CN109669837A - Equipment state method for early warning, system, computer installation and readable storage medium storing program for executing - Google Patents

Equipment state method for early warning, system, computer installation and readable storage medium storing program for executing Download PDF

Info

Publication number
CN109669837A
CN109669837A CN201811289825.4A CN201811289825A CN109669837A CN 109669837 A CN109669837 A CN 109669837A CN 201811289825 A CN201811289825 A CN 201811289825A CN 109669837 A CN109669837 A CN 109669837A
Authority
CN
China
Prior art keywords
load
monitored object
system log
early warning
data
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201811289825.4A
Other languages
Chinese (zh)
Inventor
李靖
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Ping An Technology Shenzhen Co Ltd
Original Assignee
Ping An Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Ping An Technology Shenzhen Co Ltd filed Critical Ping An Technology Shenzhen Co Ltd
Priority to CN201811289825.4A priority Critical patent/CN109669837A/en
Publication of CN109669837A publication Critical patent/CN109669837A/en
Pending legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/30Monitoring
    • G06F11/3003Monitoring arrangements specially adapted to the computing system or computing system component being monitored
    • G06F11/3024Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a central processing unit [CPU]
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/30Monitoring
    • G06F11/3003Monitoring arrangements specially adapted to the computing system or computing system component being monitored
    • G06F11/3034Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a storage system, e.g. DASD based or network based
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/30Monitoring
    • G06F11/3003Monitoring arrangements specially adapted to the computing system or computing system component being monitored
    • G06F11/3037Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a memory, e.g. virtual memory, cache
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/30Monitoring
    • G06F11/3065Monitoring arrangements determined by the means or processing involved in reporting the monitored data
    • G06F11/3072Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06NCOMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00Computing arrangements based on biological models
    • G06N3/02Neural networks
    • G06N3/04Architecture, e.g. interconnection topology
    • G06N3/045Combinations of networks
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06NCOMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00Computing arrangements based on biological models
    • G06N3/02Neural networks
    • G06N3/04Architecture, e.g. interconnection topology
    • G06N3/048Activation functions
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06NCOMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00Computing arrangements based on biological models
    • G06N3/02Neural networks
    • G06N3/08Learning methods
    • G06N3/084Backpropagation, e.g. using gradient descent

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Mathematical Physics (AREA)
  • Quality & Reliability (AREA)
  • Biomedical Technology (AREA)
  • Evolutionary Computation (AREA)
  • General Health & Medical Sciences (AREA)
  • Molecular Biology (AREA)
  • Data Mining & Analysis (AREA)
  • Computational Linguistics (AREA)
  • Biophysics (AREA)
  • Artificial Intelligence (AREA)
  • Software Systems (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Debugging And Monitoring (AREA)

Abstract

The present invention provides a kind of equipment state method for early warning, system, computer installation and computer readable storage medium.The equipment state method for early warning includes: the legacy system log for obtaining monitored object, and extracts to obtain multiple feature samples data from legacy system log;It is established according to multiple feature samples data and trains to obtain a load estimation model;The current system log of monitored object is obtained, and extracts to obtain multiple characteristics to be measured from current system log;Multiple characteristics to be measured and multiple fixed reference feature data are separately input into the load estimation model and obtain prediction load and reference load;The operation warning information of the monitored object is exported with the reference load according to the prediction load.The present invention is based on neural metwork trainings to obtain load estimation model, can determine whether the monitored object can provide preferable running environment for currently running system/software according to model, user handles monitored object with prior notice.

