CN117170989A

CN117170989A - Processing method and device of equipment performance data, computer equipment and storage medium

Info

Publication number: CN117170989A
Application number: CN202311229349.8A
Authority: CN
Inventors: 闫美阳
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2023-09-21
Filing date: 2023-09-21
Publication date: 2023-12-05

Abstract

The application relates to a processing method and device of equipment performance data, computer equipment and a storage medium, and relates to the technical field of artificial intelligence. The method comprises the following steps: acquiring quantitative performance data and qualitative performance data of equipment to be detected in the running process; analyzing the quantitative performance data and the qualitative performance data, and determining abnormal performance data from the quantitative performance data and the qualitative performance data according to an analysis result; determining root-cause performance data causing abnormality of equipment to be detected according to the abnormal performance data; according to the root performance data, the abnormal data early warning is carried out on the equipment to be detected, so that a worker receiving the abnormal data early warning can more quickly determine the abnormal position of the equipment to be detected, and the abnormal maintenance efficiency of the equipment to be detected is improved.

Description

Processing method and device of equipment performance data, computer equipment and storage medium

Technical Field

The present application relates to the field of artificial intelligence technologies, and in particular, to a method and apparatus for processing device performance data, a computer device, and a storage medium.

Background

Along with the continuous development of computer technology, various computer devices play an important role in daily work and life of people, and in order to ensure continuous and stable operation of the computer devices, an early warning component needs to be arranged in the computer devices so as to realize early warning and monitoring on the computer devices through the early warning component and perform abnormal early warning when the computer devices fail.

In the prior art, by collecting performance indexes of a certain dimension of equipment to be detected (namely computer equipment to be detected) and carrying out index analysis on the performance indexes, whether the equipment to be detected needs abnormal index early warning or not is determined; however, in the prior art, when performing index analysis, the performance index of a single dimension adopted cannot fully reflect the operation condition of the equipment to be detected, so that the prior art cannot accurately perform abnormal index early warning.

Disclosure of Invention

In view of the foregoing, it is desirable to provide a method, an apparatus, a computer device, and a storage medium for processing device performance data, which are capable of accurately performing abnormality index early warning on a device to be detected.

In a first aspect, the present application provides a method for processing device performance data. The method comprises the following steps:

Acquiring quantitative performance data and qualitative performance data of equipment to be detected in the running process;

analyzing the quantitative performance data and the qualitative performance data, and determining abnormal performance data from the quantitative performance data and the qualitative performance data according to an analysis result;

determining root-cause performance data causing abnormality of equipment to be detected according to the abnormal performance data;

and carrying out abnormal data early warning on the equipment to be detected according to the root performance data.

In one embodiment, determining the root cause performance data that causes the abnormality of the device to be detected based on the abnormality performance data includes:

determining at least two associated abnormal data with a time association relationship from the abnormal performance data according to the data acquisition time of the abnormal performance data;

determining whether each associated abnormal data belongs to the same index level; wherein, the index level comprises a business index level, an application index level and an infrastructure index level from high to low;

if so, determining root performance data causing abnormality of the equipment to be detected according to the data flow direction relations among different index levels and the predicted abnormality data of the equipment to be detected; the prediction abnormal data are obtained according to the qualitative performance data;

If not, determining root performance data which cause abnormality of the equipment to be detected according to the quantity of the associated abnormal data belonging to the downstream index level; the downstream index level refers to the lowest index level corresponding to each associated abnormal data.

In one embodiment, determining root cause performance data that causes an anomaly in a device to be detected according to a data flow direction relationship between different index levels and predicted anomaly data of the device to be detected includes:

judging whether the index data flow direction relations among different index levels contain associated abnormal data or not;

if the associated abnormal data are contained, determining upstream abnormal data corresponding to the associated abnormal data contained in the index data flow direction relation, and taking the upstream abnormal data as root performance data which cause abnormality of equipment to be detected;

if the associated abnormal data are not contained, determining whether the target abnormal data are contained in each associated abnormal data; wherein, the target abnormal data belongs to qualitative performance data and predictive abnormal data;

if the target abnormal data are contained, the target abnormal data are used as root performance data which cause the abnormality of the equipment to be detected;

And if the target abnormal data is not contained, the associated abnormal data is used as the root performance data which causes the abnormality of the equipment to be detected.

In one embodiment, determining the root cause performance data that causes the abnormality of the device to be detected based on the number of associated abnormality data belonging to the downstream indicator level includes:

determining whether the number of associated anomaly data belonging to the downstream level of the index is one;

if yes, the associated abnormal data belonging to the downstream index level is used as root performance data for causing the abnormality of the equipment to be detected;

if not, the associated abnormal data belonging to the downstream index level is used as new associated abnormal data, and the operation of determining the root performance data causing the abnormality of the equipment to be detected according to the data flow direction relation among different index levels and the predicted abnormal data of the equipment to be detected is carried out.

In one embodiment, according to the root performance data, performing abnormal data early warning on the device to be detected includes:

determining an abnormal influence weight corresponding to the root cause performance data;

generating an early warning text according to the abnormal influence weight and the root cause performance data;

and sending the early warning text to a preset early warning receiving terminal in a mail mode.

In one embodiment, analyzing the quantitative performance data and the qualitative performance data, and determining abnormal performance data from the quantitative performance data and the qualitative performance data based on the analysis results, includes:

taking quantitative performance data which is larger than an index threshold value as an abnormal performance index;

and carrying out development trend analysis on the qualitative performance data according to a density clustering algorithm, and taking the non-converged qualitative performance as an abnormal performance index.

In one embodiment, acquiring quantitative performance data and qualitative performance data of the device to be detected during operation includes:

acquiring quantitative initial data and qualitative initial data;

formatting the quantitative initial data and the qualitative initial data to obtain quantitative performance data corresponding to the quantitative initial data and qualitative performance data corresponding to the qualitative initial data; the formatting process comprises time formatting process, resource name formatting process and index value formatting process.

In one embodiment, the method further comprises:

according to the user index display requirement, determining at least one index to be displayed of the equipment to be detected and an index display strategy corresponding to the index to be displayed; the index display strategy comprises a longitudinal index display strategy for independently displaying the equipment to be detected and a transverse index display strategy for the equipment to be detected and at least one reference equipment;

And according to the index display strategy, displaying the indexes to be displayed of the equipment to be detected.

In one embodiment, the method further comprises:

determining target database fragments corresponding to quantitative performance data, qualitative performance data and abnormal performance data according to the storage available space of each candidate database fragment;

and storing the quantitative performance data, the qualitative performance data and the abnormal performance data into corresponding target database fragments.

In a second aspect, the application further provides a device for processing the equipment performance data. The device comprises:

the acquisition module is used for acquiring quantitative performance data and qualitative performance data in the running process of the equipment to be detected;

the analysis module is used for analyzing the quantitative performance data and the qualitative performance data and determining abnormal performance data from the quantitative performance data and the qualitative performance data according to an analysis result;

the first determining module is used for determining root-cause performance data which cause the abnormality of the equipment to be detected from the abnormal performance data;

and the early warning module is used for carrying out abnormal data early warning on the equipment to be detected according to the root performance data.

In a third aspect, the present application also provides a computer device. The computer device comprises a memory storing a computer program and a processor which when executing the computer program performs the steps of:

In a fourth aspect, the present application also provides a computer-readable storage medium. A computer readable storage medium having stored thereon a computer program which when executed by a processor performs the steps of:

In a fifth aspect, the present application also provides a computer program product. Computer program product comprising a computer program which, when executed by a processor, realizes the steps of:

The method, the device, the computer equipment and the storage medium for processing the equipment performance data acquire quantitative performance data and qualitative performance data, and determine abnormal performance data from the quantitative performance data and the qualitative performance data; and furthermore, carrying out abnormal data early warning on the equipment to be detected according to the root performance data corresponding to the abnormal performance data. Compared with the prior art, the method and the device have the advantages that compared with the scheme that the abnormal performance data is determined according to only one dimensional performance data, the abnormal performance data of the equipment to be detected can be analyzed more comprehensively, so that the early warning accuracy of the abnormal data early warning of the equipment to be detected is improved, the root cause performance data causing the abnormal occurrence of the equipment to be detected is determined according to the abnormal performance data, and the abnormal data early warning of the equipment to be detected is further carried out according to the root cause performance data, therefore, when the abnormal data early warning is carried out on the equipment to be detected, the method and the device also indicate the root cause performance data causing the abnormal occurrence of the equipment to be detected, and a worker receiving the abnormal data early warning can determine the abnormal occurrence position of the equipment to be detected more quickly, so that the abnormal maintenance efficiency of the equipment to be detected is improved.

Drawings

FIG. 1 is an application environment diagram of a method for processing device performance data according to an embodiment of the present application;

FIG. 2 is a flowchart of a method for processing device performance data according to an embodiment of the present application;

FIG. 3 is a flowchart illustrating steps for determining root cause performance data according to an embodiment of the present application;

FIG. 4 is a flowchart of steps for performing abnormal data early warning on equipment to be detected according to an embodiment of the present application;

FIG. 5 is a flowchart illustrating steps for determining abnormal performance data according to an embodiment of the present application;

FIG. 6 is a flowchart of steps for determining quantitative performance data and qualitative performance data provided by an embodiment of the present application;

fig. 7 is a flowchart of a step of displaying an index of a device to be detected according to an embodiment of the present application;

FIG. 8 is a flowchart illustrating steps for data storage according to an embodiment of the present application;

FIG. 9 is a flowchart of another method for processing device performance data according to an embodiment of the present application;

FIG. 10 is a block diagram of a first device performance data processing apparatus according to an embodiment of the present application;

FIG. 11 is a block diagram of a second device performance data processing apparatus according to an embodiment of the present application;

FIG. 12 is a block diagram of a third apparatus for processing device performance data according to an embodiment of the present application;

FIG. 13 is a block diagram illustrating a fourth apparatus for processing device performance data according to an embodiment of the present application;

FIG. 14 is a block diagram illustrating a fifth apparatus for processing device performance data according to an embodiment of the present application;

FIG. 15 is a block diagram illustrating a sixth apparatus for processing performance data according to an embodiment of the present application;

fig. 16 is a block diagram of a seventh device performance data processing apparatus according to an embodiment of the present application;

fig. 17 is a block diagram of a processing apparatus for eighth device performance data according to an embodiment of the present application;

fig. 18 is a block diagram of a ninth device performance data processing apparatus according to an embodiment of the present application;

fig. 19 is an internal structural view of the computer device in one embodiment.

Detailed Description

The present application will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present application more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the application.

It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the application. In the description of the present application, a description of the terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the present application. In this specification, schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, the different embodiments or examples described in this specification and the features of the different embodiments or examples may be combined and combined by those skilled in the art without contradiction.

Based on the above situation, the method for processing device performance data provided by the embodiment of the present application may be applied to an application environment as shown in fig. 1. In one embodiment, a computer device is provided, which may be a server, the internal structure of which may be as shown in FIG. 1. The computer device includes a processor, a memory, and a network interface connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database of the computer device is used for storing acquired data of a processing method of the device performance data. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a method of processing device performance data.

The application discloses a processing method and device of equipment performance data, computer equipment and a storage medium. The computer equipment of the application obtains quantitative performance data and qualitative performance data, and determines abnormal performance data from the quantitative performance data and the qualitative performance data; and furthermore, carrying out abnormal data early warning on the equipment to be detected according to the root performance data corresponding to the abnormal performance data.

In one embodiment, as shown in fig. 2, fig. 2 is a flowchart of a method for processing device performance data according to an embodiment of the present application, and provides a method for processing device performance data, where the method for processing device performance data executed by the computer device in fig. 1 may include the following steps:

step 201, quantitative performance data and qualitative performance data of equipment to be detected in the running process are obtained.

Wherein, the quantitative performance data refers to performance data needing to analyze the value and the size; qualitative performance data refers to performance data that requires a trend analysis of the values.

It should be noted that a quantitative data acquisition rule and a qualitative data acquisition rule may be preset, where quantitative performance data types included in different devices to be detected are recorded in the quantitative data acquisition rule; qualitative performance data types contained in different candidate devices are recorded in the qualitative data acquisition rules; therefore, when the quantitative performance data and the qualitative performance data in the running process of the equipment to be detected need to be acquired, the quantitative performance data and the qualitative performance data in the running process of the equipment to be detected can be determined according to the quantitative data acquisition rule and the qualitative data acquisition rule.

Specifically, according to quantitative data acquisition rules and qualitative data acquisition rules, determining quantitative performance data types and qualitative performance data types corresponding to the equipment to be detected, and further, according to the quantitative performance data types, performing data acquisition on the equipment to be detected, and determining quantitative performance data conforming to the quantitative performance data types; and acquiring data of the equipment to be detected according to the qualitative performance data type, and determining qualitative performance data conforming to the qualitative performance data type.

In one embodiment of the present application, the quantitative performance data types recorded in the quantitative data acquisition rule may be: CPU (Central Processing Unit ) data of a certain infrastructure, memory data of a certain infrastructure, SWAP server performance evaluation index data of a certain infrastructure, disk capacity data of a certain infrastructure, disk I/O (input/output) data of a certain infrastructure, connection number of a certain infrastructure, table capacity of a certain infrastructure, thread pool of a certain application, queue depth of a certain application, transaction amount of a certain service, response time of a certain service, transaction success rate of a certain service. And acquiring data of the equipment to be detected according to the quantitative performance data type, and determining quantitative performance data conforming to the quantitative performance data type.

In another embodiment of the present application, the qualitative performance data categories recorded in the qualitative data acquisition rules may be: hard disk response time data, IOPS (Input/Output Operations Per Second, a database), network traffic data, read hit rate, write hit rate; and acquiring data of the equipment to be detected according to the qualitative performance data type, and determining qualitative performance data conforming to the qualitative performance data type.

And 202, analyzing the quantitative performance data and the qualitative performance data, and determining abnormal performance data from the quantitative performance data and the qualitative performance data according to an analysis result.

When the quantitative performance data is analyzed, a data threshold corresponding to the quantitative performance data may be determined, and further, abnormal performance data may be determined from the quantitative performance data based on a magnitude relation between the quantitative performance data and the data threshold. Specifically, for each quantitative performance data, if the quantitative performance data is greater than or equal to a data threshold, determining that the quantitative performance data is abnormal performance data; if the quantitative performance data is less than the data threshold, it is determined that the quantitative performance data is not abnormal performance data.

Further, when the qualitative performance data is analyzed, the qualitative performance data may be clustered, and further, abnormal performance data may be determined from the qualitative performance data according to the result of the clustering. Specifically, for each piece of qualitative performance data, clustering the data values of the qualitative performance data in at least one acquisition time according to the preset maximum difference among the data values, and if a certain data value and other data values in the data values of the qualitative performance data in each acquisition time do not belong to the same data cluster, determining that the qualitative performance data is abnormal performance data; and if all the data values of the qualitative performance data in the data values of all the acquisition time belong to the same data cluster, determining that the qualitative performance data is not abnormal performance data.

And 203, determining the root-cause performance data which causes the abnormality of the equipment to be detected according to the abnormal performance data.

It should be noted that, in order to ensure that when the abnormal data early warning is performed on the equipment to be detected later, a worker receiving the abnormal data early warning can quickly determine a place to be maintained, so that the root cause performance data causing the abnormality of the equipment to be detected needs to be determined.

In one embodiment of the application, a corresponding relation table of the abnormal performance data and the root cause performance data can be constructed according to the working experience of the staff and the historical abnormal condition of the equipment to be detected, and different root cause performance data corresponding to different abnormal performance data are recorded in the corresponding relation table.

In another embodiment of the present application, the abnormal performance data may be subjected to data analysis based on a preset data analysis rule, so as to determine, according to an analysis result, root-cause performance data that causes an abnormality of the device to be detected; the data analysis rule records a method for carrying out data analysis on abnormal performance data according to a plurality of layers such as acquisition time, index level, data flow direction relation and the like of the abnormal data.

And 204, carrying out abnormal data early warning on the equipment to be detected according to the root performance data.

It should be noted that, in order to ensure that when the staff receives the abnormal data early warning, the influence degree of the root cause performance data on the normal operation of the equipment to be detected can be known, and different degrees of abnormal data early warning can be performed on the equipment to be detected according to the difference of the root cause performance data, for example, if the influence degree of the root cause performance data on the normal operation of the equipment to be detected is greater, the early warning level of the abnormal data early warning is higher; otherwise, if the influence degree of the root performance data on the normal operation of the equipment to be detected is smaller, the early warning level of carrying out abnormal data early warning on the equipment to be detected is lower.

Among them, there are many ways of early warning abnormal data, for example: mail pre-warning, telephone pre-warning, lamplight pre-warning, short message pre-warning and the like. Therefore, when the abnormal data early warning is needed to be carried out on the equipment to be detected, the abnormal data early warning can be carried out on the equipment to be detected according to a preset abnormal data early warning mode.

Further, a corresponding relation between the influence degree of the normal operation of the equipment to be detected by the root cause performance data and the early warning level can be predetermined, wherein the corresponding relation indicates different early warning levels (for example, the greater the influence degree is, the higher the early warning level of the abnormal data early warning is) corresponding to different influence degrees of the normal operation of the equipment to be detected by the root cause performance data, therefore, after the influence degree of the normal operation of the equipment to be detected by the root cause performance data is evaluated and determined, the early warning level corresponding to the influence degree is determined according to the influence degree and the corresponding relation, and further, the abnormal data early warning is performed on the equipment to be detected according to the early warning level.

In one embodiment of the application, if the early warning levels of the abnormal data early warning are different, and the early warning texts corresponding to the abnormal data early warning are different, after the influence degree of the normal operation of the equipment to be detected by the root cause performance data is evaluated, the early warning level corresponding to the influence degree is determined, and different early warning texts are generated according to the difference of the early warning levels, and further, the abnormal data early warning is carried out on the equipment to be detected according to a preset abnormal data early warning mode and an early warning text.

For example, if the pre-set abnormal data pre-warning mode is mail pre-warning, after the influence degree of the normal operation of the equipment to be detected by the root performance data is evaluated, the pre-warning grade corresponding to the influence degree is determined, the pre-warning text is generated according to the different pre-warning grades, and the pre-warning text is sent to the pre-set pre-warning receiving terminal in the mail mode.

In another embodiment of the application, if the early warning levels of the abnormal data early warning are different, when the early warning modes of the abnormal data early warning are different, after the influence degree of the normal operation of the equipment to be detected by the root cause performance data is evaluated, the early warning level corresponding to the influence degree is determined, and the different early warning modes are determined according to the different early warning levels, and further, the abnormal data early warning is performed on the equipment to be detected according to the early warning modes.

For example, if the preset influence degree of the root performance data on the normal operation of the equipment to be detected is high, performing abnormal data early warning on the equipment to be detected by adopting a telephone early warning mode; when the influence degree of the root performance data on the normal operation of the equipment to be detected is low, carrying out abnormal data early warning on the equipment to be detected by adopting a mail early warning mode. Therefore, after the influence degree of the root cause performance data on the normal operation of the equipment to be detected is evaluated, determining that the influence degree is intersected, and carrying out abnormal data early warning on the equipment to be detected by adopting a mail early warning mode.

The processing method of the equipment performance data acquires quantitative performance data and qualitative performance data, and determines abnormal performance data from the quantitative performance data and the qualitative performance data; and furthermore, carrying out abnormal data early warning on the equipment to be detected according to the root performance data corresponding to the abnormal performance data. Compared with the prior art, the method and the device have the advantages that compared with the scheme that the abnormal performance data is determined according to only one dimensional performance data, the abnormal performance data of the equipment to be detected can be analyzed more comprehensively, so that the early warning accuracy of the abnormal data early warning of the equipment to be detected is improved, the root cause performance data causing the abnormal occurrence of the equipment to be detected is determined according to the abnormal performance data, and the abnormal data early warning of the equipment to be detected is further carried out according to the root cause performance data, therefore, when the abnormal data early warning is carried out on the equipment to be detected, the method and the device also indicate the root cause performance data causing the abnormal occurrence of the equipment to be detected, and a worker receiving the abnormal data early warning can determine the abnormal occurrence position of the equipment to be detected more quickly, so that the abnormal maintenance efficiency of the equipment to be detected is improved.

In one embodiment, when the computer equipment needs to be subjected to early warning and monitoring, acquiring performance indexes of a certain dimension of the equipment to be detected, so as to determine whether the equipment to be detected needs to be subjected to abnormal index early warning; however, the performance index of the adopted single dimension cannot fully reflect the operation condition of the equipment to be detected, so that the prior art cannot accurately perform abnormal index early warning. In order to solve the above technical problem, the computer device of the present embodiment may determine, according to the abnormal performance data, root performance data that causes an abnormality in the device to be detected in a manner as shown in fig. 3, and specifically includes the following steps:

step 301, determining at least two associated abnormal data with time association relation from the abnormal performance data according to the data acquisition time of the abnormal performance data.

It should be noted that, because there is a certain persistence when the device to be detected fails, in order to ensure the accuracy of determining the root performance data, according to the data acquisition time of each abnormal performance data, the abnormal performance data in the same time association interval should be used as at least two associated abnormal data with a time association relationship.

Further, if the time difference between the data collection times of the abnormal performance data is smaller than the time correlation interval, the abnormal performance data is indicated to have a time correlation, and the abnormal performance data is the correlation abnormal data.

The time-related interval may be set according to historical experience of a worker, or the time-related interval may be set according to a time period consumed when the quantitative performance data and the qualitative performance data are collected, for example, when the time period consumed when the quantitative performance data and the qualitative performance data are collected is t, 10t is taken as the time-related interval. In summary, there are many ways of setting the time-related section, and the way of setting the time-related section is not limited here.

For example, if three pieces of abnormal performance data are included, the abnormal performance data a, the abnormal performance data B and the abnormal performance data C are respectively, and the time-related interval is determined to be 10t, so that according to the data collection time of the three pieces of abnormal performance data, the abnormal performance data a and the abnormal performance data B are determined to belong to the same time-related interval, that is, the abnormal performance data a and the abnormal performance data B are taken as related abnormal data.

Step 302, determining whether each associated abnormal data belongs to the same index level. If yes, go to step 303; if not, go to step 304.

Wherein the index levels include, in order from high to low, a traffic index level, an application index level, and an infrastructure index level.

It should be noted that, since the index level is used to represent application scenarios to which the quantitative performance data and the qualitative performance data correspond, and the associated abnormal data is determined from the abnormal performance data, the abnormal performance data is determined from the quantitative performance data and the qualitative performance data. Thus, the index level of each associated anomaly data can be determined from the index levels of the quantitative performance data and the qualitative performance data.

In summary, when it is required to determine whether each associated abnormal data belongs to the same index level, the index level of each associated abnormal data may be determined according to the index levels corresponding to the quantitative performance data and the qualitative performance data, and further, whether each associated abnormal data belongs to the same index level may be determined according to the index level of each associated abnormal data.

In one embodiment of the present application, when each associated abnormal data belongs to any one of a traffic index level, an application index level and an infrastructure index level, step 303 is performed; when the associated anomaly data does not belong to any of the traffic index level, the application index level, and the infrastructure index level, then step 304 is performed.

And step 303, determining the root performance data causing the abnormality of the equipment to be detected according to the data flow direction relations among different index levels and the predicted abnormality data of the equipment to be detected.

The prediction abnormal data are obtained according to the qualitative performance data. Thus, when it is necessary to acquire prediction abnormality data, the following may be included in particular: according to an exponential smoothing method of a statsmodules.tsa.holtwnters module in python, qualitative performance data in a preset period, an addition trend and a period, constructing a trend prediction model; further, predicting qualitative prediction data in a future period according to the trend prediction model; and clustering the qualitative forecast data, and determining forecast abnormal data from the qualitative forecast data according to a clustering result.

It should be noted that, when it is required to determine the source performance data that causes the abnormality of the device to be detected, the following may be included: judging whether the index data flow direction relations among different index levels contain associated abnormal data or not; if the associated abnormal data are contained, determining upstream abnormal data corresponding to the associated abnormal data contained in the index data flow direction relation, and taking the upstream abnormal data as root performance data which cause abnormality of equipment to be detected; if the associated abnormal data are not contained, determining whether the target abnormal data are contained in each associated abnormal data; wherein, the target abnormal data belongs to qualitative performance data and predictive abnormal data; if the target abnormal data are contained, the target abnormal data are used as root performance data which cause the abnormality of the equipment to be detected; and if the target abnormal data is not contained, the associated abnormal data is used as the root performance data which causes the abnormality of the equipment to be detected.

The data links corresponding to the quantitative performance data and the qualitative performance data record index data flow relationships among different index levels, so that it can be understood that if the associated abnormal data exists in the data links, the index data flow relationships among the different index levels are determined to contain the associated abnormal data, and if the associated abnormal data does not exist in the data links, the index data flow relationships among the different index levels are determined to not contain the associated abnormal data.

Wherein, the data link can be constructed according to the historical experience of staff, the data link comprises index data between at least two different index levels, and each node in the data link can digitally represent the data flow direction (namely 0 represents the initial outflow node, and each downstream node is numbered +1); for example, the data link may be represented as: the data link may also be represented as a network index (network traffic_flow_0) -a transaction index (transaction response TIME application_time_1) -a traffic operation index (daily activity_dau_2): network index (network traffic_flow_0) -system index (system physical storage index_memory_0) -transaction index (transaction response TIME application_time_1) -traffic operation index (daily activity rate service_dau_2).

And step 304, determining the root cause performance data which causes the abnormality of the equipment to be detected according to the quantity of the associated abnormal data belonging to the downstream index level.

The downstream index level refers to the lowest index level corresponding to each associated abnormal data.

It should be noted that, when it is required to determine the source performance data that causes the abnormality of the device to be detected, the following may be specifically included: determining whether the number of associated anomaly data belonging to the downstream level of the index is one; if yes, the associated abnormal data belonging to the downstream index level is used as root performance data for causing the abnormality of the equipment to be detected; if not, the associated abnormal data belonging to the downstream index level is used as new associated abnormal data, and the operation of determining the root performance data causing the abnormality of the equipment to be detected according to the data flow direction relation among different index levels and the predicted abnormal data of the equipment to be detected is carried out.

According to the method for processing the equipment performance data, whether the associated abnormal data belong to the same index level is determined, and further, the source performance data causing the abnormality of the equipment to be detected is determined according to different conditions, so that the accuracy of determining the source performance data is ensured, and a data basis is provided for carrying out abnormal data early warning on the equipment to be detected subsequently.

In one embodiment, when the device to be detected needs to be pre-warned of abnormal data according to the root cause performance data, as shown in fig. 4, the following may be included in detail,

step 401, determining an abnormal influence weight corresponding to the root cause performance data.

It should be noted that, based on the working experience of the staff, the abnormal influence weights of different levels can be divided in advance according to the influence degree of the normal operation of the equipment to be detected according to the root performance data, and further, when the abnormal influence weight corresponding to the root performance data needs to be determined, the abnormal influence weight corresponding to the influence degree can be determined according to the influence degree of the normal operation of the equipment to be detected according to the root performance data.

In one embodiment of the present application, the extent of influence of the root cause performance data on the normal operation of the device to be detected can be categorized into four types: the method comprises the steps of seriously affecting services, applications and systems, enabling the services to be unavailable, solving the problems in one operation and maintenance week and enabling the problems to be solved without intervention, wherein the abnormal impact weight corresponding to the seriously affecting services, the applications and the systems is 0.8, the abnormal impact weight corresponding to the seriously affecting services are unavailable is 0.6, the abnormal impact weight corresponding to the problems in one operation and maintenance week is 0.4, and the abnormal impact weight corresponding to the problems without intervention is 0.2. Therefore, when the abnormal influence weight corresponding to the root cause performance data needs to be determined, the relation between the influence degree of the root cause performance data on the normal operation of the equipment to be detected and the four influence degrees can be determined, and further, the influence degree of the root cause performance data on the normal operation of the equipment to be detected is determined.

And step 402, generating early warning text according to the abnormal influence weight and the root cause performance data.

It should be noted that, the text representation of the root cause performance data and the mail mark may be included in the early warning text, and the mail marks corresponding to different abnormal impact weights are also different, where the mail marks may include a life mark, an important mark, a secondary mark and a general mark; if the abnormal influence weight is 0.8, marking the mail corresponding to the abnormal influence weight as a death mark; if the abnormal influence weight is 0.6, the mail mark corresponding to the abnormal influence weight is an important mark; if the abnormal influence weight is 0.4, the mail mark corresponding to the abnormal influence weight is a secondary mark; if the abnormal influence weight is 0.2, the mail label corresponding to the abnormal influence weight is a general label. Wherein the textual representation of the root cause performance data may include: name of the root cause performance data, index level of the root cause performance data, value of the root cause performance data, and the like.

In summary, when an early warning text needs to be generated, determining a mail mark according to the abnormal influence weight, and determining a text representation of the root cause performance data; further, the text representation and the mail identification based on the root cause performance data are used as pre-warning text.

The mail marks can be represented by 'x', the more the 'x' is, the higher the abnormal influence weight is, if a plurality of source performance data exist, the mail marks of the source performance data are respectively determined according to the abnormal influence weight of the source performance data, and the positions of the source performance data in the early warning text are sequentially ordered according to the 'x' order, for example, the mail marks 'x' are positioned at the front positions in the early warning text. If the mail marks of at least two root cause performance data are the same in number, sequencing the positions of the root cause performance data in the early warning text according to a letter sequencing method.

Step 403, sending an early warning text to a preset early warning receiving terminal in a mail mode.

It should be noted that, when sending the pre-warning text to the pre-set pre-warning receiving terminal in the form of a mail, the subject of the mail needs to be determined, where the subject may include, but is not limited to: the anomaly affects the weight, the root cause performance data, the data link to which the root cause performance data pertains, and the like.

In one embodiment of the application, when the early warning text is required to be sent, the mailbox address of the early warning receiving terminal can be determined, and then the early warning text is sent to the mailbox address of the early warning receiving terminal in a mail mode, so that the early warning text is sent to the preset early warning receiving terminal.

According to the processing method of the equipment performance data, the early warning text is generated, the abnormal data early warning is carried out on the equipment to be detected in the form of mail, so that after the early warning receiving terminal receives the early warning text, workers can more quickly determine the abnormal position of the equipment to be detected, and the abnormal maintenance efficiency of the equipment to be detected is improved.

In one embodiment, when it is desired to determine abnormal performance data from both quantitative performance data and qualitative performance data, as shown in fig. 5, specifically may include,

in step 501, quantitative performance data greater than an index threshold is used as an abnormal performance index.

The method for determining the index threshold corresponding to the quantitative performance data of different index levels is also different, and specifically: if the quantitative performance data is at an application index level or an infrastructure index level, eighty percent of the critical value of the quantitative performance data is taken as an index threshold; if the quantitative performance data is at the traffic index level, eighty percent of the historical peak of the quantitative performance data is used as an index threshold.

In summary, when abnormal performance data needs to be determined from quantitative performance data, determining whether the value of the quantitative performance data is greater than an index threshold (eighty percent of the critical value of the quantitative performance data) or not according to the quantitative performance data of an application index level or an infrastructure index level, and if so, taking the quantitative performance data as the abnormal performance data; for the quantitative performance data of the service index level, counting the data value of the quantitative performance data in a target time period, determining the historical peak value of the quantitative performance data from the data value in the target time period, and judging whether the value of the quantitative performance data is larger than an index threshold value (eighty percent of the historical peak value of the quantitative performance data); if the quantitative performance data is larger than the threshold value, the quantitative performance data is taken as abnormal performance data.

Step 502, performing development trend analysis on the qualitative performance data according to a density clustering algorithm, and taking the qualitative performance with the analysis result of non-convergence as an abnormal performance index.

When the abnormal performance index in the qualitative performance data needs to be determined, an abnormal value detection model can be constructed through a density clustering algorithm, and then the abnormal performance index in the qualitative performance data is determined according to the abnormal value detection model.

In one embodiment of the application, when an abnormal performance index in qualitative performance data needs to be determined, an abnormal monitoring period is specified firstly, the abnormal monitoring period is larger than the data acquisition time of the qualitative performance data, and the minimum core point number of a data cluster and the maximum distance between two data in the same data cluster are specified, so that an abnormal value detection model is built through a density clustering algorithm, the minimum core point number and the maximum distance; the qualitative performance data is input into the abnormal value detection model, the output result of the abnormal value detection model is obtained, and if the output result is 1, the qualitative performance data is represented as normal data; if the output result is-1, the qualitative performance data is an abnormal performance index.

For example, the set anomaly monitoring period may be 10 times of the data acquisition time, and the minimum number of core points of the data cluster is defined as 2, and the maximum distance between two data in the same data cluster is defined as 3, so that an anomaly detection model (the anomaly detection model may be represented by: detection=dbscan (min_samples=2, eps=3)) is constructed through a density clustering algorithm, the minimum number of core points and the maximum distance, and performance data in the period is detected (the detection flow may be represented by clusters=outlier_detection. Fit_prediction (data)), and an output result of the anomaly detection model is obtained, and if the output result is 1, the qualitative performance data is represented as normal data; if the output result is-1, the qualitative performance data is an abnormal performance index.

According to the processing method of the equipment performance data, the abnormal performance data is determined from the quantitative performance data and the qualitative performance data by adopting the index threshold value and the density clustering algorithm, so that a data basis is provided for subsequent determination of the root performance data causing the abnormality of the equipment to be detected and early warning of the abnormal data of the equipment to be detected.

In one embodiment, when it is desired to obtain quantitative performance data and qualitative performance data during operation of the device under test, as shown in fig. 6, this may include in particular,

In step 601, quantitative initial data and qualitative initial data are obtained.

The data acquisition module can be deployed in advance to realize the data acquisition operation of quantitative initial data and qualitative initial data of the equipment to be detected, and has a real-time data receiving and transmitting function.

Therefore, when the quantitative initial data and the qualitative initial data need to be acquired, network addresses of the quantitative initial data and the qualitative initial data are determined, communication is established with the network addresses through the data acquisition module, and the acquired quantitative initial data and qualitative initial data are stored in the local file through a url request.

Further, the data collection frequency of the data collection module may be set, for example, data collection operations for quantitatively and qualitatively initializing the device to be detected may be set every minute.

Step 602, formatting the quantitative initial data and the qualitative initial data to obtain quantitative performance data corresponding to the quantitative initial data and qualitative performance data corresponding to the qualitative initial data.

The formatting process comprises time formatting process, resource name formatting process and index value formatting process.

It should be noted that, when the quantitative initial data and the qualitative initial data are formatted according to different data formats, different formatting methods are adopted, and the process of formatting the quantitative initial data and the qualitative initial data according to different data formats is as follows, where the quantitative initial data and the qualitative initial data may be classified into CSV data and XML (eXtensible Markup Language) data in a Comma Separated value file format according to a data format:

as an implementation manner, if the data format of the quantitative initial data and the qualitative initial data is the CSV format, when the time formatting process is required to be performed on the CSV data, the following specifically includes: converting the third type of character type time data of the CSV data into DATETIME (date time) format time data, unifying time measurement standards of the CSV data according to data display requirements of equipment to be detected, and recovering the DATETIME format time data of the CSV data after unification into character type time data. When the CSV data is required to be formatted in resource name, the first column of character type data of the CSV data is used as index resource names, and the second column of performance data corresponding to the index resource names is matched, so that the CSV data is formatted in resource name, wherein the second column of performance data corresponding to the index resource names can be matched through deployment (regular expression ) of a regular module. When index value formatting processing is needed to be carried out on the CSV data, character type performance numerical values of the CSV data are converted into floating point type, and thus index value formatting processing is carried out on the CSV data.

For example, if the time measurement standard of the data display requirement is UTC (coordinated universal time) time and the initial time measurement standard of the CSV data is LOCAL time, when the time formatting process is required for the CSV data, the third character type time data of the CSV data is converted into DATETIME format time data, and the time measurement standard of the CSV data is changed into UTC time and the DATETIME format time data of the CSV data changed into UTC time is restored into character type time data through the conversion relationship between the LOCAL time and UTC time.

As an implementation manner, if the data format of the quantitative initial data and the qualitative initial data is an XML format, when the XML data needs to be time-formatted, the method specifically includes the following steps: representing XML data as a tree structure according to XML. Etre. ElementTree (Python package for processing tree structure), wherein each element tag of the tree structure represents a single node within the tree structure; when time formatting is required to be carried out on XML data, character type time data of a display-start element (a child node is time-data) is extracted from a tree structure of the XML data, the character type time data are converted into DATETIME format time data, time measurement standards of the XML data are unified according to data display requirements of equipment to be detected, and the DATETIME format time data of the unified XML data are restored into character type time data. When the XML data is required to be formatted with the resource names, character type index resource names with the elements of 'name' elements (child nodes are 'captons') are extracted from the tree structure of the XML data, resource name matching is carried out in the child nodes 'captons' based on the character type index resource names through a deployed regular module, and the 'value' content of the row elements matched with the character type index resource names is used as a character type index value of the XML data. When the index value formatting process is needed to be carried out on the XML data, converting the character type performance numerical value of the XML data into a floating point type, thereby completing the index value formatting process on the XML data.

For example, if the time measurement standard of the data presentation requirement is UTC (coordinated universal time) time and the initial time measurement standard of the XML data is LOCAL time, when the XML data needs to be time-formatted, character-type time data of a "display-start" element is extracted from a tree structure of the XML data, the character-type time data is converted into DATETIME-format time data, and the time measurement standard of the XML data is changed into UTC time and the DATETIME-format time data of the XML data changed into UTC time is restored into character-type time data through the conversion relation between the LOCAL time and UTC time.

According to the method for processing the equipment performance data, the quantitative initial data and the qualitative initial data are formatted, so that the quantitative performance data and the qualitative performance data are formatted in a unified three-section form of time, resource name and index value, the simplification and extraction of the data are realized, and the storage space occupied when the quantitative initial data and the qualitative initial data are stored is reduced.

In one embodiment, when the device to be detected needs to display the index according to the user index display requirement, as shown in fig. 7, the following may be specifically included,

Step 701, determining at least one index to be displayed of the equipment to be detected and an index display strategy corresponding to the index to be displayed according to the user index display requirement.

The index display strategy comprises a longitudinal index display strategy for independently displaying the equipment to be detected and a transverse index display strategy for the equipment to be detected and at least one reference equipment.

Furthermore, the transverse index display strategy can also aim at the index display operation of the equipment to be detected in online and batch scenes.

It should be noted that, according to the content recorded in the user index display requirement, an index display policy corresponding to the index to be displayed may be determined, specifically, if the content recorded in the user index display requirement is to display only the equipment to be detected, the index display policy corresponding to the index to be displayed is determined to be a longitudinal index display policy for performing independent display on the equipment to be detected; if the content recorded in the user index display requirement is to display the equipment to be detected and at least one reference equipment, determining an index display strategy corresponding to the index to be displayed as a transverse index display strategy aiming at the equipment to be detected and the at least one reference equipment.

Step 702, performing index display on each index to be displayed of the equipment to be detected according to the index display strategy.

It should be noted that before performing index display on each index to be displayed of the device to be detected, grafana (instrument panel image editor) software may be installed in a computer device executing a processing method of device performance data, and further, a data arrangement manner of a display interface is selected according to the Grafana software, where the arrangement manner may include, but is not limited to: a broken line pattern data arrangement, a column pattern data arrangement, and the like. When the indexes to be displayed of the equipment to be detected are displayed, the storage nodes in the equipment to be detected, which are stored with the indexes to be displayed, can be associated with Grafana software, and then the indexes to be displayed of the equipment to be detected can be displayed according to the Grafana software.

In an embodiment of the present application, if the indicator display policy is a longitudinal indicator display policy, each indicator to be displayed of the device to be detected may belong to different subsystems, for example, when indicator display is required, CPU performance indicators of physical machines in different subsystems (for example, a PLEX1 subsystem and a PLEX2 subsystem) of the device to be detected may be screened for display; the indexes to be displayed of the equipment to be detected can also belong to different software products, for example, when the indexes are required to be displayed, the CPU performance of at least one software product recorded in the data table can be screened for display; the indexes to be displayed of the equipment to be detected can also belong to different transaction types; for example, when the index display is required, the trade rate performance of different areas in the online trade performance data table in the PLEX1 subsystem can be specified for display; the indexes to be displayed of the equipment to be detected can also belong to abnormal performance indexes, for example, when the indexes are required to be displayed, the abnormal performance indexes in the PLEX1 subsystem and the PLEX2 subsystem of the equipment to be detected can be screened for display; the indexes to be displayed of the equipment to be detected can also belong to prediction abnormal data, for example, when the indexes are required to be displayed, abnormal performance indexes of hard disk response time, IOPS and flow in the PLEX2 subsystem of the equipment to be detected can be screened for display.

In an embodiment of the present application, if the indicator display policy is a lateral indicator display policy, and the indicator display operation of the device to be detected in the online and batch scenarios is performed, the same indicator to be displayed in different data tables may be performed on the same dashboard, for example, when the indicator display is required, the physical machine CPU performance in the online transaction performance data table plax1_cics_tran and the batch transaction performance data table plax1_tws_tran of the plax1 subsystem of the device to be detected may be screened for the indicator display. Further, for the index display operation of the device to be detected in online and batch scenes, if the index to be displayed is an abnormal performance index, for example, when the index display is required, the abnormal performance of the physical machine CPU in the online transaction performance abnormal data table PLEX1_cics_tran_error and the batch transaction performance abnormal data table PLEX1_tws_tran_error of the device to be detected PLEX1 subsystem can be screened for display; further, for the index display operation of the device to be detected in the online and batch scenes, if the index to be displayed is the predicted abnormal data, for example, the predicted abnormal data of the hard disk response time in the online transaction performance data table PLEX1_cics_warning and the batch transaction performance data table PLEX1_tws_warning of the subsystem of the device to be detected can be screened for display.

Further, when the indexes to be displayed of the equipment to be detected are displayed, splicing processing of different indexes to be displayed can be achieved, so that index comparison operation under the scenes of system upgrading, software upgrading, patch installation and the like of the equipment to be detected is achieved; for example, after the device to be detected is subjected to software upgrading, the value differences of the same data to be displayed in the reference scene before the software upgrading of the device to be detected and in the upgrading scene after the software upgrading of the device to be detected can be compared.

Specifically, the computer equipment executing the processing method of the equipment performance data can realize index display of the same index to be displayed in different time periods by acquiring a certain index to be displayed in the time period corresponding to the reference scene and acquiring the same index to be displayed in the time period corresponding to the upgrade scene; for example, the index to be displayed is a physical machine CPU index, and the time period corresponding to the base station scene may be 24 hours of 1 month No. 1, and the time period corresponding to the upgrade scene may be 24 hours of 6 months No. 1, so that the physical machine CPU index within 24 hours of 1 month No. 1 is obtained, and the physical machine CPU index within 24 hours of 6 months No. 1 is obtained, and further, the physical machine CPU index within 24 hours of 1 month No. 1 and the physical machine CPU index within 24 hours of 6 months No. 1 are displayed.

In one embodiment of the application, when the value difference of the same data to be displayed in at least one scene of the equipment to be detected needs to be compared, the method specifically comprises the following steps of determining the starting display time and the ending display time of a first scene, and determining the starting display time of a next scene to be the time of ending display of the last scene plus a preset time interval when each scene is switched; and determining the ending display time of the next scene as the starting display time of the scene plus the specified display time of the scene. And further, according to the specified scene start display time and the specified scene end display time, continuously switching the data to be displayed in different scenes, and comparing the value difference of the same data to be displayed in at least one scene of the equipment to be detected.

According to the processing method of the equipment performance data, through determining the index to be displayed and the index display strategy which do not pass, the index display of the index to be displayed is realized according to the actual situation and the actual requirement of the user, and the user can quickly and effectively acquire related information.

In one embodiment, in data storage of quantitative performance data, qualitative performance data, and abnormal performance data, as shown in fig. 8, may include in particular,

Step 801, determining target database fragments corresponding to quantitative performance data, qualitative performance data and abnormal performance data according to the storage available space of each candidate database fragment.

The candidate database shards can be deployed in at least two storage servers, and each candidate database shard deploys a corresponding backup node so as to realize backup operation of data in the candidate database shards.

When the target database fragments corresponding to the quantitative performance data, the qualitative performance data and the abnormal performance data need to be determined, the available storage spaces of the candidate database fragments need to be combined, so that after the quantitative performance data, the qualitative performance data and the abnormal performance data are stored in the target database fragments, the difference of the available storage spaces of the candidate database fragments is smaller than or equal to a space threshold.

The spatial threshold can be set and modified according to the historical experience and actual situation of the staff, and the value range of the spatial threshold is not limited.

Further, in the process of determining the target database fragments corresponding to the quantitative performance data, the qualitative performance data and the abnormal performance data, a storage strategy with separated storage and reading and writing is adopted, so that the access efficiency to the quantitative performance data, the qualitative performance data and the abnormal performance data is ensured; in addition, in the process of storing the quantitative performance data, the qualitative performance data and the abnormal performance data, a main-standby deployment mode (main-standby writing and standby-standby reading) with separated reading and writing is adopted, so that the safety and the reading and writing efficiency of the quantitative performance data, the qualitative performance data and the abnormal performance data are ensured; for the synchronization process of the standby library and the main library, a replication function of MYSQL can be adopted, so that data replication delay is avoided.

And step 802, storing the quantitative performance data, the qualitative performance data and the abnormal performance data into corresponding target database fragments.

When the quantitative performance data, the qualitative performance data and the abnormal performance data are stored in the corresponding target database fragments, in order to achieve the purpose of long-term observable traceability of the quantitative performance data, the qualitative performance data and the abnormal performance data, the data names of the data can be unified and standardized first, so that the data positions can be quickly determined when the data are read, for example, the data names of the data can comprise the fragment names of the target database, the names of tables to which the data belong, the field names and the like.

For example, the CPU table PLEX1_cpu of the PLEX1 subsystem is created in the target DATABASE shard LP, and the index field (kpi _name_new) of the CPU performance data of the DATABASE on the PLEX1 subsystem is defined as the database_cpu, where the name of the CPU performance data may be expressed as: database name: LP (LONGTERM PERFORMANCE), table name: PLEX1_CPU, field name: database_cpu.

Further, a data long-term retention policy may be set, specifically, a data retention time may be specified (for example, the time may be set to 5 years), and when a certain data is retained in a target database partition for five years or less, the data is not processed; and if the time stored in a certain data target database fragment is longer than five years, deleting the data.

According to the processing method of the equipment performance data, the data storage of the quantitative performance data, the qualitative performance data and the abnormal performance data is realized by determining the target database fragments corresponding to the quantitative performance data, the qualitative performance data and the abnormal performance data, so that the data acquisition can be realized when a user needs to read and utilize the quantitative performance data, the qualitative performance data and the abnormal performance data.

In one embodiment, when the device to be detected needs to perform abnormal data early warning, as shown in fig. 9, the following may be specifically included,

step 901, obtaining quantitative initial data and qualitative initial data.

And step 902, formatting the quantitative initial data and the qualitative initial data to obtain quantitative performance data corresponding to the quantitative initial data and qualitative performance data corresponding to the qualitative initial data.

In step 903, the quantitative performance data greater than the index threshold is used as an abnormal performance index.

And step 904, carrying out development trend analysis on the qualitative performance data according to a density clustering algorithm, and taking the qualitative performance with the analysis result of non-convergence as an abnormal performance index.

Step 905, determining at least two associated abnormal data with a time association relationship from the abnormal performance data according to the data acquisition time of the abnormal performance data.

Step 906, determining whether each associated abnormal data belongs to the same index level; if yes, go to step 907; if not, then step 908 is performed.

And step 907, determining root cause performance data causing abnormality of the equipment to be detected according to the data flow direction relations among different index levels and the predicted abnormality data of the equipment to be detected.

Step 908, determining root cause performance data causing the abnormality of the device to be detected according to the number of associated abnormality data belonging to the downstream index level.

In step 909, an anomaly impact weight corresponding to the root cause performance data is determined.

Step 910, generating early warning text according to the abnormal influence weight and the root cause performance data.

Step 911, sending the pre-warning text to a pre-set pre-warning receiving terminal in a mail form.

It should be understood that, although the steps in the flowcharts related to the above embodiments are sequentially shown as indicated by arrows, these steps are not necessarily sequentially performed in the order indicated by the arrows. The steps are not strictly limited to the order of execution unless explicitly recited herein, and the steps may be executed in other orders. Moreover, at least some of the steps in the flowcharts described in the above embodiments may include a plurality of steps or a plurality of stages, which are not necessarily performed at the same time, but may be performed at different times, and the order of the steps or stages is not necessarily performed sequentially, but may be performed alternately or alternately with at least some of the other steps or stages.

Based on the same inventive concept, the embodiment of the application also provides a device performance data processing device for realizing the above related device performance data processing method. The implementation of the solution provided by the apparatus is similar to the implementation described in the above method, so the specific limitation in the embodiments of the processing apparatus for one or more device performance data provided below may refer to the limitation of the processing method for device performance data hereinabove, and will not be repeated herein.

In one embodiment, as shown in fig. 10, there is provided a processing apparatus for device performance data, including: the system comprises an acquisition module 10, an analysis module 20, a first determination module 30 and an early warning module 40, wherein:

and the acquisition module 10 is used for acquiring quantitative performance data and qualitative performance data in the running process of the equipment to be detected.

The analysis module 20 is configured to analyze the quantitative performance data and the qualitative performance data, and determine abnormal performance data from the quantitative performance data and the qualitative performance data according to the analysis result.

The first determining module 30 is configured to determine, from the abnormal performance data, root cause performance data that causes an abnormality of the device to be detected.

And the early warning module 40 is used for carrying out abnormal data early warning on the equipment to be detected according to the root performance data.

The processing device of the equipment performance data acquires quantitative performance data and qualitative performance data, and determines abnormal performance data from the quantitative performance data and the qualitative performance data; and furthermore, carrying out abnormal data early warning on the equipment to be detected according to the root performance data corresponding to the abnormal performance data. Compared with the prior art, the method and the device have the advantages that compared with the scheme that the abnormal performance data is determined according to only one dimensional performance data, the abnormal performance data of the equipment to be detected can be analyzed more comprehensively, so that the early warning accuracy of the abnormal data early warning of the equipment to be detected is improved, the root cause performance data causing the abnormal occurrence of the equipment to be detected is determined according to the abnormal performance data, and the abnormal data early warning of the equipment to be detected is further carried out according to the root cause performance data, therefore, when the abnormal data early warning is carried out on the equipment to be detected, the method and the device also indicate the root cause performance data causing the abnormal occurrence of the equipment to be detected, and a worker receiving the abnormal data early warning can determine the abnormal occurrence position of the equipment to be detected more quickly, so that the abnormal maintenance efficiency of the equipment to be detected is improved.

In one embodiment, as shown in fig. 11, there is provided a processing apparatus of device performance data, where the first determining module 30 includes: a first determination unit 31, a second determination unit 32, a third determination unit 33, and a fourth determination unit 34, wherein:

the first determining unit 31 is configured to determine at least two associated abnormal data having a time association relationship from the abnormal performance data according to the data acquisition time of the abnormal performance data.

A second determining unit 32 for determining whether each associated abnormal data belongs to the same index level; wherein the index levels include, in order from high to low, a traffic index level, an application index level, and an infrastructure index level.

A third determining unit 33, configured to determine, if yes, root cause performance data that causes an abnormality in the device to be detected according to the data flow direction relationships among the different index levels and the predicted abnormality data of the device to be detected; the prediction abnormal data are obtained according to the qualitative performance data.

A fourth determining unit 34, configured to determine, if not, root cause performance data that causes an abnormality of the device to be detected according to the number of associated abnormality data belonging to the downstream index level; the downstream index level refers to the lowest index level corresponding to each associated abnormal data.

In one embodiment, as shown in fig. 12, there is provided a processing apparatus of device performance data, in which the third determining unit 33 includes: a judgment subunit 331, a first determination subunit 332, a second determination subunit 333, a third determination subunit 334, and a fourth determination subunit 335, wherein:

the judging subunit 331 is configured to judge whether the index data flow relationship between different index levels includes associated abnormal data.

The first determining subunit 332 is configured to determine, if associated abnormal data is included, upstream abnormal data corresponding to the associated abnormal data included in the index data flow relationship, and take the upstream abnormal data as root performance data that causes an abnormality in the device to be detected.

A second determining subunit 333, configured to determine whether each associated abnormal data includes the target abnormal data if the associated abnormal data does not include the associated abnormal data; wherein the target abnormal data belongs to qualitative performance data and predictive abnormal data.

And a third determining subunit 334, configured to take the target abnormal data as the root performance data that causes the abnormality of the device to be detected if the target abnormal data is included.

And a fourth determining subunit 335, configured to, if the target abnormal data is not included, use the associated abnormal data as root performance data that causes an abnormality in the device to be detected.

In one embodiment, as shown in fig. 13, there is provided a processing apparatus of device performance data, in which the fourth determining unit 34 includes: a fifth determination subunit 341, a sixth determination subunit 342, and a seventh determination subunit 343, wherein:

a fifth determining subunit 341 is configured to determine whether the number of associated abnormal data belonging to the downstream indicator level is one.

And a sixth determining subunit 342, configured to, if so, use the associated abnormal data belonging to the downstream index level as the root performance data that causes the abnormality of the device to be detected.

And a seventh determining subunit 343, configured to, if not, return, as new associated exception data, associated exception data belonging to the downstream index level, perform an operation of determining root cause performance data that causes an exception of the device to be detected according to the data flow direction relationship between the different index levels and the predicted exception data of the device to be detected.

In one embodiment, as shown in fig. 14, there is provided a processing apparatus of device performance data, where the early warning module 40 includes: a fifth determination unit 41, a generation unit 42, and a transmission unit 43, wherein:

And a fifth determining unit 41 for determining an abnormal impact weight corresponding to the root cause performance data.

And the generating unit 42 is used for generating early warning text according to the abnormal influence weight and the root cause performance data.

And the sending unit 43 is configured to send the warning text to a preset warning receiving terminal in a mail form.

In one embodiment, as shown in fig. 15, there is provided a processing apparatus of device performance data, in which the analysis module 20 includes: a sixth determination unit 21 and an analysis unit 22, wherein:

a sixth determination unit 21 for taking quantitative performance data larger than the index threshold as an abnormal performance index.

And an analysis unit 22, configured to perform a trend analysis on the qualitative performance data according to a density clustering algorithm, and take the qualitative performance with the analysis result being non-convergence as an abnormal performance index.

In one embodiment, as shown in fig. 16, there is provided a processing apparatus for device performance data, where the acquiring module 10 includes: an acquisition unit 11 and a processing unit 12, wherein:

an acquisition unit 11 for acquiring quantitative initial data and qualitative initial data.

A processing unit 12, configured to perform formatting processing on the quantitative initial data and the qualitative initial data, so as to obtain quantitative performance data corresponding to the quantitative initial data and qualitative performance data corresponding to the qualitative initial data; the formatting process comprises time formatting process, resource name formatting process and index value formatting process.

In one embodiment, as shown in fig. 17, there is provided a processing apparatus of device performance data, the processing apparatus of device performance data further comprising: a second determination module 50 and a presentation module 60, wherein:

the second determining module 50 is configured to determine, according to the user indicator display requirement, at least one indicator to be displayed of the device to be detected, and an indicator display policy corresponding to the indicator to be displayed; the index display strategy comprises a longitudinal index display strategy for independently displaying the equipment to be detected and a transverse index display strategy for the equipment to be detected and at least one reference equipment.

The display module 60 is configured to display the index of each to-be-displayed index of the to-be-detected device according to the index display policy.

In one embodiment, as shown in fig. 18, there is provided a processing apparatus of device performance data, the processing apparatus of device performance data further comprising: a third determination module 70 and a storage module 80, wherein:

and a third determining module 70, configured to determine, according to the storage available space of each candidate database shard, a target database shard corresponding to the quantitative performance data, the qualitative performance data, and the abnormal performance data.

The storage module 80 is configured to store the quantitative performance data, the qualitative performance data, and the abnormal performance data into corresponding target database partitions.

The respective modules in the processing means of the above-mentioned device performance data may be implemented in whole or in part by software, hardware, and a combination thereof. The above modules may be embedded in hardware or may be independent of a processor in the computer device, or may be stored in software in a memory in the computer device, so that the processor may call and execute operations corresponding to the above modules.

In one embodiment, a computer device is provided, which may be a terminal, and the internal structure thereof may be as shown in fig. 19. The computer device includes a processor, a memory, a communication interface, a display screen, and an input device connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The communication interface of the computer device is used for carrying out wired or wireless communication with an external terminal, and the wireless mode can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. The computer program is executed by a processor to implement a method of processing device performance data. The display screen of the computer equipment can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment can be a touch layer covered on the display screen, can also be keys, a track ball or a touch pad arranged on the shell of the computer equipment, and can also be an external keyboard, a touch pad or a mouse and the like.

It will be appreciated by those skilled in the art that the structure shown in FIG. 19 is merely a block diagram of some of the structures associated with the present inventive arrangements and is not limiting of the computer device to which the present inventive arrangements may be applied, and that a particular computer device may include more or fewer components than shown, or may combine some of the components, or have a different arrangement of components.

In one embodiment, a computer device is provided comprising a memory and a processor, the memory having stored therein a computer program, the processor when executing the computer program performing the steps of:

In one embodiment, the processor when executing the computer program further performs the steps of:

acquiring quantitative initial data and qualitative initial data;

In one embodiment, a computer readable storage medium is provided having a computer program stored thereon, which when executed by a processor, performs the steps of:

In one embodiment, the computer program when executed by the processor further performs the steps of:

acquiring quantitative initial data and qualitative initial data;

In one embodiment, a computer program product is provided comprising a computer program which, when executed by a processor, performs the steps of:

acquiring quantitative initial data and qualitative initial data;

The user information (including but not limited to user equipment information, user personal information, etc.) and the data (including but not limited to data for analysis, stored data, presented data, etc.) related to the present application are information and data authorized by the user or sufficiently authorized by each party.

Those skilled in the art will appreciate that implementing all or part of the above-described methods in accordance with the embodiments may be accomplished by way of a computer program stored on a non-transitory computer readable storage medium, which when executed may comprise the steps of the embodiments of the methods described above. Any reference to memory, database, or other medium used in embodiments provided herein may include at least one of non-volatile and volatile memory. The nonvolatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical Memory, high density embedded nonvolatile Memory, resistive random access Memory (ReRAM), magnetic random access Memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric Memory (Ferroelectric Random Access Memory, FRAM), phase change Memory (Phase Change Memory, PCM), graphene Memory, and the like. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, and the like. By way of illustration, and not limitation, RAM can be in the form of a variety of forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), and the like. The databases referred to in the embodiments provided herein may include at least one of a relational database and a non-relational database. The non-relational database may include, but is not limited to, a blockchain-based distributed database, and the like. The processor referred to in the embodiments provided in the present application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, or the like, but is not limited thereto.

The technical features of the above embodiments may be arbitrarily combined, and all possible combinations of the technical features in the above embodiments are not described for brevity of description, however, as long as there is no contradiction between the combinations of the technical features, they should be considered as the scope of the description.

The foregoing examples illustrate only a few embodiments of the application, which are described in detail and are not to be construed as limiting the scope of the application. It should be noted that it will be apparent to those skilled in the art that several variations and modifications can be made without departing from the spirit of the application, which are all within the scope of the application. Accordingly, the scope of the application should be assessed as that of the appended claims.

Claims

1. A method of processing device performance data, the method comprising:

Determining root-cause performance data which cause abnormality of equipment to be detected according to the abnormal performance data;

2. The method of claim 1, wherein determining the root cause performance data that causes the anomaly in the device to be detected based on the anomaly performance data comprises:

if so, determining root performance data causing abnormality of the equipment to be detected according to the data flow direction relations among different index levels and the predicted abnormality data of the equipment to be detected; the prediction abnormal data are obtained according to the qualitative performance data in a prediction mode;

3. The method according to claim 2, wherein determining the root cause performance data that causes the abnormality of the device to be detected based on the data flow direction relationship between the different index levels and the predicted abnormality data of the device to be detected comprises:

judging whether the index data flow relation among different index levels contains the associated abnormal data or not;

if the associated abnormal data are contained, determining upstream abnormal data corresponding to the associated abnormal data contained in the index data flow direction relation, and taking the upstream abnormal data as root performance data which cause the abnormality of the equipment to be detected;

if the associated abnormal data are not contained, determining whether each associated abnormal data contain target abnormal data or not; wherein the target abnormal data belongs to qualitative performance data and predictive abnormal data;

4. The method according to claim 2, wherein determining the root cause performance data that causes the abnormality of the device to be detected based on the number of associated abnormality data belonging to the downstream index level comprises:

5. The method of claim 1, wherein the performing abnormal data pre-warning on the device to be detected according to the root cause performance data comprises:

6. The method of claim 1, wherein analyzing the quantitative performance data and the qualitative performance data and determining abnormal performance data from the quantitative performance data and the qualitative performance data based on the analysis results comprises:

Taking the quantitative performance data which is larger than an index threshold value as an abnormal performance index;

7. The method of claim 1, wherein the acquiring quantitative performance data and qualitative performance data during operation of the device to be tested comprises:

acquiring quantitative initial data and qualitative initial data;

8. The method according to any one of claims 1-7, further comprising:

determining at least one index to be displayed of equipment to be detected and an index display strategy corresponding to the index to be displayed according to user index display requirements; the index display strategy comprises a longitudinal index display strategy for independently displaying the equipment to be detected and a transverse index display strategy for the equipment to be detected and at least one reference equipment;

9. The method according to any one of claims 1-7, further comprising:

10. A device performance data processing apparatus, the apparatus comprising:

11. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor implements the steps of the method of any one of claims 1 to 9 when the computer program is executed.

12. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any of claims 1 to 9.

13. A computer program product comprising a computer program, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any one of claims 1 to 9.