CN116208532A - Abnormality detection method, abnormality detection device, storage medium, and electronic apparatus - Google Patents

Abnormality detection method, abnormality detection device, storage medium, and electronic apparatus Download PDF

Info

Publication number
CN116208532A
CN116208532A CN202211733328.5A CN202211733328A CN116208532A CN 116208532 A CN116208532 A CN 116208532A CN 202211733328 A CN202211733328 A CN 202211733328A CN 116208532 A CN116208532 A CN 116208532A
Authority
CN
China
Prior art keywords
data
abnormal
node
operation data
memory
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202211733328.5A
Other languages
Chinese (zh)
Inventor
韩红瑞
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Suzhou Inspur Intelligent Technology Co Ltd
Original Assignee
Suzhou Inspur Intelligent Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Suzhou Inspur Intelligent Technology Co Ltd filed Critical Suzhou Inspur Intelligent Technology Co Ltd
Priority to CN202211733328.5A priority Critical patent/CN116208532A/en
Publication of CN116208532A publication Critical patent/CN116208532A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0823—Errors, e.g. transmission errors
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0654—Management of faults, events, alarms or notifications using network fault recovery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0677—Localisation of faults
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
    • Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
    • Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Abstract

The embodiment of the application provides an abnormality detection method, an abnormality detection device, a storage medium and electronic equipment, wherein the method comprises the following steps: acquiring abnormal data acquired by a data acquisition unit, and determining a node corresponding to the abnormal data on a server to obtain a first node; determining a node associated with the first node in a server to obtain at least one second node, and acquiring an operation data set fed back by a data storage, wherein the operation data set comprises operation data of the first node and operation data of the at least one second node; determining an abnormal grade of the abnormal data according to the operation data set, and sending the abnormal grade and the operation data set to the controller; and receiving an abnormality detection result returned by the controller according to the abnormality grade and the operation data. According to the method and the device, the problem that in the related technology, due to incomplete and untimely reported abnormal data, efficiency and accuracy of manually checking the fault cause of the server according to the abnormal data are low is solved.

