Method and apparatus for monitoring identification of abnormal information

Abstract

The application provides a kind of monitoring abnormal information identification method and device, comprising: obtaining host running data and monitoring configuration information;Based on host running data, actual monitoring information is obtained by matching feature rule base;The actual monitoring information includes the association host information, monitoring identification of actual monitoring process and actual monitoring port;The feature rule base is the database based on historical monitoring data construction;The feature rule base includes process identification rule set and port identification rule set;Actual monitoring information is compared with monitoring configuration information, and monitoring abnormal information is obtained;The application matches and identifies actual monitoring target and compares and verifies monitoring information, realizes process and port monitoring inspection, improves the management efficiency of monitoring configuration, can effectively identify monitoring abnormality, reduces the existence of monitoring blind area and invalid monitoring.

Description

Technical Field

[0001] This invention belongs to the field of information monitoring technology, and in particular relates to a method and device for identifying abnormal monitoring information. Background Technology

[0002] Monitoring is a core component of information system operation and maintenance management, and is crucial for ensuring business continuity and system stability. Financial institutions and other enterprises deploy numerous heterogeneous applications and basic components in their production environments, requiring the configuration of monitoring alerts for critical processes and ports to achieve risk awareness. However, existing process and port monitoring configuration management solutions have significant shortcomings in ensuring integrity: manual inspection methods are inefficient and prone to omissions, making them unsuitable for large-scale, dynamically changing production environments; the integrity check of monitoring configurations lacks a standardized automatic comparison mechanism, failing to accurately identify discrepancies between the actual objects to be monitored and the configured monitoring items; and this can easily lead to long-term existence of monitoring blind spots and ineffective monitoring.

[0003] Existing monitoring and inspection technologies can only perform simple existence checks of monitoring items or standardize monitoring data only for specific middleware. They have not solved the problem of accurately identifying the processes and ports to be monitored from the massive host operation data. Moreover, the comparison logic is simple and cannot meet the actual needs of process and port monitoring integrity management in large-scale heterogeneous production environments. Summary of the Invention

[0004] This invention provides a method for identifying monitoring anomalies. By matching and identifying the actual monitoring target and comparing and verifying monitoring information, it achieves process and port monitoring checks, improves the management efficiency of monitoring configuration, effectively identifies monitoring anomalies, and reduces the existence of monitoring blind spots and invalid monitoring. The method for identifying monitoring anomalies includes: Acquire host operation data and monitoring configuration information; the host operation data includes process information, port information, and port network connection status information; the monitoring configuration information includes the associated host information and monitoring identifier of the process and port to be monitored. Based on host operation data, actual monitoring information is obtained through matching with a feature rule base. The actual monitoring information includes: associated host information and monitoring identifiers for actual monitored processes and ports. The feature rule base is a database built based on historical monitoring data. The feature rule base includes a process identification rule set and a port identification rule set. The process identification rule set is used to match the actual monitored application processes and basic component processes. The port identification rule set includes standard port identification rules and identification rules based on network connection status. The actual monitoring information is compared with the monitoring configuration information to obtain monitoring anomaly information; the monitoring anomaly information includes monitoring omission information and zombie monitoring information.

[0005] This invention provides a device for identifying monitoring anomalies. By matching and identifying the actual monitoring target and comparing and verifying monitoring information, it achieves process and port monitoring checks, improves the management efficiency of monitoring configuration, effectively identifies monitoring anomalies, and reduces the existence of monitoring blind spots and invalid monitoring. The device for identifying monitoring anomalies includes: The data acquisition module is used to acquire host operating data and monitoring configuration information; the host operating data includes process information, port information, and port network connection status information; the monitoring configuration information includes associated host information and monitoring identifiers for the processes and ports to be monitored. The matching module is used to obtain actual monitoring information based on host operation data and through a feature rule base. The actual monitoring information includes the associated host information and monitoring identifier of the actual monitored processes and ports. The feature rule base is a database built based on historical monitoring data. The feature rule base includes a process identification rule set and a port identification rule set. The process identification rule set is used to match the actual monitored application processes and basic component processes. The port identification rule set includes standard port identification rules and identification rules based on network connection status. The monitoring anomaly identification module is used to compare the actual monitoring information with the monitoring configuration information to obtain monitoring anomaly information; the monitoring anomaly information includes monitoring omission information and zombie monitoring information.

