CN111290903B - Software system monitoring method and device based on user behavior and machine learning - Google Patents

Abstract

Embodiments of the present invention provide a software system monitoring method and device based on user behavior and machine learning. The method includes: obtaining the number of logged-in users at the current moment; if it is determined that the number of logged-in users at the current moment is greater than the current warning threshold, A warning message will be issued. The software system monitoring method and device based on user behavior and machine learning provided by the embodiments of the present invention can monitor the operating status of the system in real time by setting a dynamic early warning threshold, thereby improving the accuracy and timeliness of system monitoring.

Description

Software system monitoring method and device based on user behavior and machine learning

technical field

The embodiments of the present invention relate to the technical field of system monitoring, in particular to a software system monitoring method and device based on user behavior and machine learning.

Background technique

The monitoring of the software system is very important to the stability of the software system. Through the monitoring of the software system, the abnormality of the software system can be discovered in time, and the relevant operation and maintenance personnel can be notified by SMS, email, etc.

In the prior art, the status of the target software system is monitored by linking the target software system into the dial-up testing system and periodically dial-up testing. During the dial-up test, the target software system needs to prepare the dial-up test link in advance, add the dial-up test plan, set the dial-up test frequency, etc. After it is enabled, the dial test system will visit the dial test link regularly, and judge the status of the target software system according to the returned results or whether there is any return. Specifically, if the target software system does not return, or if the return is considered abnormal from the perspective of the dial test system, it is determined that the target software system has an abnormality. At this time, the relevant operation and maintenance personnel will be notified by SMS or email.

However, the dial-up test system needs dial-up links, which are often old ones. For example, the target software system homepage, if the coverage is not enough, other links need to be added. The dial-up test frequency should not be lower than the user frequency, otherwise the monitoring effect will not be achieved. Invisibly increases the use pressure of the software system, and at the same time mechanically checks the link to return the result, and only sends an alarm when the software system is abnormal, and does not play a substantial role in the software system that is frequently used by users.

Contents of the invention

The purpose of the embodiments of the present invention is to provide a software system monitoring method and device based on user behavior and machine learning that overcomes the above problems or at least partially solves the above problems.

In order to solve the above technical problems, on the one hand, an embodiment of the present invention provides a method for monitoring a software system, including:

Get the number of logged-in users at the current moment;

If it is judged that the number of logged-in users at the current moment is greater than the early warning threshold at the current moment, an early warning message is issued.

On the other hand, an embodiment of the present invention provides a software system monitoring device, including:

The obtaining module is used to obtain the number of logged-in users at the current moment;

The early warning module is used to issue early warning information if it is determined that the number of logged-in users at the current moment is greater than the early warning threshold at the current moment.

In another aspect, an embodiment of the present invention provides an electronic device, including:

A memory and a processor, the processor and the memory communicate with each other through a bus; the memory stores program instructions that can be executed by the processor, and the processor invokes the program instructions to perform the above-mentioned method.

In yet another aspect, an embodiment of the present invention provides a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the above method is implemented.

The software system monitoring method and device provided by the embodiments of the present invention monitor the operating status of the system in real time by setting a dynamic early warning threshold, thereby improving the accuracy and timeliness of system monitoring.

Description of drawings

FIG. 1 is a schematic diagram of a software system monitoring method provided by an embodiment of the present invention;

2 is a schematic diagram of a software system monitoring device provided by an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of an electronic device provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts fall within the protection scope of the present invention.

FIG. 1 is a schematic diagram of a software system monitoring method provided by an embodiment of the present invention. As shown in FIG. 1 , an embodiment of the present invention provides a software system monitoring method, the execution subject of which is a software system monitoring device, and the method includes:

Step S101, obtaining the number of logged-in users at the current moment;

Step S102 , if it is determined that the number of logged-in users at the current time is greater than the current warning threshold, then send a warning message.

Specifically, the software system monitoring method provided by the embodiment of the present invention establishes an effective method that can continuously reflect the usage of the system, improves the real-time performance of monitoring, and cooperates with other monitoring methods to achieve the original goal of monitoring work.

Since the usage of the system changes from time to time, the monitoring and early warning threshold of the software system monitoring method provided by the embodiment of the present invention should also change from time to time, so that the timeliness and accuracy of the early warning can be guaranteed.