Description

Abnormality detection method, abnormality detection device, storage medium, and electronic apparatus
Technical Field
The embodiment of the application relates to the field of computers, in particular to an abnormality detection method, an abnormality detection device, a storage medium and electronic equipment.
Background
In the current big data cloud computing era, along with the increasing of the scale and deployment density of the data center, a single data center can reach the server scale of tens of millions of levels, under the condition that the failure rate of the server is unchanged, the number of failures is increased along with the increasing of the scale, and huge challenges are brought to operation and maintenance work, but operation and maintenance staff are not increased. The current intelligent operation and maintenance system is increasingly put into use.
The current fault monitoring of the server is still in a primary fault monitoring stage, basically, after the BMC detects the relevant state, the BMC reports the relevant state to the operation and maintenance server, and then the BMC carries out relevant processing and analysis manually, even minimizes environment reproduction positioning or various replacement parts, so that the operation and maintenance time and cost are wasted, and meanwhile, the fault rate of some parts is increased.
The server abnormal faults have suddenly, unpredictability, difficult reproducibility and strong destructiveness, positioning after the occurrence of the problems is complex, the problem positioning and solving time is long, the operation and maintenance labor investment is large, the benefits are low, and the positioning and obstacle removing period is long and difficult to realize due to the fact that the positions of all paths of signal states are difficult to reproduce when the faults occur, so that the server cannot be quickly repaired, and the normal production operation is influenced.
Disclosure of Invention
The embodiment of the application provides an anomaly detection method, an anomaly detection device, a storage medium and electronic equipment, which are used for at least solving the problems of low efficiency and low accuracy of manually checking the failure cause of a server according to anomaly data due to incomplete and untimely reported anomaly data in the related technology.
According to an embodiment of the present application, there is provided an abnormality detection method including:
in an exemplary embodiment, acquiring abnormal data acquired in a data acquisition unit, and determining a node corresponding to the abnormal data on a server to obtain a first node; determining a node associated with the first node in a server to obtain at least one second node, and acquiring an operation data set fed back by a data storage, wherein the operation data set comprises operation data of the first node and operation data of the at least one second node; determining an abnormal grade of the abnormal data according to the operation data set, and sending the abnormal grade and the operation data set to the controller; and receiving an abnormality detection result returned by the controller according to the abnormality grade and the operation data.
Optionally, acquiring the abnormal data acquired in the data acquirer includes: acquiring an acquisition mode of a data acquisition device; under the condition that the acquisition mode is continuous acquisition, current data in the data acquisition device are acquired according to a first preset frequency, and abnormal data are acquired from the current data; judging whether an acquisition instruction sent by a controller is received under the condition that the acquisition mode is single acquisition, and acquiring historical data in a data acquisition unit under the condition that the acquisition instruction is received, wherein the historical data are operation data acquired by the data acquisition unit between the current time and the time of last receiving the acquisition instruction; detecting whether the historical data has abnormal data or not, and acquiring the abnormal data from the historical data when the abnormal data exists.
Optionally, after obtaining the abnormal data from the current data, the method further comprises: storing the current data into a data memory under the condition that no abnormal data exists in the current data; after detecting whether the abnormal data exists in the historical data, the method further comprises: in the case where there is no abnormal data in the history data, the history data is stored in the data memory.
Optionally, before acquiring the operation data set fed back by the data storage, the method further comprises: determining the time when the time difference with the current time is smaller than the preset time difference, and obtaining a plurality of pieces of time information; and transmitting the plurality of time information and the node information to a data memory, wherein the node information comprises the node information of the first node and the node information of at least one second node.
Optionally, determining the anomaly level of the anomaly data from the running data set includes: acquiring an initial grade of a first node; determining occurrence frequency of abnormal data according to the operation data; judging whether the occurrence frequency is larger than a preset frequency; when the occurrence frequency is greater than the preset frequency, the initial grade is adjusted, and the adjusted initial grade is used as the abnormal grade of the abnormal data; and determining the initial grade as the abnormal grade of the abnormal data under the condition that the occurrence frequency is less than or equal to the preset frequency.
Optionally, after acquiring the running data set fed back by the data storage, the method further comprises: acquiring the data storage amount of the data storage according to a preset time interval; judging whether the data storage amount is larger than or equal to a preset storage amount or not; and deleting the operation data in the data memory at the target time with the largest time difference with the current time under the condition that the data memory is larger than or equal to the preset memory.
Optionally, before deleting the operation data at the target time point with the maximum time difference from the current time point in the data storage, the method further includes: judging whether the operation data at the target time carries a preset mark or not, wherein the preset mark represents that the operation data set is not received within a preset time interval; under the condition that the running data at the target time carries the preset mark, the running data at the target time is reserved, and the step of deleting the running data at the target time with the largest time difference from the current time in the data memory is re-executed in the rest running data of the data memory until the data memory is smaller than the preset memory.
According to another embodiment of the present application, there is provided an abnormality detection apparatus including: the first acquisition unit is used for acquiring the abnormal data acquired by the data acquisition unit, determining the corresponding node of the abnormal data on the server, and obtaining a first node; the second acquisition unit is used for determining the node associated with the first node in the server to obtain at least one second node and acquiring an operation data set fed back by the data storage, wherein the operation data set comprises the operation data of the first node and the operation data of the at least one second node; the first determining unit is used for determining the abnormal grade of the abnormal data according to the operation data set and sending the abnormal grade and the operation data set to the controller; and the receiving unit is used for receiving an abnormality detection result returned by the controller according to the abnormality grade and the operation data.
According to a further embodiment of the present application, there is also provided a computer readable storage medium having a computer program stored therein, wherein the computer program is arranged to perform the steps of any of the method embodiments described above when run.
According to a further embodiment of the present application, there is also provided an electronic device comprising a memory, in which a computer program is stored, and a processor arranged to run the computer program to perform the steps of any of the method embodiments described above.
