. Kernel Log Collection: Extract kernel hardware error flags such as hwerr through text template matching to quantify the hardware error status at the operating system level.

[0028] In an exemplary embodiment, the expression for the multi-level time quantization operator is: The expression for the multi-level time quantization operator is: ; in, For multi-level time quantization operators, For second-level operators, For minute-level operators, For hourly operators; For feature fusion function; This method is used to map operator results with different time quantization granularities to a unified feature space. Specific implementation methods include, but are not limited to, feature concatenation, weighted summation, or nonlinear mapping.

[0029] In practical applications, the expression for the multi-level time quantization operator is as follows: in, For multi-level time quantization operators, For second-level operators, in this example, we use time intervals of 15s and 30s. This is a minute-level operator; in this example, time intervals of 1 min, 2 min, 5 min, 10 min, and 30 min are used. For hourly operators, in this example, 1h, 2h, 8h, 24h, and 48h are used. Feature fusion function. The LightGBM model is used in this embodiment.

[0030] In an exemplary embodiment, based on the streaming log data, a multi-level time quantization operator is used to extract log source aggregation items, physical address aggregation items, and kernel aggregation items based on frequency quantization operators, spatial distribution operators, and intensity weighting operators, respectively. Specifically, this includes: Using a multi-level time quantization operator, based on the streaming log data and the frequency quantization operator, the cumulative occurrence count and the number of unique values ​​for each log source within a time window are calculated according to type, and the occurrence counts are summed to obtain a log source aggregation item. The log source aggregation item includes the total number, the number of unique values, the sum, and the type. The total number is the cumulative occurrence count, and the sum is the sum of the occurrence counts.

[0031] Using a multi-level time quantization operator, the total number of physical addresses, the number of unique values, and the most frequently occurring value are counted based on the spatial distribution operator according to the streaming physical address log, to obtain a physical address aggregation item.

[0032] The set hardware error flags of the streaming kernel log are weighted and summed using a multi-level time quantization operator based on the intensity weight operator to obtain a kernel aggregate term. The kernel aggregate term is a sum, and the set hardware error flags include more than 20 flags such as 1_hwerr_f, 2_sel, and 3_hwerr_n.

[0033] In practical applications, the design of multi-level time window quantization feature operators is aimed at addressing the evolutionary characteristics of memory failures from "random" to "systematic failure." This involves a set of time quantization operators covering second-level, graded, and hour-level operations. Its time span is defined as: For each time window Define the following feature extraction operator F: 1. Frequency quantization operator : Calculate the log sources in 1. Cumulative number of occurrences within a time window. 2. Spatial distribution operator. Calculate physical address Number of unique values And the most frequent value, used to identify the spatial clustering of faults. 3. Intensity weighting operator : Quantify the intensity of system-level hardware errors by performing a weighted summation of specific hardware error flags in the kernel log.

[0034] In an exemplary embodiment, the probability value of a server failure within a set time period is obtained by using a trained probability mapping model based on the quantized feature vector. Specifically, this includes the aforementioned multi-source, multi-time-window quantized feature vector. Inputting into the LightGBM (Gradient Boosting DecisionTree) model enables the extraction of spatiotemporal feature space. The nonlinear mapping of the failure probability P to the next 7 days.

[0035] In practical applications, the optimal trained model is deployed to a real-time monitoring system. The specific process is as follows: 1. Receive streaming log data in real time and dynamically update the quantized feature vector of the sliding window. 2. Input the quantized feature vector of the sliding window into the model, and output the probability value of the server failing within the next 7 days. .

[0036] In one exemplary embodiment, the trained probability mapping model is a LightGBM model. In practical applications, the probability mapping model is trained using F1-Score as the optimization objective, with a learning rate of 0.05 and a maximum depth of 6. Model parameters are optimized through cross-validation. The model training uses F1-Score as the optimization objective to ensure robustness of predictions on imbalanced datasets.

[0037] In an exemplary embodiment, the memory fault prediction method further includes: determining whether the probability value of the server failing within a set time period is greater than a set threshold; if yes, triggering an early warning and outputting a time interval; if no, returning "Real-time reception of streaming log data".