Description

Equipment state method for early warning, system, computer installation and readable storage medium storing program for executing
Technical field
The present invention relates to data processing field more particularly to a kind of equipment state method for early warning, system, computer installation and Computer readable storage medium.
Background technique
This part intends to provides background for the embodiments of the present invention stated in claims and specific embodiment Or context.Description herein recognizes it is the prior art not because not being included in this section.
The automatic monitoring for carrying out equipment fault has become a kind of important technical for ensureing that equipment operates normally.When When a certain parameter of equipment exceeds preset alarm door limit value, equipment can issue corresponding warning message.In general, alarm Threshold value is the fixed value set when equipment factory.If alarm threshold is arranged too loose, equipment when alarming Irreversible failure may have been produced, the service life of equipment is seriously affected.If alarm threshold setting is too stringent, Equipment may often carry out unnecessary alarm, influence the normal use of equipment.Thus, equipment early warning means are mainly that equipment makes With personnel according to the operating status of current device parameter subjective forecast equipment, accuracy is low.
Summary of the invention
In view of above-mentioned, the present invention provides a kind of equipment state method for early warning, system, computer installation and computer-readable deposits Storage media may be implemented to carry out early warning to the operating status of equipment in advance.
One embodiment of the application provides a kind of equipment state method for early warning, which comprises
The legacy system log of monitored object is obtained, and feature extraction is carried out to the legacy system log and obtains multiple spies Levy sample data;
It is established according to multiple feature samples data and trains to obtain a load estimation model;
The current system log of the monitored object is obtained, and current system log progress feature extraction is obtained more A characteristic to be measured;
By multiple characteristics to be measured be input to the load estimation model obtain it is corresponding with the monitored object Prediction load;
It obtains multiple fixed reference feature data of the monitored object, and multiple fixed reference feature data is input to described Load estimation model obtains reference load corresponding with the monitored object, and the plurality of fixed reference feature data are the prison Control the characteristic threshold value of the available running environment of object;And
The operation warning information of the monitored object is exported with the reference load according to the prediction load.
Preferably, described that the step of feature extraction obtains multiple feature samples data packet is carried out to the legacy system log It includes:
It is extracted and is obtained and multiple preset keywords from the legacy system log according to multiple preset keyword sections Matched multiple feature samples data.
Preferably, described feature extraction is carried out to the current system log to obtain multiple characteristics to be measured and include:
It is extracted and is obtained and multiple default keys from the current system log according to multiple preset keywords The matched multiple characteristics to be measured of word.
Preferably, the load estimation model be BP neural network model, the BP neural network model include input layer, Hidden layer and output layer, the input layer include n node, and the hidden layer includes m node, the BP neural network model Are as follows:
Wherein, y is the assessed value of output layer output, when multiple characteristics to be measured are input to the load in advance When surveying model, the output y of the load estimation model is prediction load, when multiple fixed reference feature data are input to institute When stating load estimation model, the output y of the load estimation model is the reference load, tiFor the hidden layer with it is described defeated Connection weight between layer out,(i=1,2,3...m;It j=1,2,3...n is) hidden layer Input, the output of the as described input layer, WijFor the connection weight between the input layer and the hidden layer;f(Si) for institute The activation primitive in BP neural network model is stated,
Preferably, the feature samples data, the fixed reference feature data and the characteristic to be measured are the prison Control the hardware resource data of object.
Preferably, the operation early warning for exporting the monitored object with the reference load according to the prediction load is believed The step of breath includes:
Whether within a preset range to judge the difference of prediction load and the reference load;And
When the difference of prediction load and the reference load is not in the preset range, the monitored object is exported Operation warning information.
Preferably, described when the difference of prediction load and the reference load is not in the preset range, output The step of operation warning information of the monitored object includes:
When the difference of prediction load and the reference load is not in the preset range, loaded according to the prediction And the size of the difference of the reference load exports different grades of operation warning information.
One embodiment of the application provides a kind of equipment state early warning system, the system comprises:
First extraction module is carried out for obtaining the legacy system log of monitored object, and to the legacy system log Feature extraction obtains multiple feature samples data;
Model training module, for being established according to multiple feature samples data and training to obtain a load estimation mould Type;
Second extraction module, for obtaining the current system log of the monitored object, and to the current system log It carries out feature extraction and obtains multiple characteristics to be measured;
First computing module obtains and institute for multiple characteristics to be measured to be input to the load estimation model State the corresponding prediction load of monitored object;
Second computing module, for obtaining multiple fixed reference feature data of the monitored object, and by multiple references Characteristic is input to the load estimation model and obtains reference load corresponding with the monitored object, the plurality of ginseng Examine the characteristic threshold value that characteristic is the available running environment of the monitored object;And
Output module, for exporting the operation early warning of the monitored object with the reference load according to the prediction load Information.
One embodiment of the application provides a kind of computer installation, and the computer installation includes processor and memory, Several computer programs are stored on the memory, the processor is for when executing the computer program stored in memory The step of realizing equipment state method for early warning as elucidated before.
One embodiment of the application provides a kind of computer readable storage medium, is stored thereon with computer program, described The step of equipment state method for early warning as elucidated before is realized when computer program is executed by processor.
Above equipment status early warning method, system, computer installation and computer readable storage medium are based on machine learning Legacy system log with monitored object is and special by the reference of monitored object respectively to establish and train to obtain load estimation model It levies data and is input to the load estimation model from the characteristic to be measured that current system log is extracted and be calculated with reference to negative It carries and is loaded with prediction, and then judge whether the monitored object can be current according to the reference load and the difference of prediction load The system of operation/software provides preferable running environment, when judging cannot to provide preferably as currently running system/software When running environment, output operation warning information, with prior notice, user handles monitored object.
Detailed description of the invention
It, below will be to required in embodiment description in order to illustrate more clearly of the technical solution of embodiment of the present invention The attached drawing used is briefly described, it should be apparent that, the accompanying drawings in the following description is some embodiments of the present invention, for For those of ordinary skill in the art, without creative efforts, it can also be obtained according to these attached drawings other Attached drawing.
Fig. 1 is the step flow chart of equipment state method for early warning in one embodiment of the invention.
Fig. 2 is the functional block diagram of equipment state early warning system in one embodiment of the invention.
Fig. 3 is computer schematic device in one embodiment of the invention.
Specific embodiment
To better understand the objects, features and advantages of the present invention, with reference to the accompanying drawing and specific real Applying mode, the present invention will be described in detail.It should be noted that in the absence of conflict, presently filed embodiment and reality The feature applied in mode can be combined with each other.
In the following description, numerous specific details are set forth in order to facilitate a full understanding of the present invention, described embodiment Only some embodiments of the invention, rather than whole embodiments.Based on the embodiment in the present invention, this field Those of ordinary skill's every other embodiment obtained without making creative work, belongs to guarantor of the present invention The range of shield.
Unless otherwise defined, all technical and scientific terms used herein and belong to technical field of the invention The normally understood meaning of technical staff is identical.Term as used herein in the specification of the present invention is intended merely to description tool The purpose of the embodiment of body, it is not intended that in the limitation present invention.