According to the method and the device, the data acquisition device is used for acquiring the abnormal data in the server, determining the abnormal node generating the abnormal data in the server according to the abnormal data, simultaneously acquiring the node information of a plurality of nodes related to the abnormal node, simultaneously transmitting the information of the nodes to the data storage, acquiring the operation data of the nodes from the data storage, thereby ensuring the integrity of the data required by analyzing the abnormal reasons, and simultaneously determining the abnormal grade of the abnormality according to the information in the operation data after the operation data are acquired, and transmitting the abnormal grade and the operation data to the controller, so that the occurrence reason of the abnormality can be determined according to the abnormal grade and the operation data through the controller. Therefore, the problem that the efficiency and the accuracy of manually checking the fault reasons of the server according to the abnormal data are low due to incomplete and untimely reported abnormal data in the related technology can be solved, and the effects of rapidly and accurately detecting the abnormality of the server and determining the abnormality reasons of the server are achieved.
Drawings
Fig. 1 is a hardware block diagram of a mobile terminal of an abnormality detection method according to an embodiment of the present application;
FIG. 2 is a schematic diagram of an anomaly detection system according to an embodiment of the present application;
FIG. 3 is a flow chart of an anomaly detection method according to an embodiment of the present application;
FIG. 4 is a flow chart for determining anomaly level provided in accordance with an embodiment of the present application;
fig. 5 is a schematic diagram of an abnormality detection apparatus according to an embodiment of the present application.
Detailed Description
Embodiments of the present application will be described in detail below with reference to the accompanying drawings in conjunction with the embodiments.
It should be noted that the terms "first," "second," and the like in the description and claims of the present application and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order.
The method embodiments provided in the embodiments of the present application may be performed in a mobile terminal (electronic device), a computer terminal, or similar computing device. Taking the mobile terminal as an example, fig. 1 is a block diagram of a hardware structure of the mobile terminal of an anomaly detection method according to an embodiment of the present application. As shown in fig. 1, a mobile terminal may include one or more (only one is shown in fig. 1) processors 102 (the processor 102 may include, but is not limited to, a microprocessor MCU or a processing device such as a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 for communication functions and an input-output device 108. It will be appreciated by those skilled in the art that the structure shown in fig. 1 is merely illustrative and not limiting of the structure of the mobile terminal described above. For example, the mobile terminal may also include more or fewer components than shown in fig. 1, or have a different configuration than shown in fig. 1.
The memory 104 may be used to store a computer program, for example, a software program of application software and a module, such as a computer program corresponding to the abnormality detection method in the embodiment of the present application, and the processor 102 executes the computer program stored in the memory 104, thereby performing various functional applications and data processing, that is, implementing the method described above. Memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include memory remotely located relative to the processor 102, which may be connected to the mobile terminal via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.
The transmission device 106 is used to receive or transmit data via a network. Specific examples of the network described above may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, simply referred to as NIC) that can connect to other network devices through a base station to communicate with the internet. In one example, the transmission device 106 may be a Radio Frequency (RF) module, which is configured to communicate with the internet wirelessly.
For convenience of description, the following will describe some terms or terms related to the embodiments of the present application:
the BMC (Baseboard Management Controller ) can perform firmware upgrade on the machine, check the machine equipment and other operations when the machine is not started.
CPLD (Complex Programmable Logic Device ), users construct the digital integrated circuit of the logic function by their own needs, the timing control of controlling hardware on-off, etc. is used in the server in many cases.
GPIO (General Purpose Input Output, general purpose input/output) for signal communication using the high and low levels of the physical pins.
I 2 C (Inter-Integrated Circuit, internal integration circuit) is a serial communication bus, uses a multi-master-slave architecture, and is a simple, bidirectional two-wire synchronous serial bus.
In this embodiment, fig. 2 is a schematic diagram of an abnormality detection system according to an embodiment of the present application, and as shown in fig. 2, an optional abnormality detection system is used as an execution body to execute the foregoing abnormality detection method, where the abnormality detection system at least includes: server 201, data collector 202, processor 203, data storage 204, and controller 205.
The data collector 202 is connected to the server 201, and is configured to collect a plurality of data sent by the server 201, such as signal data, voltage data, and the like, and may also perform temporary storage of the data.
The processor 203 is connected to the data collector 202, the data storage 204, and the controller 205, and is configured to send data in the data collector 202 to the data storage 204 for storage, and at the same time, when an abnormality is detected in the data, take out the abnormal data and data related to the abnormal data from the data storage 204, and send the abnormal data and the data to the controller 205.
The controller 205 is configured to determine the cause of the abnormality from the abnormality data and the abnormality level of the abnormality data.
The data storage 204 is used to store operational data.
For example, the processor 203 may perform the following operations:
the method is mainly responsible for four parts of logic control, state data processing, state control and state monitoring.
1. The logic control mainly comprises whether to start data acquisition, report abnormal information, data locking strategy and the like.
2. The state data processing mainly comprises the steps of carrying out state management, state abnormality judgment, state data statistics, state data processing and the like on each monitored circuit state.
3. The state control is mainly responsible for controlling the switch state, the power-on and power-off sequence and the like of each circuit.
4. The state monitoring is mainly responsible for detecting the working state signals of each circuit
The data collector 202 may perform the following operations:
independent waveform acquisition and data buffering may be implemented. The system mainly comprises a state control part, a data processing part, a data caching part and a data acquisition part.
1. The state control is mainly responsible for the data acquisition state of acquisition, continuous acquisition, single acquisition, start-stop acquisition and the like.
2. The data processing is mainly responsible for carrying out data compression, data combination, invalid data processing and the like on the acquired waveform data of each circuit.
3. The data caching is mainly to cache the collected data. The data buffer memory distinguishes the A/B two blocks and is filled in turn.
In this embodiment, a method for operating on the mobile terminal (electronic device) is provided, fig. 3 is a flowchart of an anomaly detection method according to an embodiment of the present application, and as shown in fig. 3, the flowchart includes the following steps:
step S302, acquiring abnormal data acquired in a data acquisition unit, and determining a node corresponding to the abnormal data on a server to obtain a first node.