[0038] In practical applications, when the probability value When the time is right, an early warning is triggered, and the predicted time interval pti is output. Wherein, To set a threshold, the time interval is the time between the earliest data point in the three time windows and the predicted target (a failure that will occur within the next 7 days). For example, after a memory log anomaly occurs, it is very likely that a failure will occur within 10 minutes, far exceeding the 7-day timeframe, even though the logs from the past 6 days were actually normal. Therefore, when a suspected anomaly is detected in the second / minute / hour feature, a failure is predicted to occur within the next second / minute / hour.

[0039] This application addresses the difficulties in existing memory fault prediction technologies, such as the single dimension of prediction, lack of trend quantification leading to insufficient early warning and high false alarm rate. It provides a memory fault prediction method, device, equipment, medium, and product based on multi-source system log fusion and multi-level time window quantification features. This achieves accurate quantification of memory fault evolution trends, significantly improving the early warning of faults while ensuring a low false alarm rate.

[0040] This application addresses the issues of insufficient dimensionality and low early warning in memory fault prediction by proposing a technical solution of "multi-source fusion + multi-level time window quantization + LightGBM mapping". Compared with traditional threshold alarm methods, this application can effectively capture the evolution trend of hardware failure, significantly improve the early warning rate, and reduce the false alarm rate by utilizing physical space characteristics, thus providing reliable technical support for preventive maintenance of server memory.

[0041] In another exemplary embodiment, a specific workflow of the memory fault prediction method in practical applications is also provided, including the following:

[0042] The specific implementation steps for memory fault prediction of a server cluster in a data center are as follows: 1. Data preparation: Synchronously acquire MCE logs, physical address logs, and kernel logs. The physical address logs contain... Key dimensions. 2. Feature engineering: Setting time window sets. For each server, calculate its performance in... At that time, the number of unique values ​​of mca_id in the MCE log ( ) and the cumulative sum of 1_hwerr_f in the kernel log ( Traversal Generate a high-dimensional feature vector from all time windows. 3. Model Training: Select a historical fault dataset and... As input, the model is labeled with "whether a failure will occur in the next 7 days" (0 / 1). The LightGBM algorithm is used with a learning rate of 0.05 and a maximum depth of 6. Model parameters are optimized through cross-validation. 4. Real-time prediction: Log data within the current minute is acquired in real-time. All quantized features within the range of 15 seconds to 2 days are dynamically updated. The model is then input to derive the predicted probability. .like If the server is deemed high-risk, a replacement warning will be triggered.

[0043] To address the issues of insufficient single-source log dimensions, lack of time trend quantification, and missing physical space correlation in server memory fault early warning, which lead to low early warning lead time and high false alarm rate, this application constructs a multi-source heterogeneous data acquisition pipeline encompassing MCE logs, physical address logs, and kernel logs. It designs a multi-level time sliding window mechanism covering 15 seconds to 2 days, extracting various aggregation items based on quantitative indicators. Specifically, the statistical results of log source aggregation items are frequency-based aggregation features (e.g., total number of errors), physical address aggregation items are diversity-based aggregation features (e.g., number of unique mca_id / memory values), and kernel aggregation items are intensity-based aggregation features (e.g., accumulated kernel error flags). The LightGBM model is then used to accurately predict the probability of memory faults within the next 7 days. Compared to traditional threshold-based alarm methods, this application significantly improves the early warning lead time, effectively distinguishes between random errors and systemic degradation, and provides reliable technical support for predictive maintenance of server memory.

[0044] Based on the same inventive concept, this application also provides a memory fault prediction device for implementing the memory fault prediction method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more memory fault prediction device embodiments provided below can be found in the limitations of the memory fault prediction method described above, and will not be repeated here.

[0045] In one exemplary embodiment, such as Figure 4 As shown, a memory fault prediction device is provided, comprising: The receiving module is used to receive streaming log data in real time; the streaming log data includes streaming MCE logs, streaming physical address logs, and streaming kernel logs.

[0046] The extraction module is used to extract log source aggregation items, physical address aggregation items, and kernel aggregation items from the streaming log data using a multi-level time quantization operator based on frequency quantization, spatial distribution, and intensity weighting operators, respectively. The expression for the multi-level time quantization operator is: ; in, For multi-level time quantization operators, For second-level operators, For minute-level operators, For hourly operators; This is the feature fusion function.