[0006] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-mentioned method for identifying abnormal monitoring information.

[0007] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-described method for identifying monitoring anomaly information.

[0008] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-mentioned method for identifying abnormal monitoring information.

[0009] In this embodiment of the invention, host operating data and monitoring configuration information are acquired. The host operating data includes process information, port information, and port network connection status information. The monitoring configuration information includes associated host information and monitoring identifiers for the processes and ports to be monitored. Based on the host operating data, actual monitoring information is obtained through matching with a feature rule base. The actual monitoring information includes associated host information and monitoring identifiers for the actual monitored processes and ports. The feature rule base is a database built based on historical monitoring data. The feature rule base includes a process identification rule set and a port identification rule set. The process identification rule set is used to match the application processes and basic component processes being monitored. The port identification rule set includes standard port identification rules and identification rules based on network connection status. The actual monitoring information is compared with the monitoring configuration information to obtain monitoring anomaly information. The monitoring anomaly information includes monitoring omission information and zombie monitoring information. This embodiment of the invention achieves process and port monitoring checks by matching and identifying actual monitoring targets and comparing and verifying monitoring information, improving the management efficiency of monitoring configuration, effectively identifying monitoring anomalies, and reducing the existence of monitoring blind spots and invalid monitoring. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings: Figure 1 This is a flowchart of the method for identifying abnormal monitoring information in an embodiment of the present invention; Figure 2 This is a specific example diagram illustrating the determination of actual monitoring information in an embodiment of the present invention; Figure 3 This is a specific example diagram of forward comparison in an embodiment of the present invention; Figure 4 This is a specific example diagram of a reverse comparison in an embodiment of the present invention; Figure 5 This is a structural example diagram of the identification device for monitoring abnormal information in an embodiment of the present invention; Figure 6 This is a specific example diagram of the structure of the identification device for monitoring abnormal information in an embodiment of the present invention; Figure 7 This is a specific example diagram of the structure of the identification device for monitoring abnormal information in an embodiment of the present invention; Figure 8 This is a structural diagram of a computer device in an embodiment of the present invention. Detailed Implementation

[0011] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0012] As mentioned earlier, in terms of process and port monitoring integrity checks, some existing technologies identify monitoring gap risks by acquiring and comparing server application running data and monitoring configuration data. However, these technologies can only acquire simple, static process and port data and cannot intelligently identify the objects to be monitored from the massive amount of raw data. Furthermore, one-way comparisons can only detect monitoring omissions and cannot identify redundant configurations. Other technologies unify the middleware monitoring data format through a format conversion layer, but assume that all middleware instances need to be monitored, making it impossible to determine the necessity of monitoring. Moreover, monitoring items must be configured before data conversion is triggered, and the mechanism fails when monitoring configurations are missing.

[0013] Meanwhile, traditional operation and maintenance processes are prone to errors and have low efficiency in terms of manual inspection process and port monitoring configuration.

[0014] To address this issue, the inventors discovered that by acquiring host runtime and monitoring configuration data through multi-source data collection, a feature rule base can be built to achieve accurate identification of monitoring targets. Furthermore, through bidirectional comparison, monitoring omissions and zombie monitoring issues can be identified. Therefore, a method for identifying abnormal monitoring information is proposed to achieve accurate and efficient checking of monitoring configurations and eliminate monitoring blind spots.

[0015] Figure 1 This is a flowchart of the method for identifying abnormal monitoring information in an embodiment of the present invention, such as... Figure 1 As shown, the method for identifying monitoring anomaly information includes: Step 101: Obtain host operation data and monitoring configuration information; the host operation data includes process information, port information, and port network connection status information; the monitoring configuration information includes the associated host information and monitoring identifier of the process to be monitored and the port to be monitored. Step 102: Based on host operation data, obtain actual monitoring information through matching with a feature rule base; the actual monitoring information includes: associated host information and monitoring identifiers of the actual monitored processes and ports; the feature rule base is a database built based on historical monitoring data; the feature rule base includes a process identification rule set and a port identification rule set; the process identification rule set is used to match the actual monitored application processes and basic component processes; the port identification rule set includes standard port identification rules and identification rules based on network connection status; Step 103: Compare the actual monitoring information with the monitoring configuration information to obtain monitoring anomaly information; the monitoring anomaly information includes monitoring omission information and zombie monitoring information.