Specifically, the processor may be a CPLD device, and the MCU (Microcontroller Unit micro control unit) may acquire abnormal data acquired by the data collector, where the data collector may send operation data of the server to the processor according to a data sending instruction preset by the processor, where the operation data is key information such as a signal or a voltage value sent by a key circuit or a key component obtained by performing real-time monitoring on the data collector. After receiving the operation data, the processor determines whether abnormal data exists in the operation data, directly sends the data to the data storage under the condition that the abnormal data does not exist, and also needs to send the data to the data storage under the condition that the abnormal data exists, and meanwhile determines which fault source in the server sends the abnormal data according to the abnormal data, so that node information of the fault source is obtained.
Step S304, determining a node associated with the first node in the server to obtain at least one second node, and acquiring an operation data set fed back by the data storage, wherein the operation data set comprises operation data of the first node and operation data of the at least one second node.
Specifically, after the node information of the fault source is determined, the node information of other elements related to the fault source needs to be determined, so that the abnormal cause of the fault source can be more comprehensively analyzed when data analysis is performed.
Further, after determining the plurality of nodes related to the abnormal data, a data acquisition instruction needs to be sent to the data memory, so that the data stored at the time before the occurrence time of the abnormal data can be acquired from the data memory, and an operation data set can be obtained, so that the better cause of the abnormal occurrence can be determined.
Step S306, determining the abnormal grade of the abnormal data according to the operation data set, and sending the abnormal grade and the operation data set to the controller.
Specifically, after the operation data set is obtained, the abnormal level of the abnormality can be determined according to the historical data in the operation data set and the initial level of the fault source, and the abnormal level and the operation data set are jointly sent to the controller, so that preliminary fault analysis and positioning can be performed according to the abnormal data in the controller, if the cause can be positioned, a diagnosis result is issued to the processor, and if the cause cannot be positioned, the abnormal condition and the acquired data are reported to the staff, so that the abnormal cause is manually determined, the frequency of manually confirming the abnormal cause is reduced, and the working strength of the staff is reduced.
Step S308, an abnormality detection result returned by the controller according to the abnormality level and the operation data is received.
Specifically, after the controller returns the abnormal detection result, the abnormal detection result can be displayed, at this time, if the controller can solve the abnormality through executing part of operations, the controller processes the abnormality by itself, if the abnormality cannot be solved, an alarm message is sent to inform a worker of repairing the abnormal operation flow, and then the abnormality of the server can be rapidly solved.
The application comprises the following steps: the method comprises the steps of collecting abnormal data in a server through a data collector, determining abnormal nodes generating the abnormal data in the server according to the abnormal data, simultaneously obtaining node information of a plurality of nodes related to the abnormal nodes, simultaneously sending the information of the nodes to a data storage, obtaining operation data of the nodes from the data storage, and therefore achieving the purpose of guaranteeing the integrity of data required by analysis of abnormal reasons. Therefore, the problem that the efficiency and the accuracy of manually checking the fault reasons of the server according to the abnormal data are low due to incomplete and untimely reported abnormal data in the related technology can be solved, and the effects of rapidly and accurately detecting the abnormality of the server and determining the abnormality reasons of the server are achieved.
The main body of execution of the above steps may be a mobile terminal (electronic device), a computer terminal, or a similar computing device, but is not limited thereto.
Optionally, acquiring the abnormal data acquired in the data acquirer includes: acquiring an acquisition mode of a data acquisition device; under the condition that the acquisition mode is continuous acquisition, current data in the data acquisition device are acquired according to a first preset frequency, and abnormal data are acquired from the current data; judging whether an acquisition instruction sent by a controller is received under the condition that the acquisition mode is single acquisition, and acquiring historical data in a data acquisition unit under the condition that the acquisition instruction is received, wherein the historical data are operation data acquired by the data acquisition unit between the current time and the time of last receiving the acquisition instruction; detecting whether the historical data has abnormal data or not, and acquiring the abnormal data from the historical data when the abnormal data exists.
Specifically, after the MCU is powered on, the key voltage and the signal in the server are always acquired, at this time, the acquisition mode set in the data acquisition device by the user is required to be acquired, if the acquisition mode is continuous acquisition, the data acquisition device can send the operation data acquired in real time to the controller, the controller judges whether the received operation data has abnormal data or not, and acquires the abnormal data, if the operation data are acquired in a single time, the MCU stores the data in the cache of the MCU after acquiring the operation data, and after receiving a data acquisition instruction sent by the controller, the controller sends the historical operation data between the moment when the data acquisition instruction is received last time and the current moment to the controller, and the controller determines whether the abnormal data exist in a large number of the historical operation data and acquires the abnormal data, so that the acquisition of the operation data and the identification of the abnormal data can be carried out through different preset acquisition modes.
Optionally, after obtaining the abnormal data from the current data, the method further comprises: storing the current data into a data memory under the condition that no abnormal data exists in the current data; after detecting whether the abnormal data exists in the historical data, the method further comprises: in the case where there is no abnormal data in the history data, the history data is stored in the data memory.
Specifically, when no abnormal data exists in the operation data, the data is directly sent to the data storage, and when the abnormal data exists, the data is also required to be sent to the data storage, and meanwhile, according to the abnormal data, the fault source of the server from which the abnormal data is sent is determined, so that node information of the fault source is obtained.
Similarly, after the historical data is received, whether the historical operation data exist or not is identified, the historical operation data are stored under the condition that the historical operation data do not exist, the data are required to be sent to a data storage under the condition that the historical operation data exist, meanwhile, the fact that the abnormal operation data are sent by a fault source in a server is determined according to the abnormal operation data, so that node information of the fault source is obtained, the abnormal operation data and the non-abnormal operation data are stored while the abnormal operation data are processed, and the abnormal operation cause analysis can be carried out as reference data under the condition that the abnormal operation occurs again later.
Optionally, before acquiring the operation data set fed back by the data storage, the method further comprises: determining the time when the time difference with the current time is smaller than the preset time difference, and obtaining a plurality of pieces of time information; and transmitting the plurality of time information and the node information to a data memory, wherein the node information comprises the node information of the first node and the node information of at least one second node.