First, get the number of logged-in users at the current moment. In order to reflect the system usage in real time, the number of logged-in users in the system during the time period is extracted as the key data. At the same time, considering the complexity and feasibility of the algorithm, it is necessary to set the time granularity within a reasonable range. If the granularity is too small, then It will consume huge computing resources, and the granularity is too large, which will not achieve a good real-time monitoring effect. After the investigation of the actual situation and the test results, it is more appropriate to use minutes as the granularity of time for statistics, that is, in terms of the length of the time interval, minutes are finally determined as the statistical unit period for data acquisition, calculation, and system. Dynamic warning. The number of logged-in users at the current moment can be a certain sampling data within the current minute, or the average value of each sampling data, which can be determined according to the actual situation.

After obtaining the number of logged-in users at the current moment, if it is judged that the number of logged-in users at the current moment is greater than the early-warning threshold at the current moment, an early-warning message is issued. The operation and maintenance personnel can be notified by SMS or email for timely processing.

If it is judged that the number of logged-in users at the current moment is less than or equal to the warning threshold at the current moment, it means that the system is normal and no warning information is issued.

Among them, the early warning threshold at the current moment is calculated based on the historical data through the preset machine learning model, and the early warning threshold at different moments is different, so as to achieve a dynamic, real-time and accurate early warning effect.

For example, the number of logged-in users obtained at the current moment is 100. If the calculated warning threshold at the current moment is 90, it means that the current number of logged-in users exceeds the warning threshold at the current moment. Operation and maintenance personnel, in order to make timely processing.

The software system monitoring method provided by the embodiment of the present invention monitors the operating state of the system in real time by setting a dynamic early warning threshold, thereby improving the accuracy and timeliness of system monitoring.

On the basis of the above embodiments, further, if it is judged that the number of logged-in users at the current moment is greater than the early warning threshold at the current moment, before sending the early warning information, it also includes:

Obtain several weeks of historical data, the historical data includes the number of logged-in users at each moment, the warning status at each moment, and the historical warning threshold at each moment;

The historical data or a part of the historical data is input into a preset machine learning model, and an early warning threshold at the current moment is output.

Specifically, the software system monitoring method provided by the embodiment of the present invention uses the preset machine learning model to calculate the current warning threshold based on historical data. , Accurate early warning effect.

Before the early warning, firstly, several weeks of historical data are obtained. The historical data includes the number of logged-in users at each moment, the early warning status at each moment, and the historical early warning threshold at each moment.

Then, input the historical data or a part of the historical data into the preset machine learning model, and output the early warning threshold at the current moment.

The size of the historical data obtained can be determined according to the actual situation, because the usage of the system shows periodic changes on a weekly basis. Therefore, when calculating the early warning threshold, this actual situation should be considered. Week is the length of time, for example, to obtain 12 weeks of historical data.

The machine learning model is pre-designed. Using the machine learning model to calculate the early warning threshold has a low degree of manual intervention and has an objective reference value, making the current early warning threshold more reasonable and accurate.

The software system monitoring method provided by the embodiment of the present invention dynamically calculates the early warning threshold at the current moment through the machine learning model, and dynamically tracks the current number of logged-in users, monitors the operating status of the system in real time, and improves the accuracy and timeliness of system monitoring sex.

On the basis of the above embodiments, further, the machine learning model is specifically:

为所有的历史预警阈值的平均值，X_i表示当前时刻所在周之前的第i周的同一时刻的登录用户数，N为所述若干个周的数量，N＞m。Among them, Y _t is the early warning threshold at the current moment, Z is the maximum number of users that the system can carry, B _t-1 is the early warning status at the same time in the first week before the current moment, and the value of B _t-1 is taken as 0 or 1, S _t-1 ＝0 indicates that no early warning information was issued at the same time in the first week before the current time, and B _t-1 ＝1 indicates that an early warning was issued at the same time in the first week before the current time Information, B _t-2 is the warning state at the same time of the week before the current moment, the value of B _t-2 is 0 or 1, B _t-2 = 0 means the second week before the week of the current moment No early warning information was issued at the same time of the week, B _t-2 = 1 means that the early warning information was issued at the same time in the second week before the current time, and B _tm is the warning status at the same time in the mth week before the current time. , the value of B _tm is 0 or 1, B _tm = 0 means that the warning information is not issued at the same time in the mth week before the current time, B _tm = 1 means that the current time is issued at the same time in the mth week before the week The early warning information, Y _t-1 is the early warning threshold at the same time in the first week before the current time,

is the average value of all historical early warning thresholds, _Xi represents the number of logged-in users at the same time in the i-th week before the current time, N is the number of weeks, and N>m.

Specifically, for example, the minute is the granularity of time, the current time is the 7th minute of Wednesday in the 13th week of 2018, and the historical data of 12 weeks is obtained, that is, N=12. In addition, m=3, that is , to analyze the warning status at the same time in the 3 weeks before the current time.

