Method, electronic device, program, and storage medium for classifying time series data

Abstract

Provided, according to one embodiment, may be a method comprising an operation of acquiring time series data generated over time in relation to a service by a plurality of monitoring targets, from the plurality of monitoring targets providing the service to a plurality of clients in response to a plurality of requests from the plurality of clients. The method may comprise an operation of classifying the time series data according to a combination of metadata of the time series data and allocating the classified time series data to a plurality of aggregators. The method may comprise an operation of transmitting the classified time series data to the plurality of aggregators to which the time series data has been allocated, in order to store the time series data in a time series database (TSDB). The method may comprise the operations of: learning, by a time series prediction model, patterns of the time series data allocated to each of the plurality of aggregators; and identifying, on the basis of the time series prediction model, a difference between a predicted amount and a measured amount per unit time of an amount of the time series data allocated to each of the plurality of aggregators, and providing an alert when the identified difference is out of a threshold range.

Description

Method, electronic device, program, and storage medium for classifying time series data

[0001] The present disclosure relates to a method, electronic device, program, and storage medium for classifying time series data.

[0002] As the volume of data processed by servers and the complexity of functions increase, monitoring systems are being used to collect various metric data from multiple servers and to analyze the collected metric data.

[0003] Metric data can be stored in a time series database (TSDB) as time series data, and through the time series database, users of the monitoring system can check changes in the server's status or prepare for potential failures by identifying trends in data changes over time. Time series data can be collected and processed in a distributed environment to monitor server applications that generate a large amount of traffic.

[0004] As the volume of data processed by IoT (Internet of Things) devices and the complexity of their functions increase, the amount of data processed by IoT hubs that collect such data (e.g., sensing data) from multiple IoT devices increases, and the resources required by monitoring systems that collect and analyze data from multiple IoT hubs increase exponentially.

[0005] The information described above may be provided as related art for the purpose of aiding understanding of the present disclosure. No claim or determination is made as to whether any of the foregoing may be applied as prior art in relation to the present disclosure.

[0006] According to one embodiment, a method may be provided comprising the operation of obtaining time series data generated over time in relation to said service by a plurality of monitoring targets from a plurality of monitoring targets that provide services to said clients in response to a plurality of requests from a plurality of clients. The method may include the operation of classifying said time series data according to a combination of metadata of said time series data and assigning it to a plurality of aggregators. The method may include the operation of transmitting said classified time series data to said assigned aggregators in order to store said time series data in a time series database (TSDB).

[0007] According to one embodiment, an electronic device may be provided comprising one or more processors including a memory for storing instructions and processing circuitry. When the instructions are executed individually or collectively by the one or more processors, the electronic device may obtain time series data generated over time in relation to said service from a plurality of monitoring targets that provide services to said clients in response to a plurality of requests from said clients. When the instructions are executed individually or collectively by the one or more processors, the electronic device may classify said time series data according to a combination of metadata of said time series data and assign it to a plurality of aggregators. When the instructions are executed individually or collectively by the one or more processors, the electronic device may transmit said classified time series data to said assigned aggregators in order to store said time series data in a time series database (TSDB).

[0008] A computer-readable non-transitory recording medium according to one embodiment of the present invention may store at least one instruction and / or instruction that causes an electronic device to perform the method or operation of the electronic device described above when executed.

[0009] In relation to the description of the drawings, the same or similar reference numerals may be used for identical or similar components.

[0010] FIG. 1 is a block diagram of an electronic device according to one embodiment.

[0011] Figure 2 is a diagram illustrating a method for collecting time-series data from multiple application servers.

[0012] Figure 3 is a diagram illustrating a method for collecting time-series data from multiple application servers using multiple aggregators.

[0013] FIG. 4 is a flowchart of a method for classifying time series data according to one embodiment.

[0014] FIG. 5 is a diagram illustrating a method for classifying time series data according to one embodiment and assigning the classified time series data to a plurality of aggregators.

[0015] FIG. 6 is a flowchart of a method using a metadata database (DB) to classify time series data according to one embodiment.

[0016] FIG. 7 is a diagram illustrating a method for providing an alert in the process of classifying time series data according to one embodiment and assigning the classified time series data to a plurality of aggregators.

[0017] FIG. 8 is a flowchart of a method for providing an alarm using a time series prediction model according to one embodiment.

[0018] Embodiments of the present disclosure are described below in detail with reference to the attached drawings so that those skilled in the art can easily implement them. However, the present disclosure may be embodied in various different forms and is not limited to the embodiments described herein. Furthermore, in order to clearly explain the present disclosure in the drawings, parts unrelated to the explanation have been omitted, and similar parts throughout the specification are denoted by similar reference numerals.

[0019] The terms used in this disclosure are described in their current, general form considering the functions mentioned herein; however, they may refer to various other terms depending on the intent of those skilled in the art, case law, or the emergence of new technologies. Accordingly, the terms used in this disclosure should not be interpreted solely by their names, but should be interpreted based on the meaning of the terms and the overall content of this disclosure.

[0020] Additionally, terms such as the first, second, third, ..., Nth may be used to describe various components, but the components should not be limited by these terms. These terms are used for the purpose of distinguishing one component from another.

[0021] Throughout the specification, when a part is described as being "connected" to another part, this includes not only cases where they are "directly connected," but also cases where they are "electrically connected" with other components interposed between them. Furthermore, when a part is described as "including" a certain component, this means that, unless specifically stated otherwise, it does not exclude other components but may include additional components.

[0022] Phrases such as "in one embodiment" appearing in various places in this disclosure do not necessarily refer to the same embodiment.

[0023] One embodiment of the present disclosure may be represented by functional block configurations and various processing steps. Some or all of these functional blocks may be implemented by various numbers of hardware and / or software configurations that execute specific functions. For example, the functional blocks of the present disclosure may be implemented by one or more microprocessors or by circuit configurations for a specific function. Additionally, for example, the functional blocks of the present disclosure may be implemented in various programming or scripting languages. The functional blocks may be implemented as algorithms executed on one or more processors. Furthermore, the present disclosure may employ prior art for electronic configuration, signal processing, and / or data processing. Terms such as "mechanism," "element," "means," and "configuration" may be used broadly and are not limited to mechanical and physical configurations.

[0024] Furthermore, the connecting lines or connecting members between the components depicted in the drawings are merely illustrative of functional connections and / or physical or circuit connections. In the actual device, connections between components may be represented by various alternative or added functional connections, physical connections, or circuit connections.

[0025] Time series data comprises multiple records that are generated over time and stored as a time series through pairs of generated time and one or more values. A single record may consist of a key and a value. The key may include, but is not limited to, a metric name, a tag or label, and a timestamp. The metric name represents the name of the subject being collected; for example, the metric name may include "http_requests_total" representing the metric HTTP request volume. Tags or labels represent additional information about the metric; for example, HTTP request volume may be further specified by labels or tags such as HTTP status code and HTTP method. The timestamp represents the time the record was generated. The value of the record represents the value of the metric generated at a specific time period with a specific tag (or label); for example, it may represent the value of HTTP request volume generated at a specific time period with a specific HTTP status code and a specific HTTP method.

[0026] Metadata of time series data may consist of tags (e.g., status codes) and tag values ​​(e.g., 200, 400). Combinations of metadata may include combinations of a first value of a first tag and a second value of a second tag. For example, if the time series data relates to a hypertext transfer protocol (HTTP) request from a client, the first tag may be a status code and the second tag may be an HTTP method, but are not limited thereto. For example, if the time series data relates to a message queuing telemetry transport (MQTT) request from IoT devices, the first tag may be the state of the device and the second tag may be a control packet type, but are not limited thereto.

[0027] A time series database (TSDB) refers to a database that stores time series data. Time series data collected in a time series database can be referenced by a monitoring system, and users of the monitoring system (e.g., administrators) can check the status changes of the sources of time series data in real time or prepare for potential failures by identifying the trends in data changes over time. According to one embodiment, the sources of time series data, as entities that generated the time series data, may be targets of monitoring by the monitoring system. The monitoring target may be an application server, and the application server may generate time series data related to services provided to multiple clients, but is not limited thereto. For example, the monitoring target may be an IoT hub that communicates with multiple IoT devices to generate time series data. Products such as Prometheus or InfluxDB may be used as the time series database, but are not limited thereto.

[0028] Cardinality represents the number of unique values ​​within a specific time interval in a time-series database. Whether time-series data has unique values ​​is determined by the combination of values ​​of labels or tags assigned to the time-series data. In other words, the cardinality of time-series data can be defined by the number of possible combinations of each tag. For example, if time-series data is collected with tags of two HTTP status codes (e.g., 200 and 400) and two HTTP methods (e.g., GET and POST), the cardinality of the collected time-series data can have a maximum value of 4. Furthermore, if time-series data is collected from 10 servers, and each of the 10 servers has a unique identifier (e.g., server_1, server_2, ..., server_10), the cardinality of the collected time-series data can have a maximum value of 40. In other words, cardinality can increase when new labels (or tags) are added to time series data, or when unique values ​​are added to existing labels (or tags).

[0029] The present disclosure will be described in detail below with reference to the attached drawings.

[0030] FIG. 1 is a block diagram of an electronic device (101) in a network environment (100) according to various embodiments.

[0031] Referring to FIG. 1, in a network environment (100), an electronic device (101) may communicate with an electronic device (102) through a first network (198) (e.g., a short-range wireless communication network) or with an electronic device (104) or a server (108) through a second network (199) (e.g., a long-range wireless communication network). According to one embodiment, the electronic device (101) may communicate with the electronic device (104) through a server (108). According to one embodiment, the electronic device (101) may include a processor (120), memory (130), input module (150), sound output module (155), display module (160), audio module (170), sensor module (176), interface (177), connection terminal (178), haptic module (179), camera module (180), power management module (188), battery (189), communication module (190), subscriber identification module (196), or antenna module (197). In some embodiments, at least one of these components (e.g., connection terminal (178)) may be omitted from the electronic device (101), or one or more other components may be added. In some embodiments, some of these components (e.g., sensor module (176), camera module (180), or antenna module (197)) may be integrated into a single component (e.g., display module (160)).

[0032] The processor (120) can control at least one other component (e.g., a hardware or software component) of the electronic device (101) connected to the processor (120) by executing software (e.g., a program (140)), and can perform various data processing or operations. According to one embodiment, as at least part of the data processing or operations, the processor (120) can store commands or data received from other components (e.g., a sensor module (176) or a communication module (190)) in volatile memory (132), process the commands or data stored in volatile memory (132), and store the resulting data in non-volatile memory (134). According to one embodiment, the processor (120) may include a main processor (121) (e.g., a central processing unit or an application processor) or an auxiliary processor (123) that can operate independently or together with it (e.g., a graphics processing unit, a neural processing unit (NPU), an image signal processor, a sensor hub processor, or a communication processor). For example, if the electronic device (101) includes a main processor (121) and an auxiliary processor (123), the auxiliary processor (123) may be configured to use lower power than the main processor (121) or to be specialized for a designated function. The auxiliary processor (123) may be implemented separately from the main processor (121) or as part thereof.

[0033] The auxiliary processor (123) may control at least some of the functions or states associated with at least one component of the electronic device (101) (e.g., display module (160), sensor module (176), or communication module (190)) on behalf of the main processor (121) while the main processor (121) is in an inactive (e.g., sleep) state, or together with the main processor (121) while the main processor (121) is in an active (e.g., application execution) state. According to one embodiment, the auxiliary processor (123) (e.g., image signal processor or communication processor) may be implemented as part of another functionally related component (e.g., camera module (180) or communication module (190)). According to one embodiment, the auxiliary processor (123) (e.g., neural network processing unit) may include a hardware structure specialized for processing an artificial intelligence model. The artificial intelligence model may be generated through machine learning. Such learning may be performed, for example, on the electronic device (101) itself where the artificial intelligence is performed, or through a separate server (e.g., server (108)). The learning algorithm may include, for example, supervised learning, unsupervised learning, semi-supervised learning, or reinforcement learning, but is not limited to the examples described above. The artificial intelligence model may include a plurality of artificial neural network layers.An artificial neural network may be a deep neural network (DNN), a convolutional neural network (CNN), a recurrent neural network (RNN), a restricted Boltzmann machine (RBM), a deep belief network (DBN), a bidirectional recurrent deep neural network (BRDNN), a deep Q-network, or a combination of two or more of the above, but is not limited to the examples described above. In addition to the hardware structure, the artificial intelligence model may include a software structure, either additionally or substantially.

[0034] The number of processors (120) may be one or more. For example, the processor (120) may have the structure of a multi-core processor such as a dual core, a quad core, or a hexa core.

[0035] The processor (120) can control the operations of the electronic device (101) by executing instructions stored in memory (130). For example, the processor (120) may correspond to a plurality of processors that divide and collectively perform a plurality of operations among the processors.

[0036] The memory (130) can store various data used by at least one component of the electronic device (101) (e.g., processor (120) or sensor module (176)). The data may include, for example, input data or output data for software (e.g., program (140)) and related commands. The memory (130) may include volatile memory (132) or non-volatile memory (134).

[0037] The program (140) may be stored as software in memory (130) and may include, for example, an operating system (142), middleware (144), or an application (146).

[0038] The input module (150) can receive commands or data to be used for a component of the electronic device (101) (e.g., processor (120)) from outside the electronic device (101) (e.g., user). The input module (150) may include, for example, a microphone, a mouse, a keyboard, a key (e.g., a button), or a digital pen (e.g., a stylus pen).

[0039] The sound output module (155) can output a sound signal to the outside of the electronic device (101). The sound output module (155) may include, for example, a speaker or a receiver. The speaker may be used for general purposes, such as multimedia playback or recording playback. The receiver may be used to receive incoming calls. According to one embodiment, the receiver may be implemented separately from the speaker or as part thereof.

[0040] The display module (160) can visually provide information to an external (e.g., user) of the electronic device (101). The display module (160) may include, for example, a display, a holographic device, or a projector and a control circuit for controlling said device. According to one embodiment, the display module (160) may include a touch sensor configured to detect a touch, or a pressure sensor configured to measure the intensity of the force generated by said touch.

[0041] The audio module (170) can convert sound into an electrical signal or, conversely, convert an electrical signal into sound. According to one embodiment, the audio module (170) can acquire sound through the input module (150) or output sound through the sound output module (155) or an external electronic device (e.g., electronic device (102)) (e.g., speaker or headphones) connected directly or wirelessly to the electronic device (101).

[0042] The sensor module (176) can detect the operating state of the electronic device (101) (e.g., power or temperature) or the external environmental state (e.g., user state) and generate an electrical signal or data value corresponding to the detected state. According to one embodiment, the sensor module (176) may include, for example, a gesture sensor, a gyroscope sensor, a barometric pressure sensor, a magnetic sensor, an accelerometer sensor, a grip sensor, a proximity sensor, a color sensor, an IR (infrared) sensor, a biosensor, a temperature sensor, a humidity sensor, or an illuminance sensor.

[0043] The interface (177) may support one or more specified protocols that can be used for the electronic device (101) to be connected directly or wirelessly to an external electronic device (e.g., electronic device (102)). According to one embodiment, the interface (177) may include, for example, a high definition multimedia interface (HDMI), a universal serial bus (USB) interface, an SD card interface, or an audio interface.

[0044] The connection terminal (178) may include a connector through which the electronic device (101) can be physically connected to an external electronic device (e.g., electronic device (102)). According to one embodiment, the connection terminal (178) may include, for example, an HDMI connector, a USB connector, an SD card connector, or an audio connector (e.g., a headphone connector).

[0045] The haptic module (179) can convert an electrical signal into a mechanical stimulus (e.g., vibration or movement) or an electrical stimulus that can be perceived by the user through tactile or kinesthetic senses. According to one embodiment, the haptic module (179) may include, for example, a motor, a piezoelectric element, or an electric stimulation device.

[0046] The camera module (180) can capture still images and video. According to one embodiment, the camera module (180) may include one or more lenses, image sensors, image signal processors, or flashes.

[0047] The power management module (188) can manage power supplied to the electronic device (101). According to one embodiment, the power management module (188) can be implemented, for example, as at least part of a power management integrated circuit (PMIC).

[0048] The battery (189) can supply power to at least one component of the electronic device (101). According to one embodiment, the battery (189) may include, for example, a non-rechargeable primary battery, a rechargeable secondary battery, or a fuel cell.

[0049] The communication module (190) can support the establishment of a direct (e.g., wired) communication channel or a wireless communication channel between an electronic device (101) and an external electronic device (e.g., electronic device (102), electronic device (104), or server (108)), and the performance of communication through the established communication channel. The communication module (190) may include one or more communication processors that operate independently of the processor (120) (e.g., application processor) and support direct (e.g., wired) communication or wireless communication. According to one embodiment, the communication module (190) may include a wireless communication module (192) (e.g., cellular communication module, short-range wireless communication module, or GNSS (global navigation satellite system) communication module) or a wired communication module (194) (e.g., LAN (local area network) communication module, or power line communication module). The corresponding communication module among these communication modules can communicate with an external electronic device (104) through a first network (198) (e.g., a short-range communication network such as Bluetooth, WiFi (wireless fidelity) direct, or IrDA (infrared data association)) or a second network (199) (e.g., a legacy cellular network, a 5G network, a next-generation communication network, the Internet, or a computer network (e.g., a LAN or WAN)). These various types of communication modules may be integrated into a single component (e.g., a single chip) or implemented as multiple separate components (e.g., multiple chips). The wireless communication module (192) can identify or authenticate the electronic device (101) within a communication network such as the first network (198) or the second network (199) using subscriber information (e.g., International Mobile Subscriber Identifier (IMSI)) stored in the subscriber identification module (196).

[0050] The wireless communication module (192) can support 5G networks and next-generation communication technologies following 4G networks, for example, new radio access technology. NR access technology can support high-speed transmission of high-capacity data (enhanced mobile broadband (eMBB)), minimization of terminal power and connection of multiple terminals (massive machine type communications (mMTC)), or high reliability and low latency (ultra-reliable and low-latency communications (URLLC)). The wireless communication module (192) can support a high-frequency band (e.g., mmWave band) to achieve a high data transmission rate, for example. The wireless communication module (192) can support various technologies for securing performance in the high-frequency band, such as beamforming, massive MIMO (multiple-input and multiple-output), full-dimensional MIMO (FD-MIMO), array antenna, analog beam-forming, or large-scale antenna. The wireless communication module (192) can support various requirements specified in the electronic device (101), external electronic device (e.g., electronic device (104)), or network system (e.g., second network (199)). According to one embodiment, the wireless communication module (192) may support a Peak data rate (e.g., 20 Gbps or more) for eMBB realization, loss coverage (e.g., 164 dB or less) for mMTC realization, or U-plane latency (e.g., downlink (DL) and uplink (UL) each 0.5 ms or less, or round trip 1 ms or less) for URLLC realization.

[0051] An antenna module (197) can transmit a signal or power to or from an external source (e.g., an external electronic device). According to one embodiment, the antenna module (197) may include an antenna comprising a radiator made of a conductor or a conductive pattern formed on a substrate (e.g., a PCB). According to one embodiment, the antenna module (197) may include a plurality of antennas (e.g., an array antenna). In this case, at least one antenna suitable for a communication method used in a communication network, such as a first network (198) or a second network (199), may be selected from the plurality of antennas, for example, by a communication module (190). A signal or power may be transmitted or received between the communication module (190) and an external electronic device through the selected at least one antenna. According to some embodiments, in addition to the radiator, other components (e.g., a radio frequency integrated circuit (RFIC)) may be additionally formed as part of the antenna module (197).

[0052] According to various embodiments, the antenna module (197) may form a mmWave antenna module. According to one embodiment, the mmWave antenna module may include a printed circuit board, an RFIC disposed on or adjacent to a first surface (e.g., bottom surface) of the printed circuit board and capable of supporting a specified high frequency band (e.g., mmWave band), and a plurality of antennas (e.g., array antennas) disposed on or adjacent to a second surface (e.g., top surface or side surface) of the printed circuit board and capable of transmitting or receiving a signal of the specified high frequency band.

[0053] At least some of the above components can be connected to each other via a communication method between peripheral devices (e.g., bus, GPIO (general purpose input and output), SPI (serial peripheral interface), or MIPI (mobile industry processor interface)) and exchange signals (e.g., commands or data) with each other.

[0054] According to one embodiment, commands or data may be transmitted or received between an electronic device (101) and an external electronic device (104) through a server (108) connected to a second network (199). Each of the external electronic devices (102, or 104) may be the same or a different type of device as the electronic device (101). According to one embodiment, all or part of the operations performed on the electronic device (101) may be performed on one or more of the external electronic devices (102, 104, or 108). For example, if the electronic device (101) needs to perform a function or service automatically or in response to a request from a user or another device, the electronic device (101) may request one or more external electronic devices to perform at least part of the function or service instead of performing the function or service itself or additionally. One or more external electronic devices that receive the above request may execute at least part of the requested function or service, or additional function or service related to the request, and transmit the result of the execution to the electronic device (101). The electronic device (101) may provide the result as is or additionally processed as at least part of the response to the request. For this purpose, for example, cloud computing, distributed computing, mobile edge computing (MEC), or client-server computing technology may be used. The electronic device (101) may provide ultra-low latency services using, for example, distributed computing or mobile edge computing. In one embodiment, the external electronic device (104) may include an Internet of Things (IoT) device. The server (108) may be an intelligent server using machine learning and / or neural networks. According to one embodiment, the external electronic device (104) or the server (108) may be included within a second network (199).The electronic device (101) can be applied to intelligent services (e.g., smart home, smart city, smart car, or healthcare) based on 5G communication technology and IoT-related technology.

[0055] An electronic device (101) according to one embodiment can function as a server and can correspond to a data distributor of FIGS. 2 to 8 (e.g., data distributor (420) of FIG. 4, data distributor (720) of FIG. 7), and the electronic device (101) can perform the operations of a data distributor (e.g., data distributor (420) of FIG. 4, data distributor (720) of FIG. 7) in FIGS. 2 to 8.

[0056] According to one embodiment, the electronic device (101) may include a memory (130) for storing instructions; and one or more processors (120) including processing circuitry. When the instructions are executed individually or collectively by the one or more processors, they may cause the electronic device (101) to obtain time series data generated over time in relation to said services from a plurality of monitoring targets that provide services to said clients in response to a plurality of requests from said clients. When the instructions are executed individually or collectively by the one or more processors, they may cause the electronic device (101) to classify said time series data according to a combination of metadata of said time series data and assign it to a plurality of aggregators (330, 530, 730). When the above instructions are executed individually or jointly by the one or more processors, they may cause the classified time series data to be transmitted to the assigned multiple aggregators (330, 530, 730) in order to store the time series data in a time series database (TSDB) (340, 540, 740).

[0057] According to one embodiment, the metadata may include a plurality of tags and a plurality of values ​​of the plurality of tags. The combination may include a combination of a first value of a first tag and a second value of a second tag.

[0058] According to one embodiment, the monitoring target may include an application server (310, 510, 710). The plurality of tags may include HTTP (hypertext transfer protocol) status codes and HTTP methods of the plurality of requests.

[0059] According to one embodiment, the plurality of tags may further include the API (application programming interface) name, service name, and application identifier (ID) of the plurality of requests.

[0060] According to one embodiment, the monitoring target may include an IoT (Internet of Things) hub. The plurality of clients may include a plurality of IoT devices. The plurality of tags may include the status of the IoT device and the type of control packet.

[0061] According to one embodiment, the electronic device may be included in a plurality of data distributors (520, 720). Destination information (524, 724) representing the combination of the metadata and the aggregator corresponding to the combination may be stored in a metadata database (522, 722) connected to the plurality of data distributors (520, 720).

[0062] According to one embodiment, when the instructions are executed individually or jointly by one or more processors, the electronic device may be configured to refer to the destination information (524, 724) through the metadata database (522, 722) to classify the time series data and assign it to the plurality of aggregators (330, 530, 730).

[0063] According to one embodiment, the monitoring target may publish the time series data. The plurality of data distributors may subscribe to the time series data. When the instructions are executed individually or jointly by the one or more processors, the electronic device may be enabled to acquire the time series data from the plurality of monitoring targets in a push or pull manner by subscribing to the time series data published by the monitoring target.

[0064] According to one embodiment, when the instructions are executed individually or jointly by the one or more processors, the electronic device may identify the amount of time-series data assigned to each of the plurality of aggregators (330, 530, 730). When the instructions are executed individually or jointly by the one or more processors, the electronic device may generate an alarm based on the identified amount exceeding a threshold range.

[0065] According to one embodiment, when the instructions are executed individually or jointly by the one or more processors, the electronic device may determine the predicted amount of the amount of time series data per unit time allocated to each of the plurality of aggregators (330, 530, 730) using a time series prediction model. When the instructions are executed individually or jointly by the one or more processors, the electronic device may determine the threshold range based on the predicted amount and the identified amount; and provide the alarm to a monitoring server (250, 350, 550, 750) that monitors the TSDB.

[0066] According to one embodiment, when the instructions are executed individually or jointly by the one or more processors, the electronic device may learn the pattern of the time series data assigned to each of the plurality of aggregators (330, 530, 730) by a time series prediction model. When the instructions are executed individually or jointly by the one or more processors, the electronic device may identify the difference between the predicted amount and the measured amount of the time series data assigned to each of the plurality of aggregators (330, 530, 730) per unit time based on the time series prediction model, and provide an alarm if the identified difference exceeds a threshold range.

[0067] Figure 2 is a diagram illustrating a method for collecting time-series data from multiple application servers.

[0068] Storing all raw data generated by application servers (210) in a time series database (220) can waste storage because the size of the data generated over time increases exponentially. Furthermore, since processing high-resolution time series data requires more resources than processing low-resolution time series data, it can increase the load on the system. Accordingly, by using aggregated time series data instead of raw data, the load on the system can be reduced and storage can be saved. For example, as shown in FIG. 2, multiple application servers (210) can aggregate the generated time series data and store the aggregated time series data directly in a time series database (240), and a monitoring system (250) can monitor the application servers (210) through the time series database (240).

[0069] Time series data comprises multiple records generated over time and stored as a time series through pairs of generated times and one or more values. A single record may consist of a key and a value. The key may include, but is not limited to, a metric name, a tag or label, and a timestamp. The metric name represents the name of the subject of collection; for example, referring to the first column of Table 1, the metric name may include "http_requests_total," representing the metric HTTP request volume. Referring to the second column of Table 1, the tag or label represents additional information about the metric; for example, HTTP request volume may be further specified by a label or tag such as an HTTP status code (referring to Table 1, "200" or "400") and an HTTP method (referring to Table 1, "GET" or "POST"). Referring to the third column of Table 1, the timestamp represents the time the record was generated. Referring to the fourth column of Table 1, the value of the record represents the value of an indicator generated at a specific time period with a specific tag (or label), for example, the value of the volume of HTTP requests generated at a specific time period with a specific HTTP status code and a specific HTTP method.

[0070]

[0071] Referring to the first record in Table 1, it can be seen that the HTTP request volume in the time zone @1434317560938 corresponds to "94355". Referring to Table 1, the timestamps of the first, fourth, seventh, and tenth records are @1434317560xxx, so these records can be grouped into the same unit of time. Referring to Table 1, the timestamps of the second, fifth, and eighth records are @1434317561xxx, so these records can be grouped into the same unit of time. Referring to Table 1, the timestamps of the third, sixth, and ninth records are @1434317562xxx, so these records can be grouped into the same unit of time.

[0072] Referring to FIG. 2, eight application servers (210) can collect time-series data with the same tag (or label) over a unit of time (e.g., 1 second, 5 seconds, 15 seconds, 30 seconds, 1 minute, 5 minutes, 15 minutes, 30 minutes, or 1 hour), calculate the sum, average, minimum value, maximum value, or percentile, and store them in a time-series database (240). Since the eight application servers (210) are distributed, even records associated with the same timestamp (or the same unit of time) and having the same tag (or label) are distinguished from each other and stored in the time-series database (240) if the data is collected from different application servers (210). Accordingly, the cardinality defined by the HTTP state mode and HTTP method of the time series data in Table 1 can be calculated as 4 by the combination of 4 combinations: "200, GET", "200, POST", "400, GET", and "400, POST". Furthermore, the cardinality considering the number of application servers (210) is calculated as 32, which is the value obtained by multiplying 4 by 8, the number of application servers (210), and this increase in cardinality increases the size of the time series data.

[0073] Figure 3 is a diagram illustrating a method for collecting time-series data from multiple application servers using multiple aggregators.

[0074] As illustrated in FIG. 2, the method in which application servers (210) directly aggregate time-series data and store the aggregated time-series data in a time-series database (240) can increase cardinality according to the number of application servers (210). Accordingly, as illustrated in FIG. 3, time-series data generated by application servers (310) can be placed in a queue (312), the time-series data accumulated in the queue (312) can be aggregated by a separate aggregator (330), and the aggregated time-series data can be stored in a time-series database (340). The aggregator (330) may be an aggregation server. The aggregator (330) can aggregate time-series data by extracting the time-series data, transforming the extracted time-series data, and loading the transformed time-series data. Time-series data can represent a request volume (V) according to time (time; T). The monitoring system (350) can provide (e.g., display) time-series data stored in the time-series database (340) to a user (e.g., administrator), and the monitoring system (350) or the user of the monitoring system (350) can monitor the application servers (310) through the provided time-series data. For example, the monitoring system (350) or the user of the monitoring system (350) (e.g., administrator) can monitor the queue (312) and the aggregator (330) using the time-series data provided through the time-series database (340). A product such as Kafka may be used as the queue (312), but is not limited thereto.

[0075] Referring to FIG. 3, application servers (310) publish time series data, and an aggregator (330) can aggregate time series data by subscribing to the published time series data through a queue (312).

[0076] The method of aggregating time series data using an aggregator (330) has less cardinality compared to the method in which application servers (e.g., 210 in FIG. 2) directly aggregate time series data, but it is unavoidable that the cardinality increases as the number of aggregators (330) increases. This is because multiple aggregators (330) each aggregate time series data according to a combination of tags (or labels).

[0077] To prevent multiple aggregators (330) from aggregating time-series data according to a combination of tags (or labels), the aggregators (330) may be clustered, and the clustered aggregators (330) may be implemented to aggregate time-series data. To cluster the aggregators (330), products such as Apache Spark or Flink may be used, but are not limited thereto.

[0078] When clustering aggregators (330) using Apache Spark, the file system of Apache Spark is HDFS (Hadoop distributed file system), which uses more resources such as storage and memory compared to other file systems.

[0079] When clustering aggregators (330) using Flink and sorting records according to the value of a tag (or label), a lot of traffic is generated during the process of transferring data to be processed between aggregators (330).

[0080] Meanwhile, as illustrated in FIG. 3, when time series data is aggregated using an aggregator (330) and the aggregated time series data is stored in a time series database (340), the monitoring system (350) can detect abnormalities in the time series data through the time series database (340). For example, if the value of the time series data retrieved from the time series database (340) exceeds a preset threshold range, it can be determined that an abnormality has occurred in the retrieved time series data. For example, statistical analysis or machine learning can be performed on the time series data stored in the time series database (340), and the pattern of the time series data can be learned. Afterward, it can be determined that an abnormality has occurred in the observed time series data based on whether the subsequently observed time series data exceeds a specific threshold range. In both methods, since the abnormality is detected after the time series data is stored in the time series database (340), an alarm may be delayed compared to the time when the abnormality occurred in the actual application servers (310).

[0081] The method of FIG. 4 can be used to reduce the cardinality of time series data generated by application servers and to advance the timing of alarm occurrence.

[0082] FIG. 4 is a flowchart of a method for classifying time series data according to one embodiment.

[0083] In the following embodiments, each operation may be performed sequentially, but is not necessarily performed sequentially. For example, the order of each operation may be changed, and at least two operations may be performed in parallel.

[0084] According to one embodiment, operations 410, 420, 430, and 440 may be understood to be performed in a processor (not shown) of an electronic device (e.g., electronic device (101) of FIG. 1) or a data distributor (e.g., data distributor (520) of FIG. 5 or data distributor (720) of FIG. 7).

[0085] For convenience of explanation, refer further to Fig. 5.

[0086] FIG. 5 is a diagram illustrating a method for classifying time series data according to one embodiment and assigning the classified time series data to a plurality of aggregators.

[0087] Referring to FIG. 5, time series data generated by application servers (510) can be classified by a data distributor (520) and transmitted to an aggregator (530). The data distributor (520) may be a data distribution server (520), and the aggregator (530) may be an aggregation server (530). The aggregator (530) may aggregate the transmitted time series data and store it in a time series database (540). A monitoring system (550) may provide (e.g., display) the time series data stored in the time series database (540) to a user (e.g., administrator), and the monitoring system (550) or the user of the monitoring system (550) may monitor the application servers (510) through the provided time series data. For example, the monitoring system (550) or the user of the monitoring system (550) can monitor the data distributor (520) and the aggregator (540) using time series data provided to the user through the time series database (540).

[0088] Referring to FIG. 4, in operation 410, the data distributor (520) can obtain time-series data from application servers (510). According to one embodiment, the application servers (510) can provide a service to the client in response to a client's request, and the time-series data generated by the application servers (510) can be generated over time in relation to the provided service. The client's request may be an HTTP request, and the service provided to the client may be an application service or a web service, but is not limited thereto.

[0089] According to one embodiment, time series data may include a plurality of records stored as a time series through pairs of time of creation and one or more values. A single record may consist of a key and a value. The key may include, but is not limited to, a metric name, a tag or label, and a timestamp. The metric name represents the name of the subject of collection; for example, the metric name may include "http_requests_total" representing the metric HTTP request volume. The tag or label represents additional information about the metric; for example, HTTP request volume may be further specified by a label or tag such as an HTTP status code and an HTTP method. The timestamp represents the time when the record was created. The value of the record represents the value of the metric created at a specific time period with a specific tag (or label); for example, it may represent the value of HTTP request volume created at a specific time period with a specific HTTP status code and a specific HTTP method.

[0090] According to one embodiment, time series data is generated by application servers (510), and the generated time series data can be transmitted from the application servers (510) to a data distributor (520).

[0091] According to one embodiment, in operation 420, the data distributor (520) can classify the acquired time series data and assign it to the aggregator (530). The aggregator (530) may be composed of a plurality of aggregators (530), and for example, the data distributor (520) can classify the time series data according to a combination of metadata of the time series data and assign it to a plurality of aggregators (530). Destination information (524) indicating a combination of metadata and an aggregator (530) corresponding to the combination may be stored in a metadata database (522), and the data distributor (520) may refer to the destination information (524) stored in the metadata database (522) to classify the time series data according to the metadata combination and assign the classified time series data to the aggregator (530) corresponding to the metadata combination. According to one embodiment, the data distributor (520) may be composed of a plurality of data distributors (520), and the consistency of the classification and assignment operations may be maintained by the plurality of data distributors (520) referencing the metadata database (522).

[0092] Metadata of time series data may consist of tags (e.g., status codes) and tag values ​​(e.g., 200, 400). A combination of metadata may include a combination of a first value of a first tag and a second value of a second tag. According to one embodiment, if the time series data relates to a client's HTTP (hypertext transfer protocol) request, the first tag may be a status code and the second tag may be an HTTP method, but is not limited thereto. For example, the tag may include a third tag, and the third tag may be an API (application programming interface) name. For example, the tag may include a fourth tag, and the fourth tag may be the name of a provided service. For example, the tag may include a fifth tag, and the fifth tag may be an application identifier (ID). For example, the tag may include a sixth tag, and the sixth tag may be a host ID. The combination of metadata may include a combination of three or more tags, for example, a first value of a first tag, a second value of a second tag, and a third value of a third tag, and may include a greater number of combinations of tags. According to one embodiment, the value of the API name may include "restore", "backup", and "auth", and the value of the service name may have a value corresponding to the API name, but is not limited thereto, and may have different names depending on the service provided. The application ID is an ID of an application using the API or service, and may include an ID for identifying a specific application, such as "cloud", "health", "television", or "refrigerator". The host ID may include an ID for identifying the source of time-series data.

[0093] According to one embodiment, when time series data relates to a message queuing telemetry transport (MQTT) request of IoT devices, the first tag may be the state of the device and the second tag may be a type of control packet, but is not limited thereto.

[0094] Referring to FIG. 5, the first time series data, in which the value of the first tag is "200" and the value of the second tag is "GET", is assigned to the first aggregator (10.0.0.1); the second time series data, in which the value of the first tag is "200" and the value of the second tag is "POST", is assigned to the second aggregator (10.0.0.2); the third time series data, in which the value of the first tag is "400" and the value of the second tag is "GET", is assigned to the third aggregator (10.0.0.3); and the fourth time series data, in which the value of the first tag is "400" and the value of the second tag is "POST", can be assigned to the fourth aggregator (10.0.0.4). Although the first, second, third, and fourth time series data are aggregated by the first, second, third, and fourth aggregators respectively, they have unique values ​​from one another, so the cardinality is not increased. FIG. 5 shows four aggregaters (530) for convenience of explanation, but the number of aggregaters (530) may be fewer or more than this.

[0095] According to one embodiment, time series data is classified using a data distributor (520) and the classified time series data is assigned to aggregators (530). The aggregators (530) receive the assigned time series data and perform aggregation on the received time series data, thereby allowing time series data to be aggregated without an increase in unnecessary cardinality as described in FIGS. 1 and 2. According to one embodiment, since an increase in cardinality unexpected by the user is minimized, the load applied to the system is reduced and the processing speed of time series data can be improved. Furthermore, since there is no need to cluster the aggregators (530), resources such as storage or memory can be saved. Unlike a load balancer, the data distributor (520) can perform classification based on the actual tag (or label) value of the time series data.

[0096] According to one embodiment, in operation 430, the data distributor (520) can transmit classified time series data to the assigned aggregator (530). For example, the first time series data in which the value of the first tag is "200" and the value of the second tag is "GET" can be transmitted to the first aggregator (10.0.0.1), the second time series data in which the value of the first tag is "200" and the value of the second tag is "POST" can be transmitted to the second aggregator (10.0.0.2), the third time series data in which the value of the first tag is "400" and the value of the second tag is "GET" can be transmitted to the third aggregator (10.0.0.3), and the fourth time series data in which the value of the first tag is "400" and the value of the second tag is "POST" can be transmitted to the fourth aggregator (10.0.0.4).

[0097] According to one embodiment, a data distributor (520) can classify time-series data collected from the application server (510) in operation 420 between the application server (510) and the aggregator (530), assign the classified time-series data to the aggregator (530), and transmit the time-series data to the assigned aggregator (530) in operation 430. The data distributor (520) can classify time-series data according to a combination of metadata of the time-series data by referring to the metadata database (522), and the method of using the metadata database (522) will be described later with reference to FIG. 6.

[0098] According to one embodiment, time series data aggregated by the aggregator (530) in operation 440 may be stored in the time series database (540). The aggregator (530) may store the aggregated time series data in the time series database (540), but is not limited thereto. For example, the data distributor (520) may cause the aggregator (530) to store the aggregated time series data in the time series database (540).

[0099] According to one embodiment, a method may be provided comprising the operation of obtaining time series data generated over time in relation to the service by a plurality of monitoring targets from a plurality of monitoring targets that provide services to a plurality of clients in response to a plurality of requests from a plurality of clients. The method may include the operation of classifying the time series data according to a combination of metadata of the time series data and assigning it to a plurality of aggregators (330, 530, 730). The method may include the operation of transmitting the classified time series data to the assigned plurality of aggregators (330, 530, 730) in order to store the time series data in a time series database (TSDB) (340, 540, 740).

[0100] According to one embodiment, the metadata may include a plurality of tags and a plurality of values ​​of the plurality of tags. The combination may include a combination of a first value of a first tag and a second value of a second tag.

[0101] According to one embodiment, the monitoring target may include an application server (310, 510, 710). The plurality of tags may include HTTP (hypertext transfer protocol) status codes and HTTP methods of the plurality of requests.

[0102] According to one embodiment, the plurality of tags may further include the API (application programming interface) name, service name, and application identifier (ID) of the plurality of requests.

[0103] According to one embodiment, the monitoring target may include an IoT (Internet of Things) hub. The plurality of clients may include a plurality of IoT devices. The plurality of tags may include the status of the IoT device and the type of control packet.

[0104] According to one embodiment, the method may be performed by a plurality of data distributors (520, 720). Destination information (524, 724) representing the combination of the metadata and the aggregator corresponding to the combination may be stored in a metadata database (522, 722) connected to the plurality of data distributors (520, 720). The operation of classifying the time series data and assigning it to the plurality of aggregators (330, 530, 730) may include the operation of the plurality of data distributors (520, 720) referring to the destination information (524, 724) through the metadata database (522, 722) to classify the time series data and assign it to the plurality of aggregators (330, 530, 730).

[0105] According to one embodiment, the monitoring target may publish the time series data. The plurality of data distributors (520, 720) may subscribe to the time series data. The operation of acquiring the time series data may include the operation of the plurality of data distributors (520, 720) acquiring the time series data from the plurality of monitoring targets in a push or pull manner by subscribing to the time series data published by the monitoring target.

[0106] According to one embodiment, the method may further include: identifying the amount of time series data assigned to each of the plurality of aggregators (330, 530, 730); and generating an alarm based on the identified amount exceeding a threshold range.

[0107] According to one embodiment, the method may include an operation to determine a predicted amount of time series data per unit time allocated to each of the plurality of aggregators (330, 530, 730) using a time series prediction model. The method may include an operation to determine a threshold range based on the predicted amount and the identified amount.

[0108] According to one embodiment, the method may include the operation of providing the alarm to a monitoring server (250, 350, 550, 750) that monitors the TSDB.

[0109] According to one embodiment, the method may include an operation of learning the pattern of the time series data assigned to each of the plurality of aggregators (330, 530, 730) by a time series prediction model. Based on the time series prediction model, the method may include an operation of identifying the difference between the predicted amount and the measured amount of the time series data assigned to each of the plurality of aggregators (330, 530, 730) per unit time, and providing an alarm if the identified difference exceeds a threshold range.

[0110] FIG. 6 is a flowchart of a method using a metadata database (DB) to classify time series data according to one embodiment.

[0111] In the following embodiments, each operation may be performed sequentially, but is not necessarily performed sequentially. For example, the order of each operation may be changed, and at least two operations may be performed in parallel.

[0112] According to one embodiment, operations 622, 624, 625, 626, 626, and 628 may be understood to be performed in a processor (not shown) of an electronic device (e.g., electronic device (101) of FIG. 1) or a data distributor (e.g., data distributor (520) of FIG. 5 or data distributor (720) of FIG. 7).

[0113] Operations 410 and 430 of FIG. 6 are described above in FIG. 4, so a redundant description is omitted.

[0114] According to one embodiment, a data distributor (e.g., 520 in FIG. 5) may query a metadata database (DB) in operation 622 to classify time series data acquired in operation 410. The query to the metadata DB may be a query regarding whether a combination of metadata matching a combination of metadata of the acquired time series data exists in the metadata DB.

[0115] According to one embodiment, in operation 624, if it is determined that a combination of metadata matching a combination of metadata of acquired time series data exists in the metadata DB, the metadata DB may return destination information indicating the metadata combination and the corresponding destination, and in operation 628, the data distributor may assign an aggregator as illustrated in FIGS. 4 and 5 based on the returned destination information.

[0116] According to one embodiment, in operation 624, if it is determined that a combination of metadata matching the combination of metadata of the acquired time-series data does not exist in the metadata DB, in operation 625, the data distributor may determine an aggregator corresponding to the new metadata combination. According to one embodiment, the data distributor may determine an appropriate aggregator (e.g., the aggregator with the least load) based on the performance of the aggregators, remaining resources, or the amount of time-series data to be allocated. In operation 626, destination information indicating the new metadata combination and the corresponding aggregator may be stored in the metadata DB. In operation 628, the newly stored destination information may be returned by the metadata DB, and the data distributor may allocate an aggregator according to the returned destination information.

[0117] FIG. 7 is a diagram illustrating a method for providing an alert in the process of classifying time series data according to one embodiment and assigning the classified time series data to a plurality of aggregators.

[0118] Referring to FIG. 7, the application server (710), data distributor (720), metadata DB (722), aggregator (730), time series data DB (740), and monitoring system (750) can correspond to the application server (510), data distributor (520), metadata DB (522), aggregator (530), time series data DB (540), and monitoring system (550) of FIG. 5.

[0119] According to one embodiment, in the process of classifying time-series data obtained from an application server (710) and assigning the classified time-series data to an aggregator (730), statistics related to the time-series data may be calculated, and an alarm (760) may be provided if the calculated statistics fall outside a threshold range. The method of providing an alarm (760) using the data distributor (720) can detect anomalies before the time-series data is stored in the time-series database (740). That is, the method of providing an alarm (760) using the data distributor (720) can provide an alarm more immediately than the method of providing an alarm based on time-series data stored in the time-series database (740), thereby minimizing the mean time to detect (MTTD) of the monitoring system (750), and allowing a user (e.g., an administrator) to check the status changes of the servers (710) in real time or prepare more effectively for potential failures.

[0120] According to one embodiment, an alarm can be provided using a time series prediction model, which is explained with reference to FIG. 8.

[0121] FIG. 8 is a flowchart of a method for providing an alarm using a time series prediction model according to one embodiment.

[0122] In the following embodiments, each operation may be performed sequentially, but is not necessarily performed sequentially. For example, the order of each operation may be changed, and at least two operations may be performed in parallel.

[0123] According to one embodiment, operations 860, 861, 862, 863, 864, 865, 866, 867, and 868 may be understood to be performed in a processor (not shown) of an electronic device (e.g., electronic device (101) of FIG. 1) or a data distributor (e.g., data distributor (520) of FIG. 5 or data distributor (720) of FIG. 7).

[0124] Operations 420 and 430 of FIG. 8 are described above in FIG. 4, so a redundant description is omitted.

[0125] According to one embodiment, in operation 861, it may be determined whether it is necessary to perform current learning based on acquired time series data. For example, it may be determined whether the time of acquisition or generation of the time series data corresponds to a learning cycle. The learning cycle may be 1 day, 3 days, or 7 days, but is not limited thereto. The data distributor may perform learning at each learning cycle and may store the learning results in a local storage or in a storage accessible to multiple data distributors.

[0126] According to one embodiment, time series data can be governed by HTTP request volume.

[0127] In operation 861, if it is determined that the time point of acquisition or generation of the time series data does not correspond to a learning period, in operation 864, the data distributor may load a time series prediction model. The time series prediction model may be stored in the local storage of the data distributor or in a storage accessible to multiple data distributors.

[0128] According to one embodiment, the time series prediction model may be a model trained by performing pattern recognition of time series data or machine learning on time series data, such as an autoencoder, long short-term memory (LSTM), prophet, or ARIMA (autoregressive integrated moving average).

[0129] In operation 865, the data distributor can use a loaded time series forecasting model to determine the forecast amount (e.g., the predicted amount of HTTP requests) per unit of time (e.g., 1 day, 3 days, or 7 days). The unit of time can be calculated from the current point in time.

[0130] In operation 866, the data distributor can compare the predicted amount determined in operation 865 with the observed actual request amount (e.g., HTTP request amount).

[0131] In operation 867, the data distributor can determine whether the comparison result of operation 866 falls outside the threshold range. For example, the data distributor can determine whether the comparison result falls outside the threshold range based on the extreme studentized deviation (ESD) test. Referring to Equation 1, "residual" refers to the value obtained by subtracting the predicted value from the observed values ​​(e.g., HTTP request volume), "median" refers to the median of the observed values, and "MAD" refers to the median absolute deviation, which is the median of the values ​​obtained by subtracting the median from the observed values. If the value of "G" in Equation 1 falls outside the threshold range, the observed HTTP request volume may be determined to be in an abnormal range, and in operation 868, the data distributor may generate an alarm. According to one embodiment, the critical range may be a range outside the mean by two standard deviations (2σ) or three standard deviations (3σ) in a t-distribution or Student t-distribution, but is not limited thereto.

[0132]

[0133] According to one embodiment, in operation 861, if the time point of acquisition or generation of time series data is determined to correspond to a learning period, in operation 862, the amount of classified time series data allocated to each aggregator can be learned. That is, the data distributor can learn how much time series data is allocated to each aggregator. Thus, if the amount of time series data allocated to each aggregator differs from the usual pattern, it can be detected that an abnormal situation has occurred in the time series data (or the source of the time series data).

[0134] According to one embodiment, in operation 863, the data distributor can update the time series prediction model based on the learning results. According to one embodiment, in operation 864, the updated time series prediction model can be loaded by the data distributor, and the data distributor can periodically update the time series prediction model to detect abnormal situations occurring in the application server.

[0135] In FIGS. 1 to 8, the monitored target is described as an application server, but the monitored target is not limited thereto. For example, the monitored target may be an IoT hub connected to IoT devices. In this case, the time-series data obtained from the IoT hub relates to the MQTT (message queuing telemetry transport) requests of the IoT devices, and as metadata for the time-series data, the first tag may be the state of the device and the second tag may be the type of control packet, but is not limited thereto.

[0136] The technical problems to be solved in this disclosure are not limited to those mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art to which this disclosure pertains.

[0137] The effects obtainable from the present disclosure are not limited to those mentioned above, and other unmentioned effects will be clearly understood by those skilled in the art to which the present disclosure belongs.

[0138] The electronic device according to the various embodiments disclosed in this document may be of various forms. The electronic device may include, for example, a portable communication device (e.g., a smartphone), a computer device, a portable multimedia device, a portable medical device, a camera, a wearable device, or a consumer electronics device. The electronic device according to the embodiments of this document is not limited to the devices described above.

[0139] The various embodiments of this document and the terms used therein are not intended to limit the technical features described in this document to specific embodiments, and should be understood to include various modifications, equivalents, or substitutions of said embodiments. In connection with the description of the drawings, similar reference numerals may be used for similar or related components. The singular form of a noun corresponding to an item may include one or more of said items unless the relevant context clearly indicates otherwise. In this document, phrases such as "A or B," "at least one of A and B," "at least one of A or B," "A, B or C," "at least one of A, B and C," and "at least one of A, B, or C" may each include any one of the items listed together in the corresponding phrase, or all possible combinations thereof. Terms such as "first," "second," or "first" or "second" may be used simply to distinguish said components from other said components and do not limit said components in any other aspect (e.g., importance or order). Where any (e.g., 1st) component is referred to as “coupled” or “connected” to another (e.g., 2nd) component, with or without the terms “functionally” or “communicationly,” it means that said any component may be connected to said other component directly (e.g., via a wire), wirelessly, or through a third component.

[0140] The term “module” as used in the various embodiments of this document may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with terms such as logic, logic block, component, or circuit, for example. A module may be a component formed integrally, or a minimum unit of said component or a part thereof that performs one or more functions. For example, according to one embodiment, a module may be implemented in the form of an application-specific integrated circuit (ASIC).

[0141] Various embodiments of the present document may be implemented as software (e.g., program (140)) comprising one or more instructions stored in a storage medium (e.g., internal memory (136) or external memory (138)) readable by a machine (e.g., electronic device (101)). For example, a processor (e.g., processor (120)) of the machine (e.g., electronic device (101)) may call at least one of the one or more instructions stored in the storage medium and execute it. This enables the machine to be operated to perform at least one function according to the at least one called instruction. The one or more instructions may include code generated by a compiler or code that can be executed by an interpreter. The storage medium readable by the machine may be provided in the form of a non-transitory storage medium. Here, 'non-temporary' simply means that the storage medium is a tangible device and does not contain a signal (e.g., electromagnetic waves), and the term does not distinguish between cases where data is stored semi-permanently and cases where it is stored temporarily.

[0142] According to one embodiment, the method according to the various embodiments disclosed herein may be provided by being included in a computer program product. The computer program product may be traded between a seller and a buyer as a product. The computer program product may be distributed in the form of a device-readable storage medium (e.g., compact disc read-only memory (CD-ROM)) or an application store (e.g., Play Store). TM It can be distributed online (e.g., downloaded or uploaded) through ) or directly between two user devices (e.g., smartphones). In the case of online distribution, at least a portion of the computer program product may be temporarily stored or temporarily created on a device-readable storage medium, such as the memory of a manufacturer's server, an application store's server, or a relay server.

[0143] According to various embodiments, each component (e.g., module or program) of the components described above may include a singular or multiple entities, and some of the multiple entities may be separated and placed in other components. According to various embodiments, one or more of the components or operations of the aforementioned components may be omitted, or one or more other components or operations may be added. Generally or additionally, multiple components (e.g., module or program) may be integrated into a single component. In this case, the integrated component may perform one or more functions of each of the multiple components in the same or similar manner as those performed by the corresponding component among the multiple components prior to integration. According to various embodiments, operations performed by the module, program, or other components may be executed sequentially, in parallel, iteratively, or heuristically, or one or more of the operations may be executed in a different order, omitted, or one or more other operations may be added.

Claims

1. As a method: An operation of obtaining time series data generated over time in relation to said service by said multiple monitoring targets from said multiple monitoring targets that provide services to said multiple clients in response to multiple requests from said multiple clients; An operation of classifying the time series data according to a combination of metadata of the time series data and assigning it to a plurality of aggregators; and A method comprising the operation of transmitting the classified time series data to the assigned plurality of aggregators in order to store the time series data in a time series database (TSDB).

2. In Paragraph 1, The above metadata is composed of a plurality of tags and a plurality of values ​​of the plurality of tags, and The above combination is a method comprising a combination of a first value of a first tag and a second value of a second tag.

3. In Paragraph 2, The above monitoring targets include application servers, and A method in which the plurality of tags include HTTP (hypertext transfer protocol) status codes and HTTP methods of the plurality of requests.

4. In Paragraph 3, A method in which the plurality of tags further include the API (application programming interface) name, service name, and application identifier (ID) of the plurality of requests.

5. In Paragraph 2, The above monitoring targets include IoT (Internet of Things) hubs, and The above plurality of clients include a plurality of IoT devices, and A method in which the plurality of tags include the state and control packet types of the IoT device.

6. In Paragraph 1, The above method is performed by a plurality of data distributors, and Destination information representing the combination of the above metadata and the aggregator corresponding to the combination is stored in a metadata database connected to the plurality of data distributors, and The operation of classifying the above time series data and assigning it to the above plurality of aggregators is: A method comprising the operation of the plurality of data distributors classifying the time series data by referring to the destination information through the metadata database and assigning it to the plurality of aggregators.

7. In Paragraph 6, The above monitoring target publishes the above time series data, and the plurality of data distributors subscribe to the above time series data, The operation of acquiring the above time series data is: A method comprising the operation of the plurality of data distributors acquiring the time series data from the plurality of monitoring targets in a push or pull manner by subscribing to the time series data published by the monitoring targets.

8. In Paragraph 1, An operation to identify the amount of time series data assigned to each of the plurality of aggregators; and A method further comprising the operation of generating an alarm based on the identified amount exceeding a threshold range.

9. In Paragraph 8, The operation of determining the predicted amount of time series data per unit time allocated to each of the plurality of aggregators using a time series prediction model; and A method further comprising the operation of determining the threshold range based on the predicted amount and the identified amount.

10. In Paragraph 8, A method further comprising the operation of providing the alarm to a monitoring server monitoring the TSDB.

11. In electronic devices: Memory for storing instructions; and It includes one or more processors including processing circuitry, and When the above instructions are executed individually or collectively by the one or more processors, the electronic device: Acquiring time series data generated over time in relation to said service by said multiple monitoring targets from which the multiple clients provide services in response to multiple requests from said multiple clients; Classifying the time series data according to a combination of metadata of the time series data and assigning it to a plurality of aggregators; and An electronic device that transmits the classified time series data to the assigned plurality of aggregators in order to store the time series data in a time series database (TSDB).

12. In Paragraph 11, The above metadata is composed of a plurality of tags and a plurality of values ​​of the plurality of tags, and The above combination is an electronic device comprising a combination of a first value of a first tag and a second value of a second tag.

13. In Paragraph 11, The above electronic device is included in a plurality of data distributors, and Destination information representing the combination of the above metadata and the aggregator corresponding to the combination is stored in a metadata database connected to the plurality of data distributors, and When the above instructions are executed individually or jointly by the one or more processors, the electronic device: An electronic device that classifies time-series data and assigns it to a plurality of aggregators by referring to the destination information through the metadata database.

14. In Paragraph 11, When the above instructions are executed individually or jointly by the one or more processors, the electronic device: Identifying the amount of time series data assigned to each of the plurality of aggregators; and An electronic device that generates an alarm based on the above-mentioned identified amount exceeding a threshold range.

15. An operation of obtaining time series data generated over time in relation to said service by said multiple monitoring targets from said multiple monitoring targets that provide services to said multiple clients in response to multiple requests from said multiple clients; An operation of classifying the time series data according to a combination of metadata of the time series data and assigning it to a plurality of aggregators; and A computer-readable recording medium having a program for executing a method including the operation of transmitting the classified time series data to the assigned plurality of aggregators in order to store the above time series data in a time series database (TSDB).

Images