Specifically, when acquiring historical operation data from the data storage, it is necessary to confirm the generation time of the abnormal data first, determine the time when the time difference from the generation time is smaller than the preset time difference, obtain a plurality of time information, and send the plurality of time information to the data storage, so that the data before and after the time when the abnormal data is generated is acquired from the data storage, and thus the analysis of the cause of the abnormality can be performed according to the change rule of each operation data with time.
Optionally, fig. 4 is a flowchart for determining an anomaly level according to an embodiment of the present application, as shown in fig. 4, step S306 includes: step S402, obtaining an initial grade of a first node; step S404, determining occurrence frequency of abnormal data according to the operation data; step S406, judging whether the occurrence frequency is larger than a preset frequency; step S408, when the occurrence frequency is greater than the preset frequency, the initial grade is adjusted, and the adjusted initial grade is used as the abnormal grade of the abnormal data; in step S410, when the occurrence frequency is equal to or less than the preset frequency, the initial level is determined as the anomaly level of the anomaly data.
Specifically, when determining the abnormal level, it is first required to determine an initial level corresponding to the fault source generating the abnormal data, and adjust the initial level corresponding to the fault source according to a large amount of history information of the fault source, so as to obtain an updated level, and send the updated abnormal level to the controller, so that the controller can better process the abnormality.
For example, the severity level can be updated for repetitive anomalies, for example, the severity of a node is general, the anomalies do not affect the normal operation of the equipment, but if repeated anomalies occur within a unit time, for example, 24 hours, the link is judged to be unstable, and the link is updated to an important level for reporting.
It is also possible to raise the severity level of a general anomaly whose frequency is fast, for example: 2 times appear in the original 24 hours, 5 times appear now, the link instability is judged to be improved, and 1 serious grade is upgraded to report.
Optionally, after acquiring the running data set fed back by the data storage, the method further comprises: acquiring the data storage amount of the data storage according to a preset time interval; judging whether the data storage amount is larger than or equal to a preset storage amount or not; and deleting the operation data in the data memory at the target time with the largest time difference with the current time under the condition that the data memory is larger than or equal to the preset memory.
Specifically, since the memory capacity in the data memory is limited, it is necessary to determine the memory capacity of the data memory according to a preset time interval, and delete the data when the memory capacity of the data memory exceeds the preset memory capacity, so as to ensure that the data acquired recently can be normally stored, and delete the old data can relieve the memory pressure of the data memory. The collected data is directly input into the data buffer area for buffer storage.
It should be noted that the data memory may include two storage intervals, if the first storage area is full, the storage area is larger than the preset storage area, and the data needs to be deleted, so that the normal operation of the data memory is ensured.
Furthermore, in the data collector, two storage intervals can be set for caching the data which is not acquired by the processor in a short time, and the processor is required to determine whether the data exceeds the preset storage amount in the data collector according to the preset time interval, so that the data in the data collector cannot be lost due to the fact that the data are full.
Optionally, before deleting the operation data at the target time point with the maximum time difference from the current time point in the data storage, the method further includes: judging whether the operation data at the target time carries a preset mark or not, wherein the preset mark represents that the operation data set is not received within a preset time interval; under the condition that the running data at the target time carries the preset mark, the running data at the target time is reserved, and the step of deleting the running data at the target time with the largest time difference from the current time in the data memory is re-executed in the rest running data of the data memory until the data memory is smaller than the preset memory.
Specifically, the abnormal operation data cannot be uploaded to the MCU due to the abnormal operation of the MCU of the controller, at this time, the abnormal operation data needs to be added with a preset identifier and stored in the data memory, and then the data is transmitted after the MCU is normal, at this time, if the operation data carrying the identifier is not acquired for a long time, the operation data can be deleted overtime, at this time, the operation data carrying the preset identifier can be skipped by a method of identifying the preset identifier, and the deletion time is after the operation data but does not carry the operation data of the preset identifier, so that the important data is ensured not to be lost.
From the description of the above embodiments, it will be clear to a person skilled in the art that the method according to the above embodiments may be implemented by means of software plus the necessary general hardware platform, but of course also by means of hardware, but in many cases the former is a preferred embodiment. Based on such understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art in the form of a software product stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk), comprising several instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the method described in the embodiments of the present application.
In this embodiment, an abnormality detection device is further provided, and the abnormality detection device is used to implement the foregoing embodiments and preferred embodiments, and is not described in detail. As used below, the terms "unit," "module" may be a combination of software and/or hardware that implements a predetermined function. While the means described in the following embodiments are preferably implemented in software, implementation in hardware, or a combination of software and hardware, is also possible and contemplated.
Fig. 5 is a schematic diagram of an abnormality detection apparatus according to an embodiment of the present application, as shown in fig. 5, the apparatus includes:
the first obtaining unit 51 is configured to obtain the abnormal data collected in the data collector, determine a node corresponding to the abnormal data on the server, and obtain a first node.
The second obtaining unit 52 is configured to determine a node associated with the first node in the server, obtain at least one second node, and obtain an operation data set fed back by the data storage, where the operation data set includes operation data of the first node and operation data of the at least one second node.
The first determining unit 53 is configured to determine an anomaly level of the anomaly data according to the operation data set, and send the anomaly level and the operation data set to the controller.
And a receiving unit 54, configured to receive an abnormality detection result returned by the controller according to the abnormality level and the operation data.