The machine learning model is specifically:

为所有的历史预警阈值的平均值，X_i表示2018年第13周之前的第i周的星期三的第7分钟的登录用户数，例如，X₂为2018年第11周的星期三的第7分钟的登录用户数。Among them, Y _t is the warning threshold at the 7th minute on Wednesday of the 13th week in 2018, Z is the maximum number of users that the system can carry, and B _t-1 is the warning status at the 7th minute of Wednesday in the 12th week of 2018 , the value of B _t-1 is 0 or 1, B _t-1 = 0 means that no warning information was issued on the 7th minute of Wednesday of the 12th week in 2018, B _t-1 = 1 means that An early warning message was issued at the 7th minute, B _t-2 is the warning status at the 7th minute on Wednesday of the 11th week of 2018, the value of S _t-2 is 0 or 1, B _t-2 = 0 means the 11th week of 2018 No early warning information was issued on the 7th minute of Wednesday of the week, B _t-2 = 1 means that an early warning information was issued on the 7th minute of Wednesday of the 11th week of 2018, B _t-3 is the 7th of Wednesday of the 10th week of 2018 Minute warning status, the value of B _tm is 0 or 1, B _t-3 = 0 means that no warning information was issued on the 7th minute of Wednesday in the 10th week of 2018, B _t-3 = 1 means that the 10th week of 2018 The warning message was issued on the 7th minute of Wednesday, Y _t-1 is the warning threshold of the 7th minute of Wednesday in the 12th week of 2018,

is the average value of all historical warning thresholds, X _i represents the number of logged-in users at the 7th minute of the Wednesday of the i-th week before the 13th week of 2018, for example, X ₂ is the 7th minute of the Wednesday of the 11th week of 2018 The number of logged-in users.

The software system monitoring method provided by the embodiment of the present invention dynamically calculates the early warning threshold at the current moment through the machine learning model, and dynamically tracks the current number of logged-in users, monitors the operating status of the system in real time, and improves the accuracy and timeliness of system monitoring sex.

On the basis of the above embodiments, further, after outputting the warning threshold, it further includes:

According to the number of logged-in users at the current moment and the early warning threshold at the current moment, a dynamic visual monitoring map is generated.

Specifically, in order to facilitate the operation and maintenance personnel to intuitively monitor the operation of the system, a dynamic visual monitoring graph is generated according to the number of logged-in users at the current moment and the warning threshold at the current moment, that is, the number of logged-in users and the warning threshold are represented by the dynamic curve The form is displayed, and the operation and maintenance personnel can intuitively monitor the operation status according to the dynamic visual monitoring diagram.

The obtained number of logged-in users at the current moment and the warning threshold at the current moment are stored in the Oracle database to support fast data query of dynamic visual monitoring graphs.

The software system monitoring method provided by the embodiment of the present invention dynamically calculates the early warning threshold at the current moment through the machine learning model, and dynamically tracks the current number of logged-in users, monitors the operating status of the system in real time, and improves the accuracy and timeliness of system monitoring sex.

On the basis of the above embodiments, further, the acquisition of the number of logged-in users at the current moment specifically includes:

Obtain the system log information at the current moment;

The number of logged-in users at the current moment is extracted from the system log information.

Specifically, the analysis program is developed through the J2EE framework, and key data is captured from a large number of basic log data storage ES.

First, get the syslog at the current moment. System log information includes various system login logs and operation logs.

Then, the number of logged-in users at the current moment is extracted from the system log information.

The software system monitoring method provided by the embodiment of the present invention dynamically calculates the early warning threshold at the current moment through the machine learning model, and dynamically tracks the current number of logged-in users, monitors the operating status of the system in real time, and improves the accuracy and timeliness of system monitoring sex.

FIG. 2 is a schematic diagram of a software system monitoring device provided by an embodiment of the present invention. As shown in FIG. 2 , an embodiment of the present invention provides a software system monitoring device for performing the method described in any of the above embodiments, specifically including obtaining Module 201 and early warning module 202, wherein:

The obtaining module 201 is used to obtain the number of logged-in users at the current moment; the early-warning module 202 is used to issue a warning message if it is determined that the number of logged-in users at the current moment is greater than the current warning threshold.

Specifically, the software system monitoring method provided by the embodiment of the present invention establishes an effective method that can continuously reflect the usage of the system, improves the real-time performance of monitoring, and cooperates with other monitoring methods to achieve the original goal of monitoring work.

Since the usage of the system changes from time to time, the monitoring and early warning threshold of the software system monitoring method provided by the embodiment of the present invention should also change from time to time, so that the timeliness and accuracy of the early warning can be guaranteed.

First, the number of logged-in users at the current moment is acquired through the acquisition module 201 . In order to reflect the system usage in real time, the number of logged-in users in the system during the time period is extracted as the key data. At the same time, considering the complexity and feasibility of the algorithm, it is necessary to set the time granularity within a reasonable range. If the granularity is too small, then It will consume huge computing resources, and the granularity is too large, which will not achieve a good real-time monitoring effect. After the investigation of the actual situation and the test results, it is more appropriate to use minutes as the granularity of time for statistics, that is, in terms of the length of the time interval, minutes are finally determined as the statistical unit period for data acquisition, calculation, and system. Dynamic warning. The number of logged-in users at the current moment can be a certain sampling data within the current minute, or the average value of each sampling data, which can be determined according to the actual situation.

After obtaining the number of logged-in users at the current moment, if the early-warning module 202 determines that the number of logged-in users at the current moment is greater than the warning threshold at the current moment, an early-warning message will be issued. The operation and maintenance personnel can be notified by SMS or email for timely processing.

If it is judged that the number of logged-in users at the current moment is less than or equal to the warning threshold at the current moment, it means that the system is normal and no warning information is issued.

Among them, the early warning threshold at the current moment is calculated based on the historical data through the preset machine learning model, and the early warning threshold at different moments is different, so as to achieve a dynamic, real-time and accurate early warning effect.

For example, the number of logged-in users obtained at the current moment is 100. If the calculated warning threshold at the current moment is 90, it means that the current number of logged-in users exceeds the warning threshold at the current moment. Operation and maintenance personnel, in order to make timely processing.

The software system monitoring device provided by the embodiment of the present invention monitors the operating state of the system in real time by setting a dynamic early warning threshold, thereby improving the accuracy and timeliness of system monitoring.

On the basis of the above embodiments, it further includes a calculation module,

The calculation module is used to obtain several weeks of historical data, the historical data including the number of logged-in users at each moment, the warning status at each moment, and the historical warning threshold at each moment;

The historical data or a part of the historical data is input into a preset machine learning model, and an early warning threshold at the current moment is output.

Specifically, the software system monitoring device provided by the embodiment of the present invention uses the preset machine learning model to calculate the current warning threshold according to the historical data. , Accurate early warning effect.

Before the early warning, firstly, several weeks of historical data are obtained through the calculation module. The historical data includes the number of logged-in users at each moment, the early warning status at each moment, and the historical early warning threshold at each moment.

Then, input the historical data or a part of the historical data into the preset machine learning model, and output the early warning threshold at the current moment.

The size of the historical data obtained can be determined according to the actual situation, because the usage of the system shows periodic changes on a weekly basis. Therefore, when calculating the early warning threshold, this actual situation should be considered. Week is the length of time, for example, to obtain 12 weeks of historical data.

The machine learning model is pre-designed. Using the machine learning model to calculate the early warning threshold has a low degree of manual intervention and has an objective reference value, making the current early warning threshold more reasonable and accurate.

The software system monitoring device provided by the embodiment of the present invention dynamically calculates the warning threshold at the current moment through the machine learning model, and dynamically tracks the current number of logged-in users, monitors the operating status of the system in real time, and improves the accuracy and timeliness of system monitoring sex.

FIG. 3 is a schematic structural diagram of an electronic device provided by an embodiment of the present invention. As shown in FIG. 3 , the device includes: a processor 301, a memory 302, and a bus 303;

Wherein, the processor 301 and the memory 302 complete mutual communication through the bus 303;

The processor 301 is used to call the program instructions in the memory 302 to execute the methods provided by the above method embodiments, for example including:

Get the number of logged-in users at the current moment;

If it is judged that the number of logged-in users at the current moment is greater than the early warning threshold at the current moment, an early warning message is issued.

An embodiment of the present invention provides a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer, The computer can execute the methods provided by the above method embodiments, including, for example:

Get the number of logged-in users at the current moment;

If it is judged that the number of logged-in users at the current moment is greater than the early warning threshold at the current moment, an early warning message is issued.

An embodiment of the present invention provides a non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the methods provided in the above method embodiments, for example include:

Get the number of logged-in users at the current moment;

If it is judged that the number of logged-in users at the current moment is greater than the early warning threshold at the current moment, an early warning message is issued.

Those of ordinary skill in the art can understand that all or part of the steps for realizing the above-mentioned method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

The above-described embodiments of devices and equipment are merely illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, That is, it can be located in one place, or it can also be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without any creative efforts.

Through the above description of the implementations, those skilled in the art can clearly understand that each implementation can be implemented by means of software plus a necessary general hardware platform, and of course also by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic discs, optical discs, etc., including several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) execute the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (10)

1. A software system monitoring method, characterized in that, comprising: Get the number of logged-in users at the current moment; If it is judged that the number of logged-in users at the current moment is greater than the early warning threshold at the current moment, an early warning message is issued; If it is judged that the number of logged-in users at the current moment is greater than the early warning threshold at the current moment, before sending the early warning information, it also includes: Obtain several weeks of historical data, the historical data includes the number of logged-in users at each moment, the warning status at each moment, and the historical warning threshold at each moment; Input the historical data or a part of the historical data into a preset machine learning model, and output the warning threshold at the current moment; The machine learning model is specifically:

Among them, Y _t is the early warning threshold at the current moment, Z is the maximum number of users that the system can carry, B _t-1 is the early warning status at the same time in the first week before the current moment, and the value of B _t-1 is taken as 0 or 1, B _t-1 = 0 means that no warning information was issued at the same time in the first week before the current time, and B _t-1 = 1 means that an early warning was issued at the same time in the first week before the current time Information, B _t-2 is the warning state at the same time of the week before the current moment, the value of B _t-2 is 0 or 1, B _t-2 = 0 means the second week before the week of the current moment No early warning information was issued at the same time of the week, B _t-2 = 1 means that the early warning information was issued at the same time in the second week before the current time, and B _tm is the warning status at the same time in the mth week before the current time. , the value of B _tm is 0 or 1, B _tm = 0 means that the warning information is not issued at the same time in the m-th week before the current time, B _tm = 1 means that the warning information is issued at the same time in the m-th week before the current time The early warning information, Y _t-1 is the early warning threshold at the same time in the first week before the current time,

is the average value of all historical early warning thresholds, _Xi represents the number of logged-in users at the same time in the i-th week before the current time, N is the number of weeks, and N>m. 2. The method according to claim 1, characterized in that, after said outputting said warning threshold, further comprising: According to the number of logged-in users at the current moment and the early warning threshold at the current moment, a dynamic visual monitoring map is generated. 3. The method according to claim 1, wherein said obtaining the number of logged-in users at the current moment specifically comprises: Obtain the system log information at the current moment; The number of logged-in users at the current moment is extracted from the system log information. 4. The method according to claim 3, wherein the system log information includes each system login log and operation log. 5. A software system monitoring device, characterized in that, comprising: The obtaining module is used to obtain the number of logged-in users at the current moment; The early warning module is used to send early warning information if it is judged that the number of logged-in users at the current moment is greater than the early warning threshold at the current moment; Computational modules are also included, The calculation module is used to obtain several weeks of historical data, the historical data including the number of logged-in users at each moment, the warning status at each moment, and the historical warning threshold at each moment; Input the historical data or a part of the historical data into a preset machine learning model, and output the warning threshold at the current moment; The machine learning model is specifically:

Among them, Y _t is the early warning threshold at the current moment, Z is the maximum number of users that the system can carry, B _t-1 is the early warning status at the same time in the first week before the current moment, and the value of B _t-1 is taken as 0 or 1, B _t-1 = 0 means that no warning information was issued at the same time in the first week before the current time, and B _t-1 = 1 means that an early warning was issued at the same time in the first week before the current time Information, B _t-2 is the warning state at the same time of the week before the current moment, the value of B _t-2 is 0 or 1, B _t-2 = 0 means the second week before the week of the current moment No early warning information was issued at the same time of the week, B _t-2 = 1 means that the early warning information was issued at the same time in the second week before the current time, and B _tm is the warning status at the same time in the mth week before the current time. , the value of B _tm is 0 or 1, B _tm = 0 means that the warning information is not issued at the same time in the mth week before the current time, B _tm = 1 means that the current time is issued at the same time in the mth week before the week The early warning information, Y _t-1 is the early warning threshold at the same time in the first week before the current time,

is the average value of all historical warning thresholds, _Xi represents the number of logged-in users at the same time in the i-th week before the current time, N is the number of weeks, and N>m. 6. The device according to claim 5, further comprising a generation module, According to the number of logged-in users at the current moment and the early warning threshold at the current moment, a dynamic visual monitoring map is generated. 7. The device according to claim 5, wherein said obtaining the number of logged-in users at the current moment specifically comprises: Obtain the system log information at the current moment; The number of logged-in users at the current moment is extracted from the system log information. 8 . The device according to claim 7 , wherein the system log information includes system login logs and operation logs. 9. An electronic device, characterized in that it comprises: A memory and a processor, the processor and the memory communicate with each other through a bus; the memory stores program instructions executable by the processor, and the processor invokes the program instructions to execute the The method described in any one of 1 to 4 is required. 10. A non-transitory computer-readable storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images