[0016] Depend on Figure 1 As shown in the process, in this embodiment of the invention, host operating data and monitoring configuration information are acquired. The host operating data includes process information, port information, and port network connection status information. The monitoring configuration information includes associated host information and monitoring identifiers for the processes and ports to be monitored. Based on the host operating data, actual monitoring information is obtained through matching with a feature rule base. The actual monitoring information includes associated host information and monitoring identifiers for the actual monitored processes and ports. The feature rule base is a database built based on historical monitoring data. The feature rule base includes a process identification rule set and a port identification rule set. The process identification rule set is used to match the application processes and basic component processes being monitored. The port identification rule set includes standard port identification rules and identification rules based on network connection status. The actual monitoring information is compared with the monitoring configuration information to obtain monitoring anomaly information. The monitoring anomaly information includes monitoring omission information and zombie monitoring information.

[0017] Compared to existing technologies that can only compare static process port data, cannot intelligently identify monitored objects, and can only detect monitoring omissions, while relying on manual inspections leading to low efficiency, this new technology obtains host operation data and monitoring information containing port network connection status. It matches actual monitoring information with a feature rule base containing process identification rule sets, standards, and port identification rule sets based on network connection status. Then, it performs bidirectional comparisons between the actual monitoring information and the monitoring information to obtain monitoring anomaly information. This enables intelligent and comprehensive checks on the integrity of process and port monitoring, accurately identifies monitoring omissions and zombie monitoring issues, thereby eliminating monitoring blind spots, providing accurate basis for subsequent governance, and adapting to the operation and maintenance needs of large-scale heterogeneous production environments.

[0018] In step 101, host operating data and monitoring configuration information are obtained; the host operating data includes process information, port information and port network connection status information; the monitoring configuration information includes the associated host information and monitoring identifier of the process to be monitored and the port to be monitored.

[0019] In a specific embodiment, obtaining host operating data and monitoring configuration information includes: Host operation data collection: Raw data is collected daily by executing system commands in batches through agents deployed on each host.

[0020] For example, the `ps aux` command can be executed to obtain full process information, including key fields such as process name, PID, startup user, and command-line arguments; the `netstat -tunlp` command can be executed to obtain full port information, as well as port network connection status information associated with the listening port, such as connection statistics such as ESTABLISHED and TIME_WAIT, which are then integrated to form host operation data.

[0021] Monitoring configuration information collection: Through the open API configuration query interface provided by the centralized monitoring platform, all configured process and port monitoring items are obtained as monitoring configuration information. Each monitoring information record includes the associated host information and monitoring identifier of the process and port to be monitored, as well as relevant configuration information such as monitoring type and alarm threshold.

[0022] Figure 2 This is a specific example diagram illustrating the determination of actual monitoring information in an embodiment of the present invention, such as... Figure 2 As shown, based on host operation data, actual monitoring information is obtained through matching using a feature rule base, which may include: Step 201: Match process information using the process identification rule set in the feature rule base, and filter out the application processes and basic component processes that are actually monitored as the actual monitored processes. Step 202: Match port information and port network connection status information using the port identification rule set in the feature rule base to filter out the actual monitoring ports.

[0023] In a specific embodiment, based on host operation data, actual monitoring information is obtained through matching using a feature rule base, including: Matching process information to determine the actual monitored process: By matching process information in host running data one by one through the process identification rule set in the feature rule base, the application processes and basic component processes that need to be monitored are selected according to the rules and used as the actual monitoring processes. For example, the rules for matching application processes are based on the user who started the application process or the command line containing the keyword "java". The rules for matching basic component processes are based on the component type. For example, the Mesh component matches the process name regular expression "mosn|sidecar-agent|citadel-agent", and the FEX component matches the process name that belongs to the set {rcmdsvr, fexnode, fexscncli, fexvdvagt}. At the same time, the associated host information and monitoring identifier are marked for the actual monitored processes that are filtered out.

[0024] Matching port-related information to determine the actual monitoring port: By combining port information and port network connection status information in the host operation data through the port identification rule set in the feature rule base, the actual monitoring ports that need to be monitored are filtered out. For example, standard ports of known basic components are matched using standard port identification rules, such as port number 3306 being identified as the port that needs to be monitored for MySQL. Non-standard application ports are matched using identification rules based on network connection status, that is, active business ports with a port status of LISTEN and connections in non-LISTEN states such as ESTABLISHED and TIME_WAIT. At the same time, the associated host information and monitoring identifiers are labeled for the actual monitoring ports that are selected.