According to the abnormality detection device provided by the embodiment of the application, the first obtaining unit 51 is configured to obtain the abnormal data collected in the data collector, determine the corresponding node of the abnormal data on the server, and obtain the first node. The second obtaining unit 52 is configured to determine a node associated with the first node in the server, obtain at least one second node, and obtain an operation data set fed back by the data storage, where the operation data set includes operation data of the first node and operation data of the at least one second node. The first determining unit 53 is configured to determine an anomaly level of the anomaly data according to the operation data set, and send the anomaly level and the operation data set to the controller. And a receiving unit 54, configured to receive an abnormality detection result returned by the controller according to the abnormality level and the operation data. The method comprises the steps of collecting abnormal data in a server through a data collector, determining abnormal nodes generating the abnormal data in the server according to the abnormal data, simultaneously obtaining node information of a plurality of nodes related to the abnormal nodes, simultaneously sending the information of the nodes to a data storage, obtaining operation data of the nodes from the data storage, and therefore achieving the purpose of guaranteeing the integrity of data required by analysis of abnormal reasons. Therefore, the problem that the efficiency and the accuracy of manually checking the fault reasons of the server according to the abnormal data are low due to incomplete and untimely reported abnormal data in the related technology can be solved, and the effects of rapidly and accurately detecting the abnormality of the server and determining the abnormality reasons of the server are achieved.
Alternatively, in the abnormality detection apparatus provided in the embodiment of the present application, the first acquisition unit 51 includes: the first acquisition module is used for acquiring an acquisition mode of the data acquisition device; the second acquisition module is used for acquiring current data in the data acquisition device according to a first preset frequency under the condition that the acquisition mode is continuous acquisition, and acquiring abnormal data from the current data; the first judging module is used for judging whether an acquisition instruction sent by the controller is received or not under the condition that the acquisition mode is single acquisition, and acquiring historical data in the data acquisition device under the condition that the acquisition instruction is received, wherein the historical data are operation data acquired by the data acquisition device between the current time and the time of last receiving the acquisition instruction; and the third acquisition module is used for detecting whether the historical data has abnormal data or not and acquiring the abnormal data from the historical data under the condition that the abnormal data exists.
Optionally, in the abnormality detection apparatus provided in the embodiment of the present application, the apparatus further includes: the first storage unit is used for storing the current data into the data memory under the condition that no abnormal data exists in the current data; the apparatus further comprises: and the second storage unit is used for storing the historical data into the data memory under the condition that the historical data does not contain abnormal data.
Optionally, in the abnormality detection apparatus provided in the embodiment of the present application, the apparatus further includes: a second determining unit, configured to determine a time when a time difference from a current time is less than a preset time difference, and obtain a plurality of time information; and the sending unit is used for sending the plurality of time information and the node information to the data memory, wherein the node information comprises the node information of the first node and the node information of at least one second node.
Alternatively, in the abnormality detection apparatus provided in the embodiment of the present application, the first determination unit 53 includes: a fourth obtaining module, configured to obtain an initial level of the first node; the first determining module is used for determining the occurrence frequency of abnormal data according to the operation data; the second judging module is used for judging whether the occurrence frequency is greater than a preset frequency; the adjusting module is used for adjusting the initial grade under the condition that the occurrence frequency is larger than the preset frequency, and taking the adjusted initial grade as the abnormal grade of the abnormal data; and the second determining module is used for determining the initial grade as the abnormal grade of the abnormal data under the condition that the occurrence frequency is smaller than or equal to the preset frequency.
Optionally, in the abnormality detection apparatus provided in the embodiment of the present application, the apparatus further includes: a third obtaining unit, configured to obtain a data storage amount of the data storage according to a preset time interval; the first judging unit is used for judging whether the data storage amount is larger than or equal to a preset storage amount or not; and the deleting unit is used for deleting the operation data in the data memory at the target time with the largest time difference with the current time under the condition that the data memory amount is larger than or equal to the preset memory amount.
Optionally, in the abnormality detection apparatus provided in the embodiment of the present application, the apparatus further includes: the second judging unit is used for judging whether the running data at the target moment carries a preset mark, wherein the preset mark represents that the running data set is not received within a preset time interval; and the execution unit is used for reserving the operation data at the target time under the condition that the operation data at the target time carries the preset mark, and re-executing the step of deleting the operation data at the target time with the largest time difference with the current time in the data memory in the rest operation data of the data memory until the data memory is smaller than the preset memory.
It should be noted that each of the above modules may be implemented by software or hardware, and for the latter, it may be implemented by, but not limited to: the modules are all located in the same processor; alternatively, the above modules may be located in different processors in any combination.
Embodiments of the present application also provide a computer readable storage medium having a computer program stored therein, wherein the computer program is arranged to perform the steps of any of the method embodiments described above when run.
In one exemplary embodiment, the computer readable storage medium may include, but is not limited to: a usb disk, a Read-Only Memory (ROM), a random access Memory (Random Access Memory, RAM), a removable hard disk, a magnetic disk, or an optical disk, or other various media capable of storing a computer program.
Embodiments of the present application also provide an electronic device comprising a memory having stored therein a computer program and a processor arranged to run the computer program to perform the steps of any of the method embodiments described above.
In an exemplary embodiment, the electronic device may further include a transmission device connected to the processor, and an input/output device connected to the processor.
Specific examples in this embodiment may refer to the examples described in the foregoing embodiments and the exemplary implementation, and this embodiment is not described herein.
It will be appreciated by those skilled in the art that the modules or steps of the application described above may be implemented in a general purpose computing device, they may be concentrated on a single computing device, or distributed across a network of computing devices, they may be implemented in program code executable by computing devices, so that they may be stored in a storage device for execution by computing devices, and in some cases, the steps shown or described may be performed in a different order than that shown or described herein, or they may be separately fabricated into individual integrated circuit modules, or multiple modules or steps of them may be fabricated into a single integrated circuit module. Thus, the present application is not limited to any specific combination of hardware and software.
The foregoing description is only of the preferred embodiments of the present application and is not intended to limit the same, but rather, various modifications and variations may be made by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the principles of the present application should be included in the protection scope of the present application.