[0047] A construction module is used to construct a quantized feature vector based on the log source aggregation item, the physical address aggregation item, and the kernel aggregation item.

[0048] The prediction module is used to predict the probability of the server failing within a set time period based on the quantized feature vector using a trained probability mapping model.

[0049] In one exemplary embodiment, a computer device is provided, which may be a server or a terminal, and its internal structure diagram may be as follows. Figure 5 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores memory fault prediction data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements a memory fault prediction method.

[0050] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer equipment to which the present application is applied. Specific computer equipment may include, for example, [the following is a list of possible additional structures]. Figure 5 The embodiments show more or fewer components, combinations of certain components, or different component arrangements. In one exemplary embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the above-described method embodiments.

[0051] In one exemplary embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the above-described method embodiments.

[0052] In one exemplary embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the above-described method embodiments.

[0053] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0054] In this application, all actions to acquire signals, information, or data are carried out in compliance with the relevant data protection laws and policies of the country where the location is situated, and with the authorization granted by the owner of the relevant device.

[0055] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0056] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0057] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0058] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A memory fault prediction method, characterized in that, include: Receive streaming log data in real time; The streaming log data includes streaming MCE logs, streaming physical address logs, and streaming kernel logs; Based on the streaming log data, a multi-level time quantization operator is used to extract log source aggregation items, physical address aggregation items, and kernel aggregation items using frequency quantization, spatial distribution, and intensity weighting operators, respectively; the expression for the multi-level time quantization operator is: ； in, For multi-level time quantization operators, For second-level operators, For minute-level operators, For hourly operators; For feature fusion function; Construct a quantized feature vector based on the log source aggregation item, the physical address aggregation item, and the kernel aggregation item; Based on the quantized feature vector, a trained probability mapping model is used to predict the probability of the server failing within a set time period.

2. The memory fault prediction method according to claim 1, characterized in that, Based on the streaming log data, multi-level time quantization operators are used to extract log source aggregation items, physical address aggregation items, and kernel aggregation items using frequency quantization operators, spatial distribution operators, and intensity weighting operators, respectively. Specifically, this includes: Using a multi-level time quantization operator, based on the streaming log data and the frequency quantization operator, the cumulative occurrence count of each log source within the time window and the number of unique values ​​of the log source are counted according to type, and the occurrence counts are summed to obtain the log source aggregation item; Using a multi-level time quantization operator, the total number of physical addresses, the number of unique values, and the most frequently occurring value are counted based on the streaming physical address log and the spatial distribution operator to obtain a physical address aggregation item; The kernel aggregate term is obtained by weighting and summing the set hardware error flags of the streaming kernel log based on the intensity weighting operator using a multi-level time quantization operator.

3. The memory fault prediction method according to claim 1, characterized in that, The trained probability mapping model is the LightGBM model.

4. The memory fault prediction method according to claim 3, characterized in that, The probability mapping model is trained using F1-Score as the optimization target, and the model parameters are optimized through cross-validation.

5. The memory fault prediction method according to claim 1, characterized in that, Also includes: Determine whether the probability value of the server failing within a set time period is greater than a set threshold; If so, trigger an alert and output the time interval; If not, it will return "Receiving streaming log data in real time".

6. A memory fault prediction device, characterized in that, include: The receiving module is used to receive streaming log data in real time. The streaming log data includes streaming MCE logs, streaming physical address logs, and streaming kernel logs; The extraction module is used to extract log source aggregation items, physical address aggregation items, and kernel aggregation items based on the streaming log data using a multi-level time quantization operator based on a frequency quantization operator, a spatial distribution operator, and an intensity weighting operator, respectively; the expression of the multi-level time quantization operator is: ； in, For multi-level time quantization operators, For second-level operators, For minute-level operators, For hourly operators; For feature fusion function; The construction module is used to construct a quantized feature vector based on the log source aggregation item, the physical address aggregation item, and the kernel aggregation item; The prediction module is used to predict the probability of the server failing within a set time period based on the quantized feature vector using a trained probability mapping model.

7. A computer device, comprising: A memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that the processor executes the computer program to implement the memory fault prediction method according to any one of claims 1-5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the memory fault prediction method according to any one of claims 1-5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the memory fault prediction method according to any one of claims 1-5.

Images