WO2020093637A1 - Device state prediction method and system, computer apparatus and storage medium - Google Patents

Abstract

A device state prediction method and system, a computer device and a storage medium. The device state prediction method comprises: acquiring time series data of a first monitored object and a second monitored object associated therewith; generating multiple tendency charts according to the time series data of the second monitored object, wherein each tendency chart corresponds to a type indicator of the second monitored object; compiling statistics to obtain extreme points included in each tendency chart of the second monitored object; determining, according to the extreme points of each tendency chart, whether an abnormality occurs in the type indicator corresponding to the tendency chart; and when a first type indicator of the second monitored object is determined to be abnormal, predicting the state of a second type indicator of the first monitored object associated with the first type indicator according to the time series data of the first type indicator. This method is based on a data analysis algorithm, which can analyze and predict the running state tendency of a monitored object, and thus can discover a problem in advance and provide an alarm notification in advance.

Description

Equipment state prediction method, system, computer device and storage medium

This application requires priority to be submitted to the Chinese Patent Office on November 9, 2018, with the application number 201811334475.9, and the Chinese patent application titled "Equipment State Prediction Methods, Systems, Terminals, and Computer-readable Storage Media". The reference is incorporated in this application.

Technical field

The present application relates to the field of data processing, and in particular, to a method, system, computer device, and storage medium for predicting equipment status.

Background technique

This section is intended to provide background or context for the implementation of the application as set forth in the claims and the detailed description. The description here is not admitted to be prior art because it is included in this section.

Automatic monitoring of equipment failure has become an important technical means to ensure the normal operation of equipment. When a certain parameter of the device exceeds the preset alarm threshold, the device can send out corresponding alarm information. Existing equipment monitoring platforms cannot analyze and judge the running state trends of the monitored objects, and thus cannot find problems in advance, and cannot give alarm notifications in advance.

Summary of the invention

In view of the above, the present application provides an equipment state prediction method, system, computer device, and storage medium, which can analyze and predict equipment operating state trends in advance to provide early warning.

An embodiment of the present application provides a method for predicting a device state. The method includes:

Acquiring time series data of a first monitored object and a second monitored object associated with the first monitored object, wherein each of the monitored objects includes one or more monitored categories, and each of the monitored categories includes one or more Type index, the time series data is a parameter set of each type index at different time nodes;

Generating a plurality of trend graphs according to the time series data of the second monitored object, where each of the trend graphs corresponds to each type of indicator of the second monitored object;

Statistically obtain the extreme point included in each trend graph of the second monitored object through a preset trend analysis algorithm;

Judging whether the type index corresponding to the trend graph is abnormal according to each extreme point of the trend graph; and

When the first type indicator of the second monitored object is determined to be abnormal, the state of the second type indicator of the first monitored object is predicted based on the time series data of the first type indicator, where the A second type indicator of a monitored object is associated with the first type indicator of the second monitored object.

An embodiment of the present application provides an equipment state prediction system, the system including:

An obtaining module, configured to obtain time series data of a first monitored object and a second monitored object associated with the first monitored object, wherein each of the monitored objects includes one or more monitored categories, and each of the monitored categories Including one or more types of indicators, and the time series data is a parameter set of each of the types of indicators at different time nodes;

A generating module, configured to generate a plurality of trend graphs according to the time series data of the second monitored object, wherein each of the trend graphs corresponds to each type of indicator of the second monitored object;

A statistics module, configured to obtain the extreme point included in each trend graph of the second monitoring object through a statistical analysis of a preset trend analysis algorithm;

A judging module, used to judge whether the type index corresponding to the trend graph is abnormal according to each extreme point of the trend graph; and

A prediction module, configured to predict the state of the second type indicator of the first monitored object according to the time series data of the first type indicator when the first type indicator of the second monitored object is determined to be abnormal;

Wherein, the second type index of the first monitored object is associated with the first type index of the second monitored object.

An embodiment of the present application provides a computer device. The computer device includes a processor and a memory. The memory stores a plurality of computer-readable instructions. The processor is used to execute the computer-readable instructions stored in the memory. The steps of the device state prediction method described above.

An embodiment of the present application provides a non-volatile readable storage medium on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor, the steps of the device state prediction method described above are implemented.

The above-mentioned device state prediction method, system, computer device and storage medium can realize the analysis and prediction of the running state of the monitored object by acquiring the time series data of one or more monitored objects, and can also monitor the abnormal state according to a determination The time series data of the object can predict the running state of other monitoring objects associated with it, so that the problem can be found in advance and the alarm notification can be made in advance.

BRIEF DESCRIPTION

FIG. 1 is a flowchart of steps in a method for predicting device status in an embodiment of the present application.

FIG. 2 is a functional block diagram of a device state prediction system in an embodiment of this application.

3 is a schematic diagram of a computer device in an embodiment of the application.

detailed description

Preferably, the device state prediction method of the present application is applied to one or more computer devices. The computer device is a device that can automatically perform numerical calculation and / or information processing according to a preset or stored instruction, and its hardware includes but is not limited to a microprocessor, an application specific integrated circuit (Application Specific Integrated Circuit, ASIC) , Programmable gate array (Field-Programmable Gate Array, FPGA), digital processor (Digital Signal Processor, DSP), embedded equipment, etc.

Example one:

FIG. 1 is a flowchart of steps of a preferred embodiment of a method for predicting a device state of the present application. According to different requirements, the order of the steps in the flowchart can be changed, and some steps can be omitted.

Referring to FIG. 1, the method for predicting a device state specifically includes the following steps.

Step S11: Acquire time series data of a first monitoring object and a second monitoring object associated with the first monitoring object, where each monitoring object includes one or more monitoring categories, and each monitoring category includes one Or multiple types of indicators, the time series data is a parameter set of each of the types of indicators at different time nodes.

In one embodiment, it is possible to connect to one or more of the monitoring objects by accessing a network, and then obtain time series data of each monitoring object. The monitoring object may be a server, a server cluster, or other electronic devices. The server or the server cluster may include several hardware resources (for example: CPU, memory, I / O interface, memory, etc.). The server or the server cluster may run different or the same operating system, database, application software, and system software. Understandably, the server cluster may be composed of multiple virtual machine managers (Virtual Machine Manager, VMM) and a number of physical nodes (Physical Node, PN), multiple operating systems running on the VMM, through VMM resources Scheduling algorithms, these operating systems share physical machine resources.

For example, the monitoring objects include a first monitoring object and a second monitoring object. There is an association relationship between the first monitoring object and the second monitoring object. When the second monitoring object changes, if the first monitoring object does not change accordingly, the first monitoring object may be caused The resources of the object are wasted or overloaded. Therefore, when the second monitoring object changes, the first monitoring object associated with it needs to be adjusted accordingly; or when the second monitoring object is a type of indicator The parameter changes, which causes a type indicator of the first monitored object to change following the change of the type indicator parameter of the second monitored object.

Each monitoring object includes one or more monitoring categories, and each monitoring category includes one or more type indicators. Understandably, the time-series data of the monitoring object is a parameter set of each of the types of indicators at different time nodes.

In one embodiment, the monitoring objects may include system resource objects and / or business type objects, and the time series data of the monitoring objects may be received / acquired in real time or periodically. For example, the time-series data is read from the monitoring object every preset time, or the monitoring object uploads the time-series data to the device state prediction system every preset time.

For example, when the server is used as a system resource monitoring object, the monitoring object may include CPU, memory, hard disk, and other hardware monitoring categories, and may also include database, system software, and other software monitoring categories running on the server. . When the monitoring category is CPU, it can output the utilization rate (the percentage of time the processor executes non-idle threads), the interrupt rate (the number of times the device interrupts the processor per second), and the system call rate (the processor calls the operating system service routine Parameter rate of other types of indicators; when the monitoring category is memory, it can output the page missing rate (indicating that the processor requests an error on a page from the specified location of the memory) and other parameter indicators; when the monitoring category is hard disk At this time, it can output parameter information such as the average number of read and write requests (the hard disk is queued in the instance interval); when the monitoring category is database, it can output parameter information such as data read and write performance.

When the business type is the monitoring object of the business class, it may include monitoring categories such as user login volume, user registration volume, and core transaction data. For example, when the monitoring category is the user login volume, parameter information such as the number of users online can be output; when the monitoring category is the user registration volume, parameter information such as the number of registered accounts can be output. When the monitoring category is core transaction data , Can output parameter information of order, click advertisement and other types of indicators.

In this embodiment, the monitored object has attribute information, and the attribute information may include but is not limited to location information. For example, the monitoring object is the location information of the server, which can acquire the attribute information of the monitoring object at the same time of acquiring the time series data of the monitoring object, or the server stores one or more attribute information, when acquiring the time series data of the monitoring object , You can get the corresponding attribute information from the stored attribute information. For example, at 21:24:44 on September 3, 2017, the CPU utilization rate of server 001 in East China is 80.02%, and the attribute information of server 001 can be represented in East China.

Understandably, the time series data may be expressed as parameter information v of the type indicator corresponding to the monitoring category at time t. For example, at 21:24:44 on September 3, 2017, the CPU utilization rate of server 001 in East China is 80.02%, where the time information is 21:24:44 on September 3, 2017, and the monitoring object is Server 001, the monitoring category is CPU, the type index is utilization rate, and the parameter information of the type index is 80.02%. Therefore, when the monitoring category includes a type indicator, the time series data of the corresponding monitoring category can be expressed as: {X = (v ₁ , t ₁ ), (v ₂ , t ₂ ), ..., (v _n , t _n )} where n is a natural number, (v _n , t _n ) represents the time node data of time node t _n , t _n > t _n-1 , that is, the time node data (v _n , t _n ) is the latest time Node data; when the monitoring category includes two or more types of indicators, the time series data of the monitoring category can be expressed as: X = {X ₁ , X ₂ , ..., X _m }, where X _m can represent Is: {X _m = (v _1m , t ₁ ), (v _2m , t ₂ ), ..., (v _nm , t _n )}, where m represents the number of type indicators and n is a natural number.

In one embodiment, after the time-series data of the monitored object is obtained, it can also be stored locally to facilitate subsequent data analysis and reading. The time series data can be stored in the relational database by default, that is, the time t and the parameter information v of the type index in the time series data are stored as key-value pairs in the relational database. Among them, the relational database may be an RRD Tool database that is simply stored based on files, an opentsdb database built on the K / V database, and a mysql and postgresql database built on the relational database.

In other embodiments of the present application, when the requirements for data storage are high or the amount of data is relatively large, the time series data may be stored in a time series data type database to improve data reading and writing efficiency and reduce the storage space occupied by the data. The time series data database may include Elasticsearch, Crate.io, Solr databases based on Lucene, or Vertica and Actian databases based on columnar storage databases.

Step S12: Generate a plurality of trend graphs according to the time series data of the second monitored object, where each of the trend graphs corresponds to each type of indicator of the second monitored object.

In one embodiment, a trend graph corresponding to the second monitored object may be generated based on the second monitored object time series data. Specifically, after acquiring the time series data of the second monitoring object, first classify the time series data of the second monitoring object, for example, sort the time series data of the second monitoring object according to each monitoring The categories are classified once, and then the time series data of each monitoring category is classified again according to each type of index, and then a trend graph corresponding to each type of index is generated according to the classified time series data.

When the monitoring category has a type indicator (for example, when the monitoring category is memory, it has a type index of page miss rate; or when the monitoring category is user login volume, it has a type indicator for the number of users online), the corresponding time series The data can be expressed as {X = (v ₁ , t ₁ ), (v ₂ , t ₂ ), ..., (v _n , t _n )}, establish an XY coordinate axis, and time t _n in the time series data As a point on the horizontal axis (X axis) of the trend graph, and the parameter information v _{n of the} corresponding type index is used as the value on the vertical axis (Y axis) of the trend graph, after which, the parameter information of the corresponding type index is passed Straight line or smooth curve connection, so that you can generate a trend graph corresponding to the monitoring category.

When the monitoring category has two or more types of indicators, the corresponding time series data can be expressed as: X = {X ₁ , X ₂ , ..., X _m }, where X _m can be expressed as: {X _m = ( v _1m , t ₁ ), (v2 _m, t ₂ ),…, (v _nm , t _n )}. For example, when the monitoring category is CPU, it has three types of indicators: utilization rate, interruption rate, and system call rate. At this time, the acquired time series data can be expressed as X = {X ₁ , X ₂ , X ₃ }. The time series data is classified and split to obtain sub-time series X ₁ , X ₂ , and X ₃ corresponding to each type of index, where X ₁ corresponds to the type index of utilization, X ₂ corresponds to the type index of interruption rate, and X ₃ corresponds to Type indicators of system call rate, and then draw a trend graph corresponding to each type of indicators in the above manner.

For example, for the trend graph of CPU utilization, for the X ₁ sub-time series, it can be expressed as {X ₁ = (v ₁₁ , t ₁ ), (v ₁₂ , t ₂ ),…, (v _n1 , t _n )}, each time t _n in the time series data can be taken as the point on the horizontal axis of the first trend graph, and the parameter information v _n1 of the corresponding type indicator can be taken as the value on the vertical axis of the first trend graph, and then Then, the parameter information of the corresponding type indicator is connected by a straight line or a smooth curve, so that the first trend graph corresponding to the CPU utilization rate can be generated. Similarly, for the trend graph of the CPU interrupt rate, for the X ₂ sub-time series, it can be expressed as {X ₂ = (v ₂₁ , t ₁ ), (v ₂₂ , t ₂ ),…, (v _n2 , t _n )}, each time t _n in the time series data can be used as a point on the horizontal axis of the trend graph, and the parameter information v _{n2 of the} corresponding type index can be used as the value on the vertical axis of the trend graph. The parameter information of the type indicator is connected by a straight line or a smooth curve, so that a second trend graph corresponding to the CPU interrupt rate can be generated. As such, for the trend graph whose monitoring type is CPU, it may include the trend graphs corresponding to the three types of indicators of utilization rate, interruption rate, and system call.

In step S13, the extreme point included in each trend graph of the second monitored object is statistically obtained through a preset trend analysis algorithm.

In one embodiment, the extreme point included in each trend graph of the second monitored object can be obtained by statistically: first, randomly select a time node data and the time node data from a trend graph Adjacent last time node data, then calculate the trend slope between the time node data and the last time node data, and then determine whether the calculated trend slope is greater than a preset threshold; when the trend slope is greater than When the preset threshold is determined, it is determined that the time node data is an extreme point in the trend graph.

For example, selecting a time node data (v _m , t _m ) and a previous time node data (v _m-1 , t _m-1 ) adjacent to the time node data from a trend graph, the trend The slope can be calculated by the following mathematical formula:

K _m = | (V _m -V _m-1 ) / (t _m -t _m-1 ) |

Among them, K _m is the trend slope. If the trend slope K _m > R, where R represents a preset threshold, then it can be determined that the time node data (v _m , t _m ) is an extreme point in the trend graph.

In an embodiment, the set of all extreme points in a trend graph can be represented as an extreme value set. The R value for different category indicators can be set differently. For example, according to the application system, the CPU utilization fluctuates within ± 5%. If it is too low, the CPU utilization of the server is not high; if it is too high, the CPU may become the processing bottleneck of the system. Therefore, for the monitoring category is CPU, the preset threshold of the utilization type index can be set to [-5, 5]. For the CPU interrupt rate, in general, the lower the processor interrupt rate, the better; it should not exceed 1000 times per second; if the value of the interrupt rate increases significantly, it may indicate that there is a hardware problem, you need to check the network adapter that caused the interrupt , Disk or other hardware. Therefore, for the monitoring category CPU, the preset threshold of the type indication of the interrupt rate is 1000 times.

Step S14: Determine whether the type indicator corresponding to the trend graph is abnormal according to each extreme point of the trend graph.

In one embodiment, the comprehensive trend slope K corresponding to two or more time series data adjacent to the extreme point in a trend graph can be used to determine whether the type indicator corresponding to the trend graph is abnormal. Specifically: first, randomly select an extreme point from a trend graph, and obtain data of at least two prior time nodes adjacent to the extreme point; secondly, calculate the data of the extreme point and the first time node respectively The first trend slope between, the second trend slope between the extreme point and the second time node data, wherein the first time node data is the data of the last time node that is close to the extreme point, The second time node data is the last time node data adjacent to the first time node data; furthermore, the standard deviation and the mean slope of the first trend slope and the second trend slope are calculated; furthermore , Based on the calculated standard deviation and mean slope, the comprehensive trend slope of the extreme point is calculated; finally, it is determined whether the comprehensive trend slope of the extreme point is within a preset range value; when the extreme point is integrated When the trend slope is not within the preset range value, it is determined that the type indicator corresponding to the trend graph is abnormal.

For example, for an extreme point, the corresponding time series data is (v _m , t _m ), so the two time series data adjacent to the extreme point are (v _m-1 , t _{m- 1} ), (v _m-2 , t _m-2 ); the three time series data adjacent to the extreme point are (v _m-1 , t _m-1 ), (v _m-2 , t _{m- 2} ), (v _m-3 , t _m-3 ). The following uses the data of the extreme point and the three adjacent time nodes as an example to illustrate:

Suppose that the trend slope between time series data (v _m , t _m ) and time series data (v _m-1 , t _m-1 ) is K _{m, m-1} ; time series data (v _m , t _m ) The trend slope with time series data (v _m-2 , t _m-2 ) is K _{m, m-2} , time series data (v _m , t _m ) and time series data (v _m-3 , t _{m -3} ) The slope of the trend between K _{m, m-3} ;

The standard deviation K _{m, sd} between the trend slopes K _{m, m-1} , K _{m, m-2} , K _{m, m-3} can be calculated by the following mathematical formula:

Trends slope _{K m, m-1, K} m, m-2, K m, the mean slope O _{m m-3} may be obtained by the following equation is _{calculated: O m = (K m,} m-1 + K m, m _-2 + K _{m, m-2} ) / 3;

For the extreme point (v _m , t _m ), the comprehensive trend slope K can be calculated by the following mathematical formula:

K = (K _{m, m-1} -O _m ) / K _{m, sd} * K _{m, m-1} + (K _{m, m-2} -O _m ) / K _{m, sd} * K _{m, m-2} + (K _{m, m-3} -O _m ) / K _{m, sd} * K _{m, m-3} ;

By judging whether the comprehensive trend slope K is within the preset range [-c, c], when K is within the preset range [-c, c], it indicates that the status of this type of indicator is normal; when K is not within the preset range [ -c, c] indicates that the status of this type of indicator is abnormal. The preset range [-c, c] can be set and adjusted according to actual use requirements.

Step S15, when the first type indicator of the second monitored object is determined to be abnormal, the state of the second type indicator of the first monitored object is predicted according to the time series data of the first type indicator; wherein, The second type index of the first monitored object is associated with the first type index of the second monitored object.

In an embodiment, when the comprehensive trend slope K of the first type indicator of the second monitored object that has an extreme point is not within the preset range [-c, c], it indicates that the state of the first type indicator is abnormal .

When the first type indicator of the second monitored object is determined to be abnormal, the manner of predicting the state of the second type indicator of the first monitored object according to the time series data of the first type indicator may specifically be: Obtain all comprehensive trend slopes included in the first type indicator that are not within the preset range value, and calculate the average comprehensive trend slope of those comprehensive trend slopes that are not within the preset range value, and then calculate according to the average Comprehensively calculate the slope of the trend and the current time node data of the second type indicator to calculate the next time node data of the second type indicator, and finally obtain the second time node data according to the next time node data of the second type indicator The state of the type indicator at the next time.

For example, the first type of indicator includes three extreme value points, and the comprehensive trend slope is not within the preset range. The comprehensive trend slopes of the three extreme points are K1, K2, and K3, respectively. average overall trend slope extrema points _{K p = (K1 + K2 +} K3) / 3. Assuming that the current time node data of the second type indicator is (v _p , t _p ), the time node data of the second type indicator at the next time node t _{P + 1} is (v _{p + 1} , t _{p + 1} ), where v _{p + 1} can be calculated by the following mathematical formula: v _{p + 1} = v _p + K _p .

In an embodiment, the second type index of the first monitored object may be predicted at the next time according to time node data (v _p , t _p ), (v _{p + 1} , t _{p + 1} ) The state of the node t _{p + 1} , specifically, two adjacent time series data (v _p , t _p ), (v _{p + 1} , t _{p + 1} ), the time series data (v _{p + 1} , t _{p + 1} ) relative to the time series data (v _p , t _p ) trend slope K _{p + 1} = (v _{p + 1} -v _p ) / (t _{p + 1} -t _p ), when K _{p + 1} > R, it means that the time series data (v _{p + 1} , t _{p + 1} ) corresponds to the maximum value; when the trend slope K _{p + 1} <-R, it means the time series data (v _{p + 1} , t _{p + 1} ) Corresponding to the minimum value. When (v _{p + 1} , t _{p + 1} ) is a maximum value, it means that the operating parameter of the second type indicator is too high, and it can be judged that the second type indicator of the first monitored object may be at the time node t _{p + 1} Overload operation occurs, and the first warning message is output; when (v _{p + 1} , t _{p + 1} ) is a minimum value, it indicates that the operating parameter of the second type index is too low, and the first monitoring can be judged The second type indicator of the object may have the possibility of wasting resources at the time node t _{p + 1} and output the second warning prompt information.

In an embodiment, the warning information may further include attribute information corresponding to the first monitored object, for example, the warning information is: the server 002 in the East China District may be overloaded at the time node t _{p + 1} , It is beneficial to locate the position of the first monitored object and perform targeted processing.

Example 2:

FIG. 2 is a functional block diagram of a preferred embodiment of the device state prediction system of the present application.

Referring to FIG. 2, the device state prediction system 10 may include an acquisition module 101, a generation module 102, a statistics module 103, a judgment module 104, and a prediction module 105.

The acquiring module 101 is used to acquire time series data of a first monitoring object and a second monitoring object associated with the first monitoring object, wherein each of the monitoring objects includes one or more monitoring categories, each of which The monitoring category includes one or more type indicators, and the time series data is a parameter set of each type indicator at different time nodes.

In one embodiment, the acquisition module 101 may be connected to one or more monitoring objects by accessing a network, and then acquiring time series data of each monitoring object. The monitoring object may be a server, a server cluster, or other electronic devices. The server or the server cluster may include several hardware resources (for example: CPU, memory, I / O interface, memory, etc.). The server or the server cluster may run different or the same operating system, database, application software, and system software. Understandably, the server cluster may be composed of multiple virtual machine managers (Virtual Machine Manager, VMM) and a number of physical nodes (Physical Node, PN), multiple operating systems running on the VMM, through VMM resources Scheduling algorithms, these operating systems share physical machine resources.

For example, the monitoring objects include a first monitoring object and a second monitoring object. There is an association relationship between the first monitoring object and the second monitoring object. When the second monitoring object changes, if the first monitoring object does not change accordingly, the first monitoring object may be caused The resources of the object are wasted or overloaded. Therefore, when the second monitoring object changes, the first monitoring object associated with it needs to be adjusted accordingly; or when the second monitoring object is a type of indicator The parameter changes, which causes a type indicator of the first monitored object to change following the change of the type indicator parameter of the second monitored object.

Each monitoring object includes one or more monitoring categories, and each monitoring category includes one or more type indicators. Understandably, the time-series data of the monitoring object is a parameter set of each of the types of indicators at different time nodes.

In one embodiment, the monitoring objects may include system resource objects and / or business type objects, and the time series data of the monitoring objects may be received / acquired in real time or periodically. For example, the time-series data is read from the monitoring object every preset time, or the monitoring object uploads the time-series data to the device state prediction system every preset time.

For example, when the server is used as a system resource monitoring object, the monitoring object may include CPU, memory, hard disk, and other hardware monitoring categories, and may also include database, system software, and other software monitoring categories running on the server. . When the monitoring category is CPU, it can output the utilization rate (the percentage of time the processor executes non-idle threads), the interrupt rate (the number of times the device interrupts the processor per second), and the system call rate (the processor calls the operating system service routine Parameter rate of other types of indicators; when the monitoring category is memory, it can output the page missing rate (indicating that the processor requests an error on a page from the specified location of the memory) and other parameter indicators; when the monitoring category is hard disk At this time, it can output parameter information such as the average number of read and write requests (the hard disk is queued in the instance interval); when the monitoring category is database, it can output parameter information such as data read and write performance.

When the business type is the monitoring object of the business class, it may include monitoring categories such as user login volume, user registration volume, and core transaction data. For example, when the monitoring category is the user login volume, parameter information such as the number of users online can be output; when the monitoring category is the user registration volume, parameter information such as the number of registered accounts can be output. , Can output parameter information of order, click advertisement and other types of indicators.

In this embodiment, the monitored object has attribute information, and the attribute information may include but is not limited to location information. For example, the monitoring object is the location information of the server, which can acquire the attribute information of the monitoring object at the same time of acquiring the time series data of the monitoring object, or the server stores one or more attribute information when acquiring the time series data of the monitoring object , You can get the corresponding attribute information from the stored attribute information. For example, at 21:24:44 on September 3, 2017, the CPU utilization rate of server 001 in East China is 80.02%, and the attribute information of server 001 can be represented in East China.

Understandably, the time series data may be expressed as parameter information v of the type indicator corresponding to the monitoring category at time t. For example, at 21:24:44 on September 3, 2017, the CPU utilization rate of server 001 in East China is 80.02%, where the time information is 21:24:44 on September 3, 2017, and the monitoring object is Server 001, the monitoring category is CPU, the type index is utilization rate, and the parameter information of the type index is 80.02%. Therefore, when the monitoring category includes a type indicator, the time series data of the corresponding monitoring category can be expressed as: {X = (v ₁ , t ₁ ), (v ₂ , t ₂ ), ..., (v _n , t _n )} where n is a natural number, (v _n , t _n ) represents the time node data of time node t _n , t _n > t _n-1 , that is, the time node data (v _n , t _n ) is the latest time Node data; when the monitoring category includes two or more types of indicators, the time series data of the monitoring category can be expressed as: X = {X ₁ , X ₂ , ..., X _m }, where X _m can represent Is: {X _m = (v _1m , t ₁ ), (v _2m , t ₂ ), ..., (v _nm , t _n )}, where m represents the number of type indicators and n is a natural number.

In one embodiment, after the time-series data of the monitored object is obtained, it can also be stored locally to facilitate subsequent data analysis and reading. The time series data can be stored in the relational database by default, that is, the time t and the parameter information v of the type index in the time series data are stored as key-value pairs in the relational database. Among them, the relational database may be an RRD Tool database that is simply stored based on files, an opentsdb database built on the K / V database, and a mysql and postgresql database built on the relational database.

In other embodiments of the present application, when data storage requirements are high or the amount of data is relatively large, time series data may be stored in a time series data database to improve data read and write efficiency and reduce data storage space. The time series data database may include Elasticsearch, Crate.io, Solr databases based on Lucene, or Vertica and Actian databases based on columnar storage databases.

The generating module 102 is configured to generate a plurality of trend graphs according to the time series data of the second monitored object, where each of the trend graphs corresponds to each type of indicator of the second monitored object.

In an embodiment, the generating module 102 may generate a trend graph corresponding to the second monitored object according to the second monitored object time series data. Specifically, after acquiring the time series data of the second monitored object, the generation module 102 first classifies the time series data of the second monitored object, for example, the time series of the second monitored object The data is classified once for each monitoring category, and then the time series data of each monitoring category is classified again according to each type of indicator, and then a trend graph corresponding to each type of indicator is generated according to the classified time series data .

When the monitoring category has a type indicator (for example, when the monitoring category is memory, it has a type index of page miss rate; or when the monitoring category is user login volume, it has a type indicator for the number of users online), the corresponding time series The data can be expressed as {X = (v ₁ , t ₁ ), (v ₂ , t ₂ ), ..., (v _n , t _n )}, the generation module 102 establishes an XY coordinate axis and converts the time series data At each time t _{n in the} graph as the point on the horizontal axis (X axis) of the trend graph, and the parameter information v _{n of the} corresponding type index is taken as the value on the vertical axis (Y axis) of the trend graph, and then the corresponding type The parameter information of the indicator is connected by a straight line or a smooth curve, so that a trend graph corresponding to the monitoring category can be generated.

When the monitoring category has two or more types of indicators, the corresponding time series data can be expressed as: X = {X ₁ , X ₂ , ..., X _m }, where X _m can be expressed as: {X _m = ( v _1m , t ₁ ), (v _2m , t ₂ ),…, (v _nm , t _n )}. For example, when the monitoring category is CPU, it has three types of indicators: utilization rate, interruption rate, and system call rate. At this time, the acquired time series data can be expressed as X = {X ₁ , X ₂ , X ₃ }. The time series data is classified and split to obtain sub-time series X ₁ , X ₂ , and X ₃ corresponding to each type of index, where X ₁ corresponds to the type index of utilization rate, X ₂ corresponds to the type index of interruption rate, and X ₃ corresponds to Type indicators of system call rate, and then draw a trend graph corresponding to each type of indicators in the above manner.

For example, for the trend graph of CPU utilization, for the X1 sub-time series, it can be expressed as {X ₁ = (v ₁₁ , t ₁ ), (v ₁₂ , t ₂ ),…, (v _n1 , t _n )}, Each time t _n in the time series data can be used as a point on the horizontal axis of the first trend graph, and the parameter information v _n1 of the corresponding type indicator can be used as the value on the vertical axis of the first trend graph. Then, the parameter information of the corresponding type indicator is connected by a straight line or a smooth curve, so that a first trend graph corresponding to the CPU utilization rate can be generated. Similarly, for the trend graph of the CPU interrupt rate, for the X ₂ sub-time series, it can be expressed as {X ₂ = (v ₂₁ , t ₁ ), (v ₂₂ , t ₂ ),…, (v _n2 , t _n )}, each time t _n in the time series data can be used as a point on the horizontal axis of the trend graph, and the parameter information v _{n2 of the} corresponding type index can be used as the value on the vertical axis of the trend graph. The parameter information of the type indicator is connected by a straight line or a smooth curve, so that a second trend graph corresponding to the CPU interrupt rate can be generated. As such, for the trend graph whose monitoring type is CPU, it may include the trend graphs corresponding to the three types of indicators of utilization rate, interruption rate, and system call.

The statistics module 103 is configured to obtain the extreme point included in each trend graph of the second monitored object through a statistical analysis of a preset trend analysis algorithm.

In an embodiment, the statistics module 103 can statistically obtain the extreme point included in each trend graph of the second monitored object by first selecting a time node data and a random from a trend graph The last time node data adjacent to the time node data, then calculate the trend slope between the time node data and the last time node data, and then determine whether the calculated trend slope is greater than a preset threshold; When the slope of the trend is greater than the preset threshold, it is determined that the time node data is an extreme point in the trend graph.

For example, the statistics module 103 selects a time node data (v _m , t _m ) and a previous time node data (v _m-1 , t _m- adjacent to the time node data from a trend graph ₁ ), the trend slope can be calculated by the following mathematical formula:

K _m = | (V _m -V _m-1 ) / (t _m -t _m-1 ) |

Among them, K _m is the trend slope. If the trend slope K _m > R, where R represents a preset threshold, then it can be determined that the time node data (v _m , t _m ) is an extreme point in the trend graph.

In an embodiment, the set of all extreme points in a trend graph can be represented as an extreme value set. The R value for different category indicators can be set differently. For example, according to the application system, the CPU utilization fluctuates within ± 5%. If it is too low, the CPU utilization of the server is not high; if it is too high, the CPU may become the processing bottleneck of the system. Therefore, for the monitoring category is CPU, the preset threshold of the utilization type index can be set to [-5, 5]. For the CPU interrupt rate, in general, the lower the processor interrupt rate, the better; it should not exceed 1000 times per second; if the value of the interrupt rate increases significantly, it may indicate that there is a hardware problem, you need to check the network adapter that caused the interrupt , Disk or other hardware. Therefore, for the monitoring category CPU, the preset threshold of the type indication of the interrupt rate is 1000 times.

The judgment module 104 is used for judging whether the type index corresponding to the trend graph is abnormal according to the extreme point of each trend graph.

In one embodiment, the judgment module 104 can determine the type indicator corresponding to the trend graph by using the comprehensive trend slope K corresponding to two or more time series data adjacent to the extreme point in a trend graph Is it abnormal? Specifically: first, randomly select an extreme point from a trend graph, and obtain data of at least two prior time nodes adjacent to the extreme point; secondly, calculate the data of the extreme point and the first time node respectively The first trend slope between, the second trend slope between the extreme point and the second time node data, wherein the first time node data is the data of the last time node that is close to the extreme point, The second time node data is the last time node data adjacent to the first time node data; furthermore, the standard deviation and the mean slope of the first trend slope and the second trend slope are calculated; furthermore , Based on the calculated standard deviation and mean slope, the comprehensive trend slope of the extreme point is calculated; finally, it is determined whether the comprehensive trend slope of the extreme point is within a preset range value; when the extreme point is integrated When the trend slope is not within the preset range value, it is determined that the type indicator corresponding to the trend graph is abnormal.

For example, for an extreme point, the corresponding time series data is (v _m , t _m ), so the two time series data adjacent to the extreme point are (v _m-1 , t _{m- 1} ), (v _m-2 , t _m-2 ); the three time series data adjacent to the extreme point are (v _m-1 , t _m-1 ), (v _m-2 , t _{m- 2} ), (v _m-3 , t _m-3 ). The following uses the data of the extreme point and the three adjacent time nodes as an example to illustrate:

Suppose that the trend slope between time series data (v _m , t _m ) and time series data (v _m-1 , t _m-1 ) is K _{m, m-1} ; time series data (v _m , t _m ) The trend slope with time series data (v _m-2 , t _m-2 ) is K _{m, m-2} , time series data (v _m , t _m ) and time series data (v _m-3 , t _{m -3} ) The slope of the trend between K _{m, m-3} ;

The standard deviation K _{m, sd} between the trend slopes K _{m, m-1} , K _{m, m-2} , K _{m, m-3} can be calculated by the following mathematical formula:

Trends slope _{K m, m-1, K} m, m-2, K m, the mean slope O _{m m-3} may be obtained by the following equation is _{calculated: O m = (K m,} m-1 + K m, m _-2 + K _{m, m-2} ) / 3;

For the extreme point (v _m , t _m ), the comprehensive trend slope K can be calculated by the following mathematical formula:

K = (K _{m, m-1} -O _m ) / K _{m, sd} * K _{m, m-1} + (K _{m, m-2} -O _m ) / K _{m, sd} * K _{m, m-2} + (K _{m, m-3} -O _m ) / K _{m, sd} * K _{m, m-3} ;

By determining whether the comprehensive trend slope K is within the preset range [-c, c] to determine whether this type of index is abnormal, when K is within the preset range [-c, c], it indicates that the status of this type of index is normal; When K is not within the preset range [-c, c], it means that the status of this type of indicator is abnormal. The preset range [-c, c] can be set and adjusted according to actual use requirements.

The prediction module 105 is used to predict the second type index of the first monitored object according to the time series data of the first type index when the first type index of the second monitored object is determined to be abnormal State; wherein, the second type index of the first monitored object is associated with the first type index of the second monitored object.

In an embodiment, when the comprehensive trend slope K of the first type indicator of the second monitored object that has an extreme point is not within the preset range [-c, c], it indicates that the state of the first type indicator is abnormal .

When the first type indicator of the second monitored object is determined to be abnormal, the prediction module 105 predicts the state of the second type indicator of the first monitored object based on the time series data of the first type indicator The method may be specifically: acquiring all comprehensive trend slopes included in the first type indicator that are not within the preset range value, and calculating an average comprehensive trend slope of the comprehensive trend slopes that are not within the preset range value, Then calculate the next time node data of the second type indicator according to the average comprehensive trend slope and the current time node data of the second type indicator, and finally according to the next time node data of the second type indicator Obtain the state of the second type indicator at the next time.

For example, the first type of indicator includes three extreme value points, and the comprehensive trend slope is not within the preset range. The comprehensive trend slopes of the three extreme points are K1, K2, and K3, respectively. average overall trend slope extrema points _{K p = (K1 + K2 +} K3) / 3. Assuming that the current time node data of the second type indicator is (v _p , t _p ), the time node data of the second type indicator at the next time node t _{P + 1} is (v _{p + 1} , t _{p + 1} ), where v _{p + 1} can be calculated by the following mathematical formula: v _{p + 1} = v _p + K _p .

In an embodiment, the prediction module 105 may predict that the second type of indicators of the first monitored object will be based on time node data (v _p , t _p ), (v _{p + 1} , t _{p + 1} ) The state of the next time node t _{p + 1} coming, specifically, two adjacent time series data (v _p , t _p ), (v _{p + 1} , t _{p + 1} ), the time series data can be calculated ( _{v p + 1, t p +} 1) with respect to time-series data (v _p, t _p) of the trend of the slope _{K p + 1 = (v p} + 1 -v p) / (t p + 1 -t p), When K _{p + 1} > R, it means that the time series data (v _{p + 1} , t _{p + 1} ) corresponds to the maximum value; when the trend slope K _{p + 1} <-R, it means that the time series data (v _{p + 1} , t _{p + 1} ) corresponds to the minimum value. When (v _{p + 1} , t _{p + 1} ) is a maximum value, it means that the operating parameter of the second type indicator is too high, and it can be judged that the second type indicator of the first monitored object may be at the time node t _{p + 1} Overload operation occurs, and the first warning message is output; when (v _{p + 1} , t _{p + 1} ) is a minimum value, it indicates that the operating parameter of the second type index is too low, and the first monitoring can be judged The second type indicator of the object may have the possibility of wasting resources at the time node t _{p + 1} and output the second warning prompt information.

In an embodiment, the warning information may further include attribute information corresponding to the first monitored object, for example, the warning information is: the server 002 in the East China District may be overloaded at the time node t _{p + 1} , It is beneficial to locate the position of the first monitored object and perform targeted processing.

FIG. 3 is a schematic diagram of a preferred embodiment of the computer device of the present application.

The computer device 1 includes a memory 20, a processor 30, and computer-readable instructions 40 stored in the memory 20 and executable on the processor 30, such as a device state prediction program. When the processor 30 executes the computer-readable instruction 40, the steps in the embodiment of the device state prediction method described above are implemented, for example, steps S11 to S15 shown in FIG. 1. Alternatively, when the processor 30 executes the computer-readable instructions 40, the functions of the modules in the embodiment of the device state prediction system described above are implemented, for example, the modules 101 to 105 in FIG. 2.

Exemplarily, the computer-readable instructions 40 may be divided into one or more modules / units, the one or more modules / units are stored in the memory 20 and executed by the processor 30, To complete this application. The one or more modules / units may be a series of computer-readable instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer-readable instructions 40 in the computer device 1. For example, the computer-readable instructions 40 may be divided into an acquisition module 101, a generation module 102, a statistics module 103, a judgment module 104, and a prediction module 105 in FIG. For specific functions of each module, see Embodiment 2.

The computer device 1 may be a computing device such as a desktop computer, a notebook, a palmtop computer and a cloud server. A person skilled in the art may understand that the schematic diagram is only an example of the computer device 1 and does not constitute a limitation on the computer device 1, and may include more or less components than the illustration, or a combination of certain components, or different Components, for example, the computer device 1 may also include input and output devices, network access devices, buses, and the like.

The so-called processor 30 may be a central processing unit (Central Processing Unit, CPU), or other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application-specific integrated circuits (Application Specific Integrated Circuit, ASIC), Ready-made programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor 30 may also be any conventional processor, etc. The processor 30 is the control center of the computer device 1 and connects the entire computer device 1 using various interfaces and lines The various parts.

The memory 20 may be used to store the computer-readable instructions 40 and / or modules / units, and the processor 30 executes or executes the computer-readable instructions and / or modules / units stored in the memory 20, and The data stored in the memory 20 is called to realize various functions of the computer device 1. The memory 20 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, at least one function required application programs (such as sound playback function, image playback function, etc.); the storage data area may Data (such as audio data, phone book, etc.) created according to the use of the computer device 1 is stored. In addition, the memory 20 may include a high-speed random access memory, and may also include non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart, Media, Card, SMC), and a secure digital (SD) Card, flash memory card (Flash), at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage device.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and not to limit them. Although the application is described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the present application can be Make modifications or equivalent replacements without departing from the spirit and scope of the technical solutions of the present application.

Claims (20)

1. A device state prediction method, characterized in that the method includes:

   Acquiring time series data of a first monitored object and a second monitored object associated with the first monitored object, wherein each of the monitored objects includes one or more monitored categories, and each of the monitored categories includes one or more Type index, the time series data is a parameter set of each type index at different time nodes;

   Generating a plurality of trend graphs according to the time series data of the second monitored object, where each of the trend graphs corresponds to each type of indicator of the second monitored object;

   Statistically obtain the extreme point included in each trend graph of the second monitored object through a preset trend analysis algorithm;

   Judging whether the type index corresponding to the trend graph is abnormal according to each extreme point of the trend graph; and

   When the first type indicator of the second monitored object is determined to be abnormal, the state of the second type indicator of the first monitored object is predicted based on the time series data of the first type indicator, where the A second type indicator of a monitored object is associated with the first type indicator of the second monitored object.
2. The device state prediction method according to claim 1, wherein the plurality of trend graphs are generated according to time series data of the second monitored object, wherein each of the trend graphs corresponds to the second monitored object The steps for each type of indicator include:

   Classify the time series data of the second monitoring object once for each monitoring category, and then classify the time series data of each monitoring category according to each type of index for a second time;

   Establish an XY coordinate axis, and use each time node in the time series data of the first type indicator as the point of the trend graph on the X axis; and

   The parameter information corresponding to each of the time nodes is used as the Y-axis value of the trend graph to obtain a trend graph corresponding to the first-type indicator.
3. The method for predicting a device state according to claim 1 or 2, wherein the step of statistically obtaining an extreme point included in each trend graph of the second monitored object through a preset trend analysis algorithm includes:

   Randomly selecting a time node data and a previous time node data adjacent to the time node data from a trend graph of the second monitored object;

   Calculating the trend slope between the time node data and the previous time node data;

   Determine whether the calculated trend slope is greater than a preset threshold; and

   When the slope of the trend is greater than the preset threshold, it is determined that the time node data is an extreme point in the trend graph.
4. The method for predicting a device state according to claim 3, wherein the trend slope of the time node data and the previous time node data can be calculated by the following mathematical formula:

   K _m = | (V _m -V _m-1 ) / (t _m -t _m-1 ) |;

   Where K _m is the trend slope, t _m is the time node corresponding to the time node data, t _m-1 is the last time node adjacent to t _m , V _m is the parameter information corresponding to the time node t _m , V _m-1 is the parameter information corresponding to the time node t _m-1 .
5. The method for predicting a device state according to claim 1 or 2, wherein the step of judging whether the type indicator corresponding to the trend graph is abnormal according to the extreme point of each trend graph includes:

   Randomly selecting an extreme point from a trend graph of the second monitored object, and acquiring data of at least two prior time nodes adjacent to the extreme point;

   Calculate the first trend slope between the extreme point and the first time node data, and the second trend slope between the extreme point and the second time node data, where the first time node data is The last time node data near the extreme point, and the second time node data is the last time node data close to the first time node data;

   Calculating the standard deviation and mean slope of the first trend slope and the second trend slope;

   Calculate the comprehensive trend slope of the extreme point according to the calculated standard deviation and the mean slope;

   Judging whether the slope of the comprehensive trend of the extreme point is within a preset range value; and

   When the slope of the comprehensive trend of the extreme point is not within the preset range value, it is determined that the type indicator corresponding to the trend graph is abnormal.
6. The method for predicting the equipment state according to claim 5, wherein the slope of the comprehensive trend of the extreme point can be calculated by the following mathematical formula:

   K = (K _{m, m-1} -O _m ) / K _{m, sd} * K _{m, m-1} + (K _{m, m-2} -O _m ) / K _{m, sd} * K _{m, m-2} ;

   Where K is the slope of the comprehensive trend, K _{m, m-1} is the slope of the first trend, K _{m, m-2} is the slope of the second trend, and O _m is the slope of the first trend and the The mean slope of the second trend slope, K _{m, sd} is the standard deviation of the first trend slope and the second trend slope.
7. The device state prediction method according to claim 5, wherein the step of predicting the state of the second type indicator of the first monitored object based on the time series data of the first type indicator includes:

   Obtain all comprehensive trend slopes included in the first type indicator that are not within the preset range value;

   Calculating the average comprehensive trend slope of the comprehensive trend slopes that are not within the preset range value;

   Calculating the next time node data of the second type indicator according to the average comprehensive trend slope and the current time node data of the second type indicator; and

   The state of the second type indicator at the next time is obtained according to the next time node data of the second type indicator.
8. An equipment state prediction system, characterized in that the system includes:

   An obtaining module, configured to obtain time series data of a first monitored object and a second monitored object associated with the first monitored object, wherein each of the monitored objects includes one or more monitored categories, and each of the monitored categories Including one or more types of indicators, and the time series data is a parameter set of each of the types of indicators at different time nodes;

   A generating module, configured to generate a plurality of trend graphs according to the time series data of the second monitored object, wherein each of the trend graphs corresponds to each type of indicator of the second monitored object;

   A statistics module, configured to obtain the extreme point included in each trend graph of the second monitoring object through a statistical analysis of a preset trend analysis algorithm;

   A judging module, used to judge whether the type index corresponding to the trend graph is abnormal according to each extreme point of the trend graph; and

   A prediction module, configured to predict the state of the second type indicator of the first monitored object according to the time series data of the first type indicator when the first type indicator of the second monitored object is determined to be abnormal;

   Wherein, the second type index of the first monitored object is associated with the first type index of the second monitored object.
9. A computer device includes a processor and a memory, and a plurality of computer-readable instructions are stored on the memory, wherein the processor is used to execute the following steps when executing the computer-readable instructions stored in the memory:

   Acquiring time series data of a first monitored object and a second monitored object associated with the first monitored object, wherein each of the monitored objects includes one or more monitored categories, and each of the monitored categories includes one or more Type index, the time series data is a parameter set of each type index at different time nodes;

   Generating a plurality of trend graphs according to the time series data of the second monitored object, where each of the trend graphs corresponds to each type of indicator of the second monitored object;

   Statistically obtain the extreme point included in each trend graph of the second monitored object through a preset trend analysis algorithm;

   Judging whether the type index corresponding to the trend graph is abnormal according to each extreme point of the trend graph; and

   When the first type indicator of the second monitored object is determined to be abnormal, the state of the second type indicator of the first monitored object is predicted based on the time series data of the first type indicator, where the A second type indicator of a monitored object is associated with the first type indicator of the second monitored object.
10. The computer device according to claim 9, wherein the processor generates a plurality of trend graphs according to the time series data of the second monitored object, wherein each of the trend graphs corresponds to the second monitored For each type of indicator of the object, the computer-readable instructions are executed to achieve the following steps:

    Classify the time series data of the second monitoring object once for each monitoring category, and then classify the time series data of each monitoring category according to each type of index for a second time;

    Establish an XY coordinate axis, and use each time node in the time series data of the first type indicator as the point of the trend graph on the X axis; and

    The parameter information corresponding to each of the time nodes is used as the Y-axis value of the trend graph to obtain a trend graph corresponding to the first-type indicator.
11. The computer device according to claim 9 or 10, characterized in that when the processor statistically obtains the extreme point included in each trend graph of the second monitored object through a preset trend analysis algorithm, the execution The computer readable instructions to implement the following steps:

    Randomly selecting a time node data and a previous time node data adjacent to the time node data from a trend graph of the second monitored object;

    Calculating the trend slope between the time node data and the previous time node data;

    Determine whether the calculated trend slope is greater than a preset threshold; and

    When the slope of the trend is greater than the preset threshold, it is determined that the time node data is an extreme point in the trend graph.
12. The computer device according to claim 9 or 10, wherein when the processor determines whether the type indicator corresponding to the trend graph is abnormal according to each extreme point of the trend graph, the processor executes the Computer readable instructions to achieve the following steps:

    Randomly selecting an extreme point from a trend graph of the second monitored object, and acquiring data of at least two prior time nodes adjacent to the extreme point;

    Calculate the first trend slope between the extreme point and the first time node data, and the second trend slope between the extreme point and the second time node data, where the first time node data is The last time node data near the extreme point, and the second time node data is the last time node data close to the first time node data;

    Calculating the standard deviation and mean slope of the first trend slope and the second trend slope;

    Calculate the comprehensive trend slope of the extreme point according to the calculated standard deviation and the mean slope;

    Judging whether the slope of the comprehensive trend of the extreme point is within a preset range value; and

    When the slope of the comprehensive trend of the extreme point is not within the preset range value, it is determined that the type indicator corresponding to the trend graph is abnormal.
13. The computer device according to claim 12, wherein the slope of the comprehensive trend of the extreme point can be calculated by the following mathematical formula:

    K = (K _{m, m-1} -O _m ) / K _{m, sd} * K _{m, m-1} + (K _{m, m-2} -O _m ) / K _{m, sd} * K _{m, m-2} ;

    Where K is the slope of the comprehensive trend, K _{m, m-1} is the slope of the first trend, K _{m, m-2} is the slope of the second trend, and O _m is the slope of the first trend and the The mean slope of the second trend slope, K _{m, sd} is the standard deviation of the first trend slope and the second trend slope.
14. The computer device according to claim 12, wherein the computer executes the computer when the processor predicts the state of the second type indicator of the first monitored object based on the time series data of the first type indicator Readable instructions to achieve the following steps:

    Obtain all comprehensive trend slopes included in the first type indicator that are not within the preset range value;

    Calculating the average comprehensive trend slope of the comprehensive trend slopes that are not within the preset range value;

    Calculating the next time node data of the second type indicator according to the average comprehensive trend slope and the current time node data of the second type indicator; and

    The state of the second type indicator at the next time is obtained according to the next time node data of the second type indicator.
15. A non-volatile readable storage medium on which computer-readable instructions are stored, characterized in that when the computer-readable instructions are executed by a processor, the following steps are realized:

    Acquiring time series data of a first monitored object and a second monitored object associated with the first monitored object, wherein each of the monitored objects includes one or more monitored categories, and each of the monitored categories includes one or more Type index, the time series data is a parameter set of each type index at different time nodes;

    Generating a plurality of trend graphs according to the time series data of the second monitored object, where each of the trend graphs corresponds to each type of indicator of the second monitored object;

    Statistically obtain the extreme point included in each trend graph of the second monitored object through a preset trend analysis algorithm;

    Judging whether the type index corresponding to the trend graph is abnormal according to each extreme point of the trend graph; and

    When the first type indicator of the second monitored object is determined to be abnormal, the state of the second type indicator of the first monitored object is predicted based on the time series data of the first type indicator, where the A second type indicator of a monitored object is associated with the first type indicator of the second monitored object.
16. The storage medium according to claim 15, wherein a plurality of trend graphs are generated according to the time-series data of the second monitored object, wherein each of the trend graphs corresponds to the second monitored object's For each type of indicator, the computer-readable instructions are executed by the processor to achieve the following steps:

    Classify the time series data of the second monitoring object once for each monitoring category, and then classify the time series data of each monitoring category according to each type of index for a second time;

    Establish an XY coordinate axis, and use each time node in the time series data of the first type indicator as the point of the trend graph on the X axis; and

    The parameter information corresponding to each of the time nodes is used as the Y-axis value of the trend graph to obtain a trend graph corresponding to the first-type indicator.
17. The storage medium according to claim 15 or 16, wherein when the extreme point included in each trend graph of the second monitored object is statistically obtained through a preset trend analysis algorithm, the computer The readable instructions are executed by the processor to achieve the following steps:

    Randomly selecting a time node data and a previous time node data adjacent to the time node data from a trend graph of the second monitored object;

    Calculating the trend slope between the time node data and the previous time node data;

    Determine whether the calculated trend slope is greater than a preset threshold; and

    When the slope of the trend is greater than the preset threshold, it is determined that the time node data is an extreme point in the trend graph.
18. The storage medium according to claim 15 or 16, wherein the computer readable when the type indicator corresponding to the trend graph is abnormal according to the extreme point of each of the trend graphs The instructions are executed by the processor to achieve the following steps:

    Randomly selecting an extreme point from a trend graph of the second monitored object, and acquiring data of at least two prior time nodes adjacent to the extreme point;

    Calculate the first trend slope between the extreme point and the first time node data, and the second trend slope between the extreme point and the second time node data, where the first time node data is The last time node data near the extreme point, and the second time node data is the last time node data close to the first time node data;

    Calculating the standard deviation and mean slope of the first trend slope and the second trend slope;

    Calculate the comprehensive trend slope of the extreme point according to the calculated standard deviation and the mean slope;

    Judging whether the slope of the comprehensive trend of the extreme point is within a preset range value; and

    When the slope of the comprehensive trend of the extreme point is not within the preset range value, it is determined that the type indicator corresponding to the trend graph is abnormal.
19. The storage medium according to claim 18, wherein the slope of the comprehensive trend of the extreme point can be calculated by the following mathematical formula:

    K = (K _{m, m-1} -O _m ) / K _{m, sd} * K _{m, m-1} + (K _{m, m-2} -O _m ) / K _{m, sd} * K _{m, m-2} ;

    Where K is the slope of the comprehensive trend, K _{m, m-1} is the slope of the first trend, K _{m, m-2} is the slope of the second trend, and O _m is the slope of the first trend and the The mean slope of the second trend slope, K _{m, sd} is the standard deviation of the first trend slope and the second trend slope.
20. The storage medium according to claim 18, wherein the computer readable instructions when the state of the second type indicator of the first monitored object is predicted based on the time series data of the first type indicator It is executed by the processor to achieve the following steps:

    Obtain all comprehensive trend slopes included in the first type indicator that are not within the preset range value;

    Calculating the average comprehensive trend slope of the comprehensive trend slopes that are not within the preset range value;

    Calculating the next time node data of the second type indicator according to the average comprehensive trend slope and the current time node data of the second type indicator; and

    The state of the second type indicator at the next time is obtained according to the next time node data of the second type indicator.

Images