Preferably, equipment state method for early warning of the invention is applied in one or more computer installation.The meter Calculation machine device be it is a kind of can be according to the instruction for being previously set or store, automatic progress numerical value calculating and/or information processing are set Standby, hardware includes but is not limited to microprocessor, specific integrated circuit (Application Specific Integrated Circuit, ASIC), programmable gate array (Field-Programmable Gate Array, FPGA), digital processing unit (Digital Signal Processor, DSP), embedded device etc..
The computer installation can be the calculating such as desktop PC, laptop, tablet computer, server and set It is standby.The computer installation can carry out people by modes such as keyboard, mouse, remote controler, touch tablet or voice-operated devices with user Machine interaction.
Embodiment one:
Fig. 1 is the step flow chart of present device status early warning method preferred embodiment.It is described according to different requirements, The sequence of step can change in flow chart, and certain steps can be omitted.
As shown in fig.1, the equipment state method for early warning specifically includes following steps.
Step S11, the legacy system log of monitored object is obtained, and feature extraction is carried out to the legacy system log and is obtained To multiple feature samples data.
In one embodiment, it can be connected to the monitored object by access network, and then obtain the monitoring The legacy system log of object.The monitored object can be a server or a server cluster.The server is described Server cluster may include several hardware resources (such as: CPU, memory, I/O interface, memory etc.).The server is described Server cluster can run similar and different operating system, database, with software, system software.It is to be appreciated that institute Virtual machine manager (Virtual Machine Manager, VMM), several physics can be had by multiple operations by stating server cluster Node (Physical Node, PN) is constituted, and runs multiple operating systems on VMM, by the resource scheduling algorithm of VMM, this A little operating systems share the resource of physical machine.
The legacy system log can refer to the system log before a scheduled date, for example, the monitored object exists 2018.8.12 all system logs before.When the application software or the system software are run, operating system or VMM meeting Relevant record is carried out, and then forms system log.
The system log that is generated when in one embodiment, the system log may include the operating system of equipment, Application log and security log etc.;In one embodiment, can by operating system operation in input The event viewer of eventvwr.msc calling system is to obtain the system log.In other embodiments, for not Same operating system, the order for obtaining system log may be different.
It in one embodiment, can be according to multiple default passes when carrying out feature extraction to the legacy system log Key field is extracted from the legacy system log to be obtained and multiple matched multiple feature samples data of preset keyword.
For example, for database, the change in system log recorded data library (for example, MySQL database) is operated, Including but not limited to create database or table, insertion operation, update operation, delete operation etc., each change operation is with one In the form write-in journal file of record, system log is formd.Every record may include the timestamp of current record update, be somebody's turn to do The position (such as offset) being recorded in journal file and other information relevant to database change operation.MySQL data Usually there is one or more journal file in library, and different journal files uses different digital number shapes by file extension Formula is distinguish, such as: mysql-bin.00001, mysql-bin.00002.
It may include that (CPU executes non-idle thread time for the utilization rate of CPU for hardware resource, in system log Percentage), the interruption rate number of device interrupt processor (each second), (system service of CPU call operation is customary for system calling rate The overall rate of program), memory is using accounting, residual memory space etc..
Step S12, it is established according to multiple feature samples data and trains to obtain a load estimation model.
In one embodiment, the load estimation model can be based on neural network model and multiple feature samples Notebook data trains the model come.The neural network model can take out human brain neuroid from information processing angle As different networks being formed by different connection types, it is not necessary that the mathematics side of mapping relations between input and output is determined in advance Journey obtains the result closest to desired output in given input value only by the training of itself.The neural network model Including input layer, hidden layer and output layer.The history feature data can be used as the input layer of neural network model, using mind An assessed value is exported by output layer after the connection of the hidden layer of network model.
In one embodiment, the neural network model can be BP (Back Propagation, backpropagation) mind Through network model, the BP neural network model be it is a kind of based on gradient descent method by error back propagation training multilayer before Network is presented, using gradient search technology, to make the real output value of network and the error mean square difference minimum of desired output. In other embodiments of the invention, other kinds of neural network model can also be selected according to actual needs.
In one embodiment, the input layer includes n node, and the hidden layer includes m node, the BP nerve Network model can indicate are as follows:
Wherein, y is the assessed value of output layer output, when multiple characteristics to be measured are input to the load in advance When surveying model, the output y of the load estimation model is prediction load, when multiple fixed reference feature data are input to institute When stating load estimation model, the output y of the load estimation model is the reference load, tiFor the hidden layer with it is described defeated Connection weight between layer out,(i=1,2,3...m;J=1,2,3...n), SiFor the hidden layer Input, the output of the as described input layer, WijFor the connection weight between the input layer and the hidden layer, f () is Activation primitive in the BP neural network model, when the hidden layer has input, activation primitive is expressed as f (Si).It is described Activation primitive f (Si) S type function (Sigmoid function), f (S can be usedi) can indicate are as follows:
It is to be appreciated that tiIt can indicate the connection weight between i-th of node of the hidden layer and the output layer, For example, t11st connection weight between node and the output layer of the as described hidden layer, t2The as described hidden layer 2nd connection weight between node and the output layer, t33rd node of the as described hidden layer and the output layer it Between connection weight, tmConnection weight between m-th of the node and the output layer of the as described hidden layer.Similarly it is found that WijConnection weight between i-th of node of the as described hidden layer and j-th of node of the input layer.By to the BP Neural network model is trained, and can be correspondingly made available tiAnd WijValue, i.e., training obtain each layer of BP neural network model Parameter, the load estimation model so can be obtained.
Step S13, the current system log of the monitored object is obtained, and feature is carried out to the current system log and is mentioned Obtain multiple characteristics to be measured.
In one embodiment, the current system log describes the current operating parameter of the monitored object.Right It, equally can be according to multiple preset keyword sections from the current system log when current system log carries out feature extraction Middle extraction obtains and multiple matched multiple characteristics to be measured of preset keyword.
Step S14, multiple characteristics to be measured the load estimation model is input to obtain and the monitoring pair As corresponding prediction loads.
In one embodiment, the training by step S12 to neural network model, the load estimation model can be real Now the current operating environment of the monitored object is predicted.It at this time can be using multiple characteristics to be measured as described in The output of the load estimation model is considered as prediction load by the input of load estimation model, and the prediction load can refer to Operating status of the monitored object under currently running system or software.
Step S15, multiple fixed reference feature data of the monitored object are obtained, and multiple fixed reference feature data are defeated Enter to the load estimation model and obtains reference load corresponding with the monitored object, the plurality of fixed reference feature data For the characteristic threshold value of the available running environment of the monitored object.
In one embodiment, the monitored object has several fixed reference feature data, and the fixed reference feature data can table Show that the monitored object can support the preferable states of system operation.It is to be measured when the monitored object obtained from current system log When characteristic is higher than corresponding fixed reference feature data, indicate that the monitored object possibly can not preferably meet system operation and want It asks.
For example, utilization rate is the percentage that finger processor executes non-idle thread time, threshold values one for CPU As be set as 85% (as fixed reference feature data);Interruption rate refers to that the number of device interrupt processor each second, threshold values are general It is set as 1000 times/second (can be used as fixed reference feature data);System calling rate, which refers to, operates in all processor call operation system clothes The overall rate of business routine program, if system calling rate is greater than interruption rate, then it represents that hardware device produces excessively in system Interruption, it is generally no (can be used as fixed reference feature data);For memory, memory is generally set to using the threshold value of accounting 90% (can be used as fixed reference feature data).Therefore, it is pre- that the fixed reference feature data of the monitored object can be input to the load It surveys in model, corresponding reference load can be obtained.
Step S16, the operation warning information of the monitored object is exported with the reference load according to the prediction load.
In one embodiment, can by calculate and judge prediction load and the reference load difference whether The operation warning information of the monitored object is exported in preset range.When the prediction load and the reference load difference not When in the preset range, indicate that the monitored object possibly can not provide preferable fortune for currently running system/software Row environment or currently running system/software have had exceeded the available running environment of the monitored object, export institute at this time State the operation warning information of monitored object.For example, user can issue migration order according to the operation warning information, with By currently running system, software or data service migration to other servers.When prediction load and the reference load Difference in the preset range when, indicate that the monitored object can provide preferable fortune for currently running system/software Row environment does not export the operation warning information.The preset range can be set according to actual use demand, in turn The effect to give warning in advance can be played.
Embodiment two:
Fig. 2 is the functional block diagram of present device status early warning system preferred embodiment.
As shown in fig.2, the equipment state early warning system 10 may include the first extraction module 101, model training mould Block 102, the second extraction module 103, the first computing module 104, the second computing module 105, output module 106 and judgment module 107。
First extraction module 101 is used to obtain the legacy system log of monitored object, and to the legacy system day Will carries out feature extraction and obtains multiple feature samples data.
In one embodiment, first extraction module 101 can be connected to the monitoring pair by access network As, and then obtain the legacy system log of the monitored object.The monitored object can be a server or a server set Group.The server or the server cluster may include several hardware resources (such as: CPU, memory, I/O interface, memory Deng).The server or the server cluster can run similar and different operating system, database, with software, be System software.It is to be appreciated that the server cluster can have virtual machine manager (Virtual Machine by multiple operations Manager, VMM), several physical nodes (Physical Node, PN) constitute, run multiple operating systems on VMM, lead to The resource scheduling algorithm of VMM is crossed, these operating systems share the resource of physical machine.
The legacy system log can refer to the system log before a scheduled date, for example, the monitored object exists 2018.8.12 all system logs before.When the application software or the system software are run, operating system or VMM meeting Relevant record is carried out, and then forms system log.
The system log that is generated when in one embodiment, the system log may include the operating system of equipment, Application log and security log etc.;In one embodiment, can by operating system operation in input The event viewer of eventvwr.msc calling system is to obtain the system log.In other embodiments, for not Same operating system, the order for obtaining system log may be different.
In one embodiment, when carrying out feature extraction to the legacy system log, first extraction module 101 It can be extracted from the legacy system log according to multiple preset keyword sections and obtain matching with multiple preset keywords Multiple feature samples data.
For example, for database, the change in system log recorded data library (for example, MySQL database) is operated, Including but not limited to create database or table, insertion operation, update operation, delete operation etc., each change operation is with one In the form write-in journal file of record, system log is formd.Every record may include the timestamp of current record update, be somebody's turn to do The position (such as offset) being recorded in journal file and other information relevant to database change operation.MySQL data Usually there is one or more journal file in library, and different journal files uses different digital number shapes by file extension Formula is distinguish, such as: mysql-bin.00001, mysql-bin.00002.
It may include that (CPU executes non-idle thread time for the utilization rate of CPU for hardware resource, in system log Percentage), the interruption rate number of device interrupt processor (each second), (system service of CPU call operation is customary for system calling rate The overall rate of program), memory is using accounting, residual memory space etc..
The model training module 102 is used to be established and be trained according to multiple feature samples data to obtain a load pre- Survey model.
In one embodiment, the model training module 102, which trains the load estimation model come, can be base In neural network model and multiple feature samples data.The neural network model can be from information processing angle to human brain Neuroid is abstracted, and different networks is formed by different connection types, without being determined in advance between input and output The math equation of mapping relations obtains the result closest to desired output in given input value only by the training of itself. The neural network model includes input layer, hidden layer and output layer.The history feature data can be used as neural network model Input layer, using after the connection of the hidden layer of neural network model by output layer export an assessed value.
In one embodiment, the neural network model can be BP (Back Propagation, backpropagation) mind Through network model, the BP neural network model be it is a kind of based on gradient descent method by error back propagation training multilayer before Network is presented, using gradient search technology, to make the real output value of network and the error mean square difference minimum of desired output. In other embodiments of the invention, other kinds of neural network model can also be selected according to actual needs.
In one embodiment, the input layer includes n node, and the hidden layer includes m node, the BP nerve Network model can indicate are as follows:
Wherein, y is the assessed value of output layer output, when multiple characteristics to be measured are input to the load in advance When surveying model, the output y of the load estimation model is prediction load, when multiple fixed reference feature data are input to institute When stating load estimation model, the output y of the load estimation model is the reference load, tiFor the hidden layer with it is described defeated Connection weight between layer out,(i=1,2,3...m;J=1,2,3...n), SiFor the hidden layer Input, the output of the as described input layer, WijFor the connection weight between the input layer and the hidden layer, f () is Activation primitive in the BP neural network model, when the hidden layer has input, activation primitive is expressed as f (Si).It is described Activation primitive f (Si) S type function (Sigmoid function), f (S can be usedi) can indicate are as follows:
It is to be appreciated that tiIt can indicate the connection weight between i-th of node of the hidden layer and the output layer, For example, t11st connection weight between node and the output layer of the as described hidden layer, t2The as described hidden layer 2nd connection weight between node and the output layer, t33rd node of the as described hidden layer and the output layer it Between connection weight, tmConnection weight between m-th of the node and the output layer of the as described hidden layer.Similarly it is found that WijConnection weight between i-th of node of the as described hidden layer and j-th of node of the input layer.By to the BP Neural network model is trained, and can be correspondingly made available tiAnd WijValue, i.e., training obtain each layer of BP neural network model Parameter, the load estimation model so can be obtained.
Second extraction module 103 is used to obtain the current system log of the monitored object, and to the current system System log carries out feature extraction and obtains multiple characteristics to be measured.
In one embodiment, the current system log describes the current operating parameter of the monitored object.Right When the current system log carries out feature extraction, second extraction module 103 equally can be according to multiple preset keywords Section is extracted from the current system log to be obtained and multiple matched multiple characteristics to be measured of preset keyword.
First computing module 104 is obtained for multiple characteristics to be measured to be input to the load estimation model It is loaded to prediction corresponding with the monitored object.
In one embodiment, the training by step S12 to neural network model, the load estimation model can be real Now the current operating environment of the monitored object is predicted.First computing module 104 can will be multiple described at this time Characteristic to be measured is input to the load estimation model, and the output of the load estimation model is considered as prediction load, described Prediction load can refer to operating status of the monitored object under currently running system or software.
Second computing module 105 is used to obtain multiple fixed reference feature data of the monitored object, and by multiple institutes It states fixed reference feature data and is input to the load estimation model and obtain reference load corresponding with the monitored object, it is plurality of The fixed reference feature data are the characteristic threshold value of the available running environment of the monitored object.
In one embodiment, the monitored object has several fixed reference feature data, and the fixed reference feature data can table Show that the monitored object can support the preferable states of system operation.It is to be measured when the monitored object obtained from current system log When characteristic is higher than corresponding fixed reference feature data, indicate that the monitored object possibly can not preferably meet system operation and want It asks.
For example, utilization rate is the percentage that finger processor executes non-idle thread time, threshold values one for CPU As be set as 85% (as fixed reference feature data);Interruption rate refers to that the number of device interrupt processor each second, threshold values are general It is set as 1000 times/second (can be used as fixed reference feature data);System calling rate, which refers to, operates in all processor call operation system clothes The overall rate of business routine program, if system calling rate is greater than interruption rate, then it represents that hardware device produces excessively in system Interruption, it is generally no (can be used as fixed reference feature data);For memory, memory is generally set to using the threshold value of accounting 90% (can be used as fixed reference feature data).Therefore, it is pre- that the fixed reference feature data of the monitored object can be input to the load It surveys in model, corresponding reference load can be obtained.
The output module 106 is used to export the fortune of the monitored object with the reference load according to the prediction load Row warning information.
In one embodiment, the output module 106 can be according to the difference of prediction load and the reference load Whether the operation warning information of the monitored object exported within a preset range.Specifically, the judgment module 107 is for sentencing The difference for prediction load and the reference load of breaking whether within a preset range, when the prediction loads and the reference load Difference not in the preset range when, indicate the monitored object possibly can not be provided for currently running system/software compared with Good running environment or currently running system/software have had exceeded the available running environment of the monitored object, at this time The output module 106 exports the operation warning information of the monitored object.For example, user can be pre- according to the operation Alert delivering migration order, by currently running system, software or data service migration to other servers.When described pre- When the difference of survey load and the reference load is in the preset range, indicate that the monitored object can be currently running system System/software provides preferable running environment, does not export the operation warning information.The preset range can make according to actual It is set with demand, and then the effect to give warning in advance can be played.
Fig. 3 is the schematic diagram of computer installation preferred embodiment of the present invention.
The computer installation 1 includes memory 20, processor 30 and is stored in the memory 20 and can be in institute State the computer program 40 run on processor 30, such as equipment state early warning program.The processor 30 executes the calculating The step in above equipment status early warning embodiment of the method, such as step S11~S16 shown in FIG. 1 are realized when machine program 40.Or Person, the processor 30 realize each module in above equipment status early warning system embodiment when executing the computer program 40 Module 101~107 in function, such as Fig. 2.
Illustratively, the computer program 40 can be divided into one or more module/units, it is one or Multiple module/units are stored in the memory 20, and are executed by the processor 30, to complete the present invention.Described one A or multiple module/units can be the series of computation machine program instruction section that can complete specific function, and described instruction section is used In implementation procedure of the description computer program 40 in the computer installation 1.For example, the computer program 40 can be with The first extraction module 101, model training module 102, the second extraction module 103, the first computing module being divided into Fig. 2 104, the second computing module 105, output module 106 and judgment module 107.Each module concrete function is referring to embodiment two.
The computer installation 1 can be the calculating such as desktop PC, notebook, palm PC and cloud server and set It is standby.It will be understood by those skilled in the art that the schematic diagram is only the example of computer installation 1, do not constitute to computer The restriction of device 1 may include perhaps combining certain components or different components, example than illustrating more or fewer components Such as described computer installation 1 can also include input-output equipment, network access equipment, bus.
Alleged processor 30 can be central processing unit (Central Processing Unit, CPU), can also be Other general processors, digital signal processor (Digital Signal Processor, DSP), specific integrated circuit (Application Specific Integrated Circuit, ASIC), ready-made programmable gate array (Field- Programmable Gate Array, FPGA) either other programmable logic device, discrete gate or transistor logic, Discrete hardware components etc..General processor can be microprocessor or the processor 30 is also possible to any conventional processing Device etc., the processor 30 are the control centres of the computer installation 1, utilize various interfaces and the entire computer of connection The various pieces of device 1.
The memory 20 can be used for storing the computer program 40 and/or module/unit, and the processor 30 passes through Operation executes the computer program and/or module/unit being stored in the memory 20, and calls and be stored in memory Data in 20 realize the various functions of the computer installation 1.The memory 20 can mainly include storing program area and deposit Store up data field, wherein storing program area can application program needed for storage program area, at least one function (for example sound is broadcast Playing function, image player function etc.) etc.;Storage data area, which can be stored, uses created data (ratio according to computer installation 1 Such as audio data, phone directory) etc..In addition, memory 20 may include high-speed random access memory, it can also include non-easy The property lost memory, such as hard disk, memory, plug-in type hard disk, intelligent memory card (Smart Media Card, SMC), secure digital (Secure Digital, SD) card, flash card (Flash Card), at least one disk memory, flush memory device or other Volatile solid-state part.
If the integrated module/unit of the computer installation 1 is realized in the form of SFU software functional unit and as independence Product when selling or using, can store in a computer readable storage medium.Based on this understanding, of the invention It realizes all or part of the process in above-described embodiment method, can also instruct relevant hardware come complete by computer program At the computer program can be stored in a computer readable storage medium, and the computer program is held by processor When row, it can be achieved that the step of above-mentioned each embodiment of the method.Wherein, the computer program includes computer program code, institute Stating computer program code can be source code form, object identification code form, executable file or certain intermediate forms etc..It is described Computer-readable medium may include: any entity or device, recording medium, U that can carry the computer program code Disk, mobile hard disk, magnetic disk, CD, computer storage, read-only memory (ROM, Read-Only Memory), arbitrary access Memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium etc..It needs It is bright, the content that the computer-readable medium includes can according in jurisdiction make laws and patent practice requirement into Row increase and decrease appropriate, such as do not include electric load according to legislation and patent practice, computer-readable medium in certain jurisdictions Wave signal and telecommunication signal.
In several embodiments provided by the present invention, it should be understood that disclosed computer installation and method, it can be with It realizes by another way.For example, computer installation embodiment described above is only schematical, for example, described The division of unit, only a kind of logical function partition, there may be another division manner in actual implementation.
It, can also be in addition, each functional unit in each embodiment of the present invention can integrate in same treatment unit It is that each unit physically exists alone, can also be integrated in same unit with two or more units.Above-mentioned integrated list Member both can take the form of hardware realization, can also realize in the form of hardware adds software function module.
It is obvious to a person skilled in the art that invention is not limited to the details of the above exemplary embodiments, Er Qie In the case where without departing substantially from spirit or essential attributes of the invention, the present invention can be realized in other specific forms.Therefore, no matter From the point of view of which point, the present embodiments are to be considered as illustrative and not restrictive, and the scope of the present invention is by appended power Benefit requires rather than above description limits, it is intended that all by what is fallen within the meaning and scope of the equivalent elements of the claims Variation is included in the present invention.Any reference signs in the claims should not be construed as limiting the involved claims.This Outside, it is clear that one word of " comprising " does not exclude other units or steps, and odd number is not excluded for plural number.It is stated in computer installation claim Multiple units or computer installation can also be implemented through software or hardware by the same unit or computer installation.The One, the second equal words are used to indicate names, and are not indicated any particular order.
Finally it should be noted that the above examples are only used to illustrate the technical scheme of the present invention and are not limiting, although reference Preferred embodiment describes the invention in detail, those skilled in the art should understand that, it can be to of the invention Technical solution is modified or equivalent replacement, without departing from the spirit and scope of the technical solution of the present invention.

Claims (10)

1. a kind of equipment state method for early warning, which is characterized in that the described method includes:
The legacy system log of monitored object is obtained, and feature extraction is carried out to the legacy system log and obtains multiple feature samples Notebook data;
It is established according to multiple feature samples data and trains to obtain a load estimation model;
Obtain the current system log of the monitored object, and to the current system log carry out feature extraction obtain it is multiple to Survey characteristic;
Multiple characteristics to be measured are input to the load estimation model and obtain prediction corresponding with the monitored object Load;
Multiple fixed reference feature data of the monitored object are obtained, and multiple fixed reference feature data are input to the load Prediction model obtains reference load corresponding with the monitored object, and the plurality of fixed reference feature data are the monitoring pair As the characteristic threshold value of available running environment;And
The operation warning information of the monitored object is exported with the reference load according to the prediction load.
2. equipment state method for early warning as described in claim 1, which is characterized in that described to be carried out to the legacy system log Feature extraction obtains the step of multiple feature samples data and includes:
It is extracted from the legacy system log according to multiple preset keyword sections and obtains matching with multiple preset keywords Multiple feature samples data.
3. equipment state method for early warning as claimed in claim 2, which is characterized in that described to be carried out to the current system log Feature extraction obtains multiple characteristics to be measured
It is extracted and is obtained and multiple preset keywords from the current system log according to multiple preset keywords The multiple characteristics to be measured matched.
4. equipment state method for early warning as claimed in any one of claims 1-3, which is characterized in that the load estimation model For BP neural network model, the BP neural network model includes input layer, hidden layer and output layer, and the input layer includes n A node, the hidden layer include m node, the BP neural network model are as follows:
Wherein, y is the assessed value of output layer output, when multiple characteristics to be measured are input to the load estimation mould When type, the output y of the load estimation model is prediction load, when multiple fixed reference feature data are input to described bear When carrying prediction model, the output y of the load estimation model is the reference load, tiFor the hidden layer and the output layer Between connection weight, For the input of the hidden layer, The output of the as described input layer, WijFor the connection weight between the input layer and the hidden layer;f(Si) it is the BP mind Through the activation primitive in network model,
5. equipment state method for early warning as described in claim 1, which is characterized in that the feature samples data, the reference Characteristic and the characteristic to be measured are the hardware resource data of the monitored object.
6. equipment state method for early warning as described in claim 1, which is characterized in that it is described according to the prediction load with it is described Reference load exports the step of operation warning information of the monitored object and includes:
Whether within a preset range to judge the difference of prediction load and the reference load;And
When the difference of prediction load and the reference load is not in the preset range, the fortune of the monitored object is exported Row warning information.
7. equipment state method for early warning as claimed in claim 6, which is characterized in that described when prediction load and the ginseng When examining the difference of load not in the preset range, the step of exporting the operation warning information of the monitored object, includes:
When the difference of prediction load and the reference load is not in the preset range, according to prediction load and institute The size for stating the difference of reference load exports different grades of operation warning information.
8. a kind of equipment state early warning system, which is characterized in that the system comprises:
First extraction module carries out feature for obtaining the legacy system log of monitored object, and to the legacy system log Extraction obtains multiple feature samples data;
Model training module, for being established according to multiple feature samples data and training to obtain a load estimation model;
Second extraction module is carried out for obtaining the current system log of the monitored object, and to the current system log Feature extraction obtains multiple characteristics to be measured;
First computing module obtains and the prison for multiple characteristics to be measured to be input to the load estimation model Control the corresponding prediction load of object;
Second computing module, for obtaining multiple fixed reference feature data of the monitored object, and by multiple fixed reference features Data are input to the load estimation model and obtain reference load corresponding with the monitored object, plurality of described with reference to special Levy the characteristic threshold value that data are the available running environment of the monitored object;And
Output module, the operation early warning for exporting the monitored object with the reference load according to the prediction load are believed Breath.
9. a kind of computer installation, the computer installation includes processor and memory, is stored on the memory several Computer program, which is characterized in that such as right is realized when the processor is for executing the computer program stored in memory It is required that described in any one of 1-7 the step of equipment state method for early warning.
10. a kind of computer readable storage medium, is stored thereon with computer program, which is characterized in that the computer program The step of equipment state method for early warning as described in any one of claim 1-7 is realized when being executed by processor.
CN201811289825.4A 2018-10-31 2018-10-31 Equipment state method for early warning, system, computer installation and readable storage medium storing program for executing Pending CN109669837A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201811289825.4A CN109669837A (en) 2018-10-31 2018-10-31 Equipment state method for early warning, system, computer installation and readable storage medium storing program for executing

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201811289825.4A CN109669837A (en) 2018-10-31 2018-10-31 Equipment state method for early warning, system, computer installation and readable storage medium storing program for executing

Publications (1)

Publication Number Publication Date
CN109669837A true CN109669837A (en) 2019-04-23

Family

ID=66141772

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201811289825.4A Pending CN109669837A (en) 2018-10-31 2018-10-31 Equipment state method for early warning, system, computer installation and readable storage medium storing program for executing

Country Status (1)

Country Link
CN (1) CN109669837A (en)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110389840A (en) * 2019-07-25 2019-10-29 中国工商银行股份有限公司 Load consumption method for early warning, device, computer equipment and storage medium
CN110738120A (en) * 2019-09-17 2020-01-31 平安科技(深圳)有限公司 Environment data adjusting method and device, electronic equipment and medium
CN110955586A (en) * 2019-11-27 2020-04-03 中国银行股份有限公司 System fault prediction method, device and equipment based on log
CN111078500A (en) * 2019-12-11 2020-04-28 何晨 Method and device for adjusting operation configuration parameters, computer equipment and storage medium
CN111200649A (en) * 2019-12-30 2020-05-26 北京知道创宇信息技术股份有限公司 Scheduling method and device and scheduling model generation method and device
CN111262728A (en) * 2020-01-08 2020-06-09 国网福建省电力有限公司 Flow load monitoring system based on log port flow
CN111708682A (en) * 2020-06-17 2020-09-25 腾讯科技(深圳)有限公司 Data prediction method, device, equipment and storage medium
CN111756455A (en) * 2019-12-26 2020-10-09 广州极飞科技有限公司 Method and related device for early warning connection state of electronic equipment and reference station
CN112529733A (en) * 2020-12-07 2021-03-19 云南电网有限责任公司普洱供电局 Power distribution network operation safety remote control method, device, equipment and storage medium

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160379112A1 (en) * 2015-06-29 2016-12-29 Microsoft Technology Licensing, Llc Training and operation of computational models
CN106650919A (en) * 2016-12-23 2017-05-10 国家电网公司信息通信分公司 Information system fault diagnosis method and device based on convolutional neural network
CN107526666A (en) * 2017-07-17 2017-12-29 阿里巴巴集团控股有限公司 Alarm method, system, device and electronic equipment based on deep learning
CN108388503A (en) * 2018-02-13 2018-08-10 中体彩科技发展有限公司 Data-base performance monitoring method, system, equipment and computer readable storage medium
CN108427720A (en) * 2018-02-08 2018-08-21 中国科学院计算技术研究所 System log sorting technique

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160379112A1 (en) * 2015-06-29 2016-12-29 Microsoft Technology Licensing, Llc Training and operation of computational models
CN106650919A (en) * 2016-12-23 2017-05-10 国家电网公司信息通信分公司 Information system fault diagnosis method and device based on convolutional neural network
CN107526666A (en) * 2017-07-17 2017-12-29 阿里巴巴集团控股有限公司 Alarm method, system, device and electronic equipment based on deep learning
CN108427720A (en) * 2018-02-08 2018-08-21 中国科学院计算技术研究所 System log sorting technique
CN108388503A (en) * 2018-02-13 2018-08-10 中体彩科技发展有限公司 Data-base performance monitoring method, system, equipment and computer readable storage medium

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110389840B (en) * 2019-07-25 2022-02-01 中国工商银行股份有限公司 Load consumption early warning method and device, computer equipment and storage medium
CN110389840A (en) * 2019-07-25 2019-10-29 中国工商银行股份有限公司 Load consumption method for early warning, device, computer equipment and storage medium
CN110738120A (en) * 2019-09-17 2020-01-31 平安科技(深圳)有限公司 Environment data adjusting method and device, electronic equipment and medium
CN110738120B (en) * 2019-09-17 2024-02-09 平安科技(深圳)有限公司 Environment data adjustment method and device, electronic equipment and medium
CN110955586A (en) * 2019-11-27 2020-04-03 中国银行股份有限公司 System fault prediction method, device and equipment based on log
CN111078500A (en) * 2019-12-11 2020-04-28 何晨 Method and device for adjusting operation configuration parameters, computer equipment and storage medium
CN111756455A (en) * 2019-12-26 2020-10-09 广州极飞科技有限公司 Method and related device for early warning connection state of electronic equipment and reference station
CN111756455B (en) * 2019-12-26 2022-09-13 广州极飞科技股份有限公司 Method and related device for early warning connection state of electronic equipment and reference station
CN111200649B (en) * 2019-12-30 2023-03-24 北京知道创宇信息技术股份有限公司 Scheduling method and device and scheduling model generation method and device
CN111200649A (en) * 2019-12-30 2020-05-26 北京知道创宇信息技术股份有限公司 Scheduling method and device and scheduling model generation method and device
CN111262728A (en) * 2020-01-08 2020-06-09 国网福建省电力有限公司 Flow load monitoring system based on log port flow
CN111708682A (en) * 2020-06-17 2020-09-25 腾讯科技(深圳)有限公司 Data prediction method, device, equipment and storage medium
CN112529733A (en) * 2020-12-07 2021-03-19 云南电网有限责任公司普洱供电局 Power distribution network operation safety remote control method, device, equipment and storage medium

Similar Documents

Publication Publication Date Title
CN109669837A (en) Equipment state method for early warning, system, computer installation and readable storage medium storing program for executing
CN104750768B (en) Method and system for identification, monitoring and ranking event from social media
CN108304250A (en) Method and apparatus for the node for determining operation machine learning task
US20210042628A1 (en) Building a federated learning framework
CN107918600A (en) report development system and method, storage medium and electronic equipment
CN111489095B (en) Risk user management method, apparatus, computer device and storage medium
CN109598434A (en) Abnormity early warning method, apparatus, computer installation and storage medium
Pan et al. Research on dependability of cloud computing systems
CN109542714A (en) Method for monitoring application program and device, computer installation and computer storage medium
CN109241096A (en) Data processing method, device and system
CN111090686B (en) Data processing method, device, server and storage medium
CN111383100A (en) Risk model-based full life cycle management and control method and device
CN109683880A (en) Webpage exchange method, device, equipment and storage medium
CN110689225A (en) Enterprise financial risk portrait creation method based on outbound call and related equipment
CN114707002A (en) Disaster emergency decision generation method, device, equipment and storage medium
CN109800124A (en) CPU usage monitoring method, device, electronic equipment and storage medium
CN109446278A (en) A kind of big data management platform system based on block chain
CN117435999A (en) Risk assessment method, apparatus, device and medium
Ranganathan et al. An automated decision support system based on game theoretic optimization for emergency management in urban environments
US11783221B2 (en) Data exposure for transparency in artificial intelligence
CN114300082B (en) Information processing method and device and computer readable storage medium
CN114267440B (en) Medical order information processing method and device and computer readable storage medium
CN111651652B (en) Emotion tendency identification method, device, equipment and medium based on artificial intelligence
CN115221892A (en) Work order data processing method and device, storage medium and electronic equipment
Liu et al. Towards dynamic reconfiguration of composite services via failure estimation of general and domain quality of services

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication

Application publication date: 20190423

RJ01 Rejection of invention patent application after publication