Claims (10)

1. An abnormality detection method, comprising:
acquiring abnormal data acquired in a data acquisition unit, and determining a node corresponding to the abnormal data on a server to obtain a first node;
determining a node associated with the first node in the server to obtain at least one second node, and acquiring an operation data set fed back by a data storage, wherein the operation data set comprises operation data of the first node and operation data of the at least one second node;
determining an abnormal grade of the abnormal data according to the operation data set, and sending the abnormal grade and the operation data set to a controller;
and receiving an abnormality detection result returned by the controller according to the abnormality grade and the operation data.
2. The method of claim 1, wherein acquiring anomaly data acquired in the data acquisition unit comprises:
acquiring an acquisition mode of the data acquisition device;
under the condition that the acquisition mode is continuous acquisition, current data in the data acquisition device are acquired according to a first preset frequency, and abnormal data are acquired from the current data;
judging whether an acquisition instruction sent by the controller is received or not under the condition that the acquisition mode is single acquisition, and acquiring historical data in the data acquisition device under the condition that the acquisition instruction is received, wherein the historical data is operation data acquired by the data acquisition device between the current time and the time of last receiving the acquisition instruction;
detecting whether abnormal data exists in the historical data, and acquiring the abnormal data from the historical data when the abnormal data exists.
3. The method of claim 2, wherein after obtaining exception data from the current data, the method further comprises:
storing the current data into the data memory under the condition that no abnormal data exists in the current data;
after detecting whether there is abnormal data in the history data, the method further includes:
storing the history data in the data memory in the case that the abnormal data does not exist in the history data.
4. The method of claim 1, wherein prior to obtaining the operational data set for the data store feedback, the method further comprises:
determining the time when the time difference with the current time is smaller than the preset time difference, and obtaining a plurality of pieces of time information;
and sending the plurality of time information and node information to the data memory, wherein the node information comprises the node information of the first node and the node information of the at least one second node.
5. The method of claim 1, wherein determining an anomaly level of the anomaly data from the set of operational data comprises:
acquiring an initial grade of the first node;
determining occurrence frequency of the abnormal data according to the operation data;
judging whether the occurrence frequency is larger than a preset frequency or not;
when the occurrence frequency is greater than the preset frequency, the initial grade is adjusted, and the adjusted initial grade is used as the abnormal grade of the abnormal data;
and determining the initial grade as the abnormal grade of the abnormal data under the condition that the occurrence frequency is smaller than or equal to the preset frequency.
6. The method of claim 1, wherein after obtaining the operational data set for the data store feedback, the method further comprises:
acquiring the data storage amount of the data storage according to a preset time interval;
judging whether the data storage amount is larger than or equal to a preset storage amount or not;
and deleting the operation data in the data memory at the target time with the maximum time difference from the current time under the condition that the data memory is larger than or equal to the preset memory.
7. The method of claim 6, wherein prior to deleting the operational data in the data store at the target time instant having the greatest time difference from the current time instant, the method further comprises:
judging whether the operation data at the target time carries a preset mark or not, wherein the preset mark represents that the operation data set is not received within a preset time interval;
and under the condition that the running data at the target time carries the preset mark, reserving the running data at the target time, and re-executing the step of deleting the running data at the target time with the largest time difference with the current time in the data memory in the rest running data of the data memory until the data memory is smaller than the preset memory.
8. An abnormality detection apparatus, comprising:
the first acquisition unit is used for acquiring the abnormal data acquired by the data acquisition unit, determining the corresponding node of the abnormal data on the server, and obtaining a first node;
the second acquisition unit is used for determining the node associated with the first node in the server to obtain at least one second node and acquiring an operation data set fed back by the data storage, wherein the operation data set comprises the operation data of the first node and the operation data of the at least one second node;
the first determining unit is used for determining the abnormal grade of the abnormal data according to the operation data set and sending the abnormal grade and the operation data set to the controller;
and the receiving unit is used for receiving an abnormality detection result returned by the controller according to the abnormality grade and the operation data.
9. A computer readable storage medium, characterized in that a computer program is stored in the computer readable storage medium, wherein the computer program, when being executed by a processor, implements the steps of the method according to any of the claims 1 to 7.
10. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the steps of the method of any one of claims 1 to 7 when the computer program is executed.
CN202211733328.5A 2022-12-30 2022-12-30 Abnormality detection method, abnormality detection device, storage medium, and electronic apparatus Pending CN116208532A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202211733328.5A CN116208532A (en) 2022-12-30 2022-12-30 Abnormality detection method, abnormality detection device, storage medium, and electronic apparatus