[0025] Integrate relevant information about the actual monitoring process and the actual monitoring port to form actual monitoring information that includes associated host information and monitoring identifiers for all actual monitored objects.

[0026] Figure 3 This is a specific example diagram of forward alignment in an embodiment of the present invention, as shown below. Figure 3 As shown, by comparing the actual monitoring information with the monitoring configuration information, monitoring anomaly information can be obtained, which may include: Identifying missed monitoring information through forward comparison can include: Step 301: Traverse each data item in the actual monitoring information and obtain the monitoring type, monitoring identifier and associated host information corresponding to each data item; Step 302: Based on the obtained monitoring type, monitoring identifier and associated host information, perform a matching query in the monitoring configuration information to determine whether there is monitoring configuration information for the same host, the same type and the same monitoring identifier; Step 303: If the query result is not found, mark the data as monitoring omission information.

[0027] In a specific embodiment, identifying missed monitoring information through forward comparison includes: Extract key data from actual monitoring information: Iterate through each data item of the actual monitored process and port in the actual monitoring information, and extract the monitoring type corresponding to each data item, namely process / port, monitoring identifier, such as process name / PID combination / port number, and associated host information, such as host name and host IP, to provide accurate retrieval basis for subsequent matching queries.

[0028] Perform precise matching queries within the monitoring configuration information: Based on the extracted monitoring type, monitoring identifier, and associated host information, a one-to-one matching query is performed on the monitoring configuration information in the monitoring configuration baseline library to determine whether there are monitoring configuration items for the same host, the same monitoring type, and the same monitoring identifier in the monitoring information.

[0029] Identify and label any missing monitoring information: If, after matching and querying, there is no monitoring configuration corresponding to the same host, type, and monitoring identifier in the monitoring configuration information, it is determined that the actual monitored object has not been configured for monitoring. This data is marked as monitoring omission information, and the corresponding hostname, host IP, anomaly type, component category, discovery time, and other key information are recorded.

[0030] Figure 4 This is a specific example diagram of a reverse comparison in an embodiment of the present invention, such as... Figure 4 As shown, by comparing the actual monitoring information with the monitoring configuration information, monitoring anomaly information can be obtained, which may include: Identifying zombie surveillance information through reverse comparison can include: Step 401: Traverse each data item in the monitoring configuration information and obtain the monitoring type, monitoring identifier and associated host information corresponding to each data item; Step 402: Based on the obtained monitoring type, monitoring identifier and associated host information, perform a consistency query in the actual monitoring information to determine whether the data actually exists on the corresponding host and meets the monitoring conditions. Step 403: If the query result is non-existent, or exists but does not meet the monitoring judgment rules in the feature rule base, mark the data as zombie monitoring information.

[0031] In a specific embodiment, zombie monitoring information is identified through reverse comparison, including: Extract key data from monitoring configuration information: Iterate through each data item in the monitoring configuration baseline library, extracting the monitoring type, monitoring identifier, and associated host information corresponding to each data item, providing a retrieval basis for subsequent consistent queries.

[0032] Perform consistency queries on actual monitoring information: Based on the extracted monitoring type, monitoring identifier, and associated host information, a precise consistency query is performed on the actual monitoring information to determine whether the monitoring target actually exists on the corresponding host and whether it conforms to the monitoring judgment rules for processes and ports in the feature rule base.

[0033] Identify and label zombie monitoring information: If a consistency query finds that the monitoring target does not exist on the corresponding host, or exists but does not meet the monitoring judgment rules in the feature rule base, the monitoring configuration is determined to be an invalid and redundant configuration. The monitoring target is marked as zombie monitoring information, and the corresponding hostname, host IP, anomaly type, component category, discovery time and other key information are recorded.

[0034] In this embodiment, after comparing the actual monitoring information with the monitoring configuration information to obtain monitoring anomaly information, the following may be included: An action plan is generated based on the abnormal monitoring information, and the abnormal monitoring information is then processed based on the action plan.

[0035] In a specific embodiment, a handling plan is generated based on the abnormal monitoring information, and the abnormal monitoring information is handled, including: The system compiles and aggregates both missed and botnet monitoring information to form a complete list of monitoring anomalies. For each anomaly, it adds information such as the associated system name and group. The system is then categorized and sorted by anomaly type and risk level. Based on the anomaly type and risk level, a standardized handling plan is generated. For missed monitoring information, a handling plan is generated to add monitoring configurations. For botnet monitoring information, a handling plan is generated to delete invalid monitoring configurations.

[0036] Based on the handling plan, the abnormal monitoring information is handled. First, the list of monitored abnormalities and the handling plan are displayed by generating a monitoring integrity report through a visual web console. For complex abnormalities, the work order process engine is automatically triggered to create an operation and maintenance work order, which includes abnormal details, handling plan and completion deadline requirements.

[0037] By relying on the closed-loop controller to track the progress of work order processing, and after the monitoring configuration is added or invalid configuration is deleted according to the handling plan, the system automatically verifies the handling result. If the verification is successful, the work order is closed and the abnormal monitoring information is handled. If the verification fails, the work order is reassigned until the problem is resolved, thus forming a complete closed-loop management of monitoring anomaly handling.

[0038] In this embodiment, after comparing the actual monitoring information with the monitoring configuration information to obtain monitoring anomaly information, the following may be included: Reacquire host operation data and monitoring configuration information, and obtain updated actual monitoring information by matching with the feature rule base; Compare the updated actual monitoring information with the updated monitoring configuration information to verify whether the anomaly has been eliminated.

[0039] In a specific embodiment, after obtaining the monitoring anomaly information, the verification of the anomaly elimination includes: Following the original method of collecting host operation data and monitoring configuration information, the latest host operation data is collected again by executing system commands through each host agent, including process information, port information and port network connection status information. At the same time, the updated monitoring information is obtained through the API configuration query interface of the centralized monitoring platform to form the latest monitoring configuration benchmark library.

[0040] The newly acquired host operation data is input into the rule engine, which loads the process identification rule set and port identification rule set in the feature rule base and performs matching one by one. The engine intelligently identifies and extracts the updated actual monitoring information, and clarifies the updated actual monitoring process and actual monitoring port, as well as the corresponding associated host information and monitoring identifier.

[0041] The updated actual monitoring information is compared with the updated monitoring configuration information in both forward and reverse directions. According to the original comparison rules, it is checked whether the monitoring objects corresponding to the original missing monitoring information have been configured for monitoring and whether the invalid monitoring configurations corresponding to the original zombie monitoring information have been deleted, so as to verify whether the monitoring anomaly has been eliminated. If the comparison result does not have corresponding anomaly information, it is determined that the anomaly has been eliminated. If there is still relevant anomaly information, it is determined that the anomaly has not been eliminated and the follow-up and handling will continue.

[0042] Verification has shown that the method for identifying abnormal monitoring information in this embodiment of the invention has the following beneficial effects: 1. By using rules and intelligent judgment based on network connection status, the accuracy and coverage of monitoring target identification are significantly improved, and two types of abnormal information, namely monitoring omissions and zombie monitoring, are accurately identified.

[0043] 2. The monitoring anomaly information obtained from the two-way comparison includes key information such as hostname, IP, anomaly type, and component category. It can be directly connected to the operation and maintenance management process, laying the foundation for closed-loop management of subsequent anomaly handling and fundamentally preventing the problem from being shelved.

[0044] 3. A port service importance judgment logic based on network connection status was designed: It innovatively proposes not only to check the port listening status, but also to further analyze its network status, which serves as the key basis for judging whether the port carries real service traffic and needs to be monitored, greatly improving the accuracy of the judgment.

[0045] This invention also provides a device for identifying abnormal monitoring information, as described in the following embodiments. Since the principle behind this device is similar to that of the method for identifying abnormal monitoring information, the implementation of this device can refer to the implementation of the method for identifying abnormal monitoring information; repeated details will not be elaborated further.

[0046] Figure 5 This is a structural example diagram of the identification device for monitoring abnormal information in an embodiment of the present invention, as shown below. Figure 5As shown, the device for identifying abnormal monitoring information includes: The data acquisition module 501 is used to acquire host operating data and monitoring configuration information; the host operating data includes process information, port information and port network connection status information; the monitoring configuration information includes associated host information and monitoring identifier of the process to be monitored and the port to be monitored. The matching module 502 is used to obtain actual monitoring information based on host operation data through a feature rule base. The actual monitoring information includes the associated host information and monitoring identifier of the actual monitored process and port. The feature rule base is a database built based on historical monitoring data. The feature rule base includes a process identification rule set and a port identification rule set. The process identification rule set is used to match the actual monitored application processes and basic component processes. The port identification rule set includes standard port identification rules and identification rules based on network connection status. The monitoring anomaly identification module 503 is used to compare the actual monitoring information with the monitoring configuration information to obtain monitoring anomaly information; the monitoring anomaly information includes monitoring omission information and zombie monitoring information.

[0047] In one embodiment, the matching module 502 is specifically used for: By matching process information with process identification rule sets in the feature rule base, the actual monitored application processes and basic component processes are selected as the actual monitored processes. By matching port information and port network connection status information using the port identification rule set in the feature rule base, the actual monitored ports are selected.

[0048] In one embodiment, the monitoring anomaly identification module 503 is specifically used for: Iterate through each piece of data in the actual monitoring information to obtain the monitoring type, monitoring identifier, and associated host information corresponding to each piece of data; Based on the obtained monitoring type, monitoring identifier, and associated host information, a matching query is performed in the monitoring configuration information to determine whether there is monitoring configuration information for the same host, the same type, and the same monitoring identifier. If the query result is not found, mark the data as a monitoring omission.

[0049] In one embodiment, the monitoring anomaly identification module 503 is specifically used for: Iterate through each data item in the monitoring configuration information to obtain the monitoring type, monitoring identifier, and associated host information corresponding to each data item; Based on the acquired monitoring type, monitoring identifier, and associated host information, a consistency query is performed on the actual monitoring information to determine whether the data actually exists on the corresponding host and meets the monitoring conditions. If the query result is non-existent, or exists but does not meet the monitoring judgment rules in the feature rule base, the data item will be marked as zombie monitoring information.

[0050] Figure 6 This is a specific example diagram of the structure of the identification device for monitoring abnormal information in an embodiment of the present invention, as shown below. Figure 6 As shown in one embodiment, Figure 5 The device for identifying abnormal information in the embodiment of the present invention shown may further include: a processing module 601.

[0051] In one embodiment, the processing module 601 is specifically used for: An action plan is generated based on the abnormal monitoring information, and the abnormal monitoring information is then processed based on the action plan.

[0052] Figure 7 This is a specific example diagram of the structure of the identification device for monitoring abnormal information in an embodiment of the present invention, as shown below. Figure 7 As shown in one embodiment, Figure 5 The device for identifying abnormal information in the embodiment of the present invention shown may further include: an update module 701.

[0053] In one embodiment, the update module 701 is specifically used for: Reacquire host operation data and monitoring configuration information, and obtain updated actual monitoring information by matching with the feature rule base; Compare the updated actual monitoring information with the updated monitoring configuration information to verify whether the anomaly has been eliminated.

[0054] Based on the aforementioned inventive concept, such as Figure 8 As shown, the present invention also proposes a computer device 800, including a memory 810, a processor 820, and a computer program 830 stored in the memory 810 and executable on the processor 820. When the processor 820 executes the computer program 830, it implements the aforementioned method for determining the injection-production relationship of carbonate rock fractured reservoirs.

[0055] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-described method for identifying monitoring anomaly information.

[0056] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-mentioned method for identifying abnormal monitoring information.

[0057] In this embodiment of the invention, host operating data and monitoring configuration information are acquired. The host operating data includes process information, port information, and port network connection status information. The monitoring configuration information includes associated host information and monitoring identifiers for the processes and ports to be monitored. Based on the host operating data, actual monitoring information is obtained through matching with a feature rule base. The actual monitoring information includes associated host information and monitoring identifiers for the actual monitored processes and ports. The feature rule base is a database built based on historical monitoring data. The feature rule base includes a process identification rule set and a port identification rule set. The process identification rule set is used to match the application processes and basic component processes being monitored. The port identification rule set includes standard port identification rules and identification rules based on network connection status. The actual monitoring information is compared with the monitoring configuration information to obtain monitoring anomaly information. The monitoring anomaly information includes monitoring omission information and zombie monitoring information. This embodiment of the invention achieves process and port monitoring checks by matching and identifying actual monitoring targets and comparing and verifying monitoring information, improving the management efficiency of monitoring configuration, effectively identifying monitoring anomalies, and reducing the existence of monitoring blind spots and invalid monitoring.

[0058] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0059] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0060] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0061] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0062] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for identifying abnormal monitoring information, characterized in that, include: Obtain host operating data and monitoring configuration information; The host operating data includes process information, port information, and port network connection status information; The monitoring configuration information includes the associated host information and monitoring identifier of the process and port to be monitored; Based on host operation data, actual monitoring information is obtained through matching with a feature rule base; the actual monitoring information includes: associated host information and monitoring identifier of the actual monitoring process and the actual monitoring port; The feature rule base is a database built based on historical monitoring data; The feature rule base includes a process identification rule set and a port identification rule set; the process identification rule set is used to match the application processes and basic component processes actually being monitored. The port identification rule set includes standard port identification rules and identification rules based on network connection status; The actual monitoring information is compared with the monitoring configuration information to obtain monitoring anomaly information; the monitoring anomaly information includes monitoring omission information and zombie monitoring information.

2. The method as described in claim 1, characterized in that, Based on host operation data, actual monitoring information is obtained through matching using a feature rule base, including: By matching process information with process identification rule sets in the feature rule base, the actual monitored application processes and basic component processes are selected as the actual monitored processes. By matching port information and port network connection status information using the port identification rule set in the feature rule base, the actual monitored ports are selected.

3. The method as described in claim 1, characterized in that, By comparing the actual monitoring information with the monitoring configuration information, abnormal monitoring information is obtained, including: Identifying missed monitoring information through forward comparison, including: Iterate through each piece of data in the actual monitoring information to obtain the monitoring type, monitoring identifier, and associated host information corresponding to each piece of data; Based on the obtained monitoring type, monitoring identifier, and associated host information, a matching query is performed in the monitoring configuration information to determine whether there is monitoring configuration information for the same host, the same type, and the same monitoring identifier. If the query result is not found, mark the data as a monitoring omission.

4. The method as described in claim 1, characterized in that, By comparing the actual monitoring information with the monitoring configuration information, abnormal monitoring information is obtained, including: Zombie surveillance information is identified through reverse comparison, including: Iterate through each data item in the monitoring configuration information to obtain the monitoring type, monitoring identifier, and associated host information corresponding to each data item; Based on the acquired monitoring type, monitoring identifier, and associated host information, a consistency query is performed on the actual monitoring information to determine whether the data actually exists on the corresponding host and meets the monitoring conditions. If the query result is non-existent, or exists but does not meet the monitoring judgment rules in the feature rule base, the data item will be marked as zombie monitoring information.

5. The method as described in claim 1, characterized in that, After comparing the actual monitoring information with the monitoring configuration information to obtain monitoring anomaly information, the following are included: An action plan is generated based on the abnormal monitoring information, and the abnormal monitoring information is then processed based on the action plan.

6. The method as described in claim 1, characterized in that, After comparing the actual monitoring information with the monitoring configuration information to obtain monitoring anomaly information, the following are included: Reacquire host operation data and monitoring configuration information, and obtain updated actual monitoring information by matching with the feature rule base; Compare the updated actual monitoring information with the updated monitoring configuration information to verify whether the anomaly has been eliminated.

7. A device for identifying abnormal information during monitoring, characterized in that, include: The data acquisition module is used to acquire host operating data and monitoring configuration information; The host operating data includes process information, port information, and port network connection status information; The monitoring configuration information includes the associated host information and monitoring identifier of the process and port to be monitored; The matching module is used to obtain actual monitoring information based on host operation data and through a feature rule base; the actual monitoring information includes: associated host information and monitoring identifier of the actual monitoring process and the actual monitoring port. The feature rule base is a database built based on historical monitoring data; The feature rule base includes a process identification rule set and a port identification rule set; the process identification rule set is used to match the application processes and basic component processes actually being monitored. The port identification rule set includes standard port identification rules and identification rules based on network connection status; The monitoring anomaly identification module is used to compare the actual monitoring information with the monitoring configuration information to obtain monitoring anomaly information; the monitoring anomaly information includes monitoring omission information and zombie monitoring information.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method of any one of claims 1-6.

Images