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202211733328.5A CN116208532A (en) 2022-12-30 2022-12-30 Abnormality detection method, abnormality detection device, storage medium, and electronic apparatus

Publications (1)

Publication Number Publication Date
CN116208532A true CN116208532A (en) 2023-06-02

Family

ID=86510515

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202211733328.5A Pending CN116208532A (en) 2022-12-30 2022-12-30 Abnormality detection method, abnormality detection device, storage medium, and electronic apparatus

Country Status (1)

Country Link
CN (1) CN116208532A (en)

Similar Documents

Publication Publication Date Title
CN103812726A (en) Automated testing method and device for data communication equipment
CN112733369B (en) Intelligent equipment maintenance method, terminal and system and electronic equipment
CN108847879B (en) Double-machine fault detection and recovery method based on bus controller
CN112698989A (en) Dual-computer mutual backup method and system of data acquisition system
CN112988537A (en) Server fault diagnosis method and device and related equipment
CN114510378A (en) Parameter backup method and device for air conditioning unit and electronic equipment
CN110794189A (en) Data acquisition method and device and related equipment
CN104579717A (en) Method and device for locating fault of DCN
CN101854263B (en) Method, system and management server for analysis processing of network topology
CN111880992B (en) Monitoring and maintaining method for controller state in storage device
CN108064054B (en) FTP file transmission monitoring method and system in LTE system
CN111010706B (en) Abnormality recovery method and device
CN110224872B (en) Communication method, device and storage medium
JPH09205429A (en) Network fault diagnostic device, fault prediction device, and its diagnostic and prediction method
JP2006121692A (en) System for previously checking corrective action for parameterable element causing problem in communication network
CN100421381C (en) Method and device for obtaining information of operation and failure state for network equipment
CN116208532A (en) Abnormality detection method, abnormality detection device, storage medium, and electronic apparatus
CN113810238A (en) Network monitoring method, electronic device and storage medium
CN111078484A (en) Power-off test method, device, equipment and storage medium for system upgrading
CN114500178A (en) Intelligent internet of things gateway capable of self-operation and self-maintenance
CN114069624A (en) Power grid fault recovery system and method
CN110569047A (en) method for remotely updating human-computer interface based on detachable communication module
CN105044552A (en) Fault diagnosis method, system and device for distribution network automation system
KR20180113957A (en) Apparatus and method for acquiring data
CN116032720A (en) Information recovery method, device, electronic equipment and storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination