System monitoring method and apparatus

Patent metadata

Field	Value
Publication number	US-10248528-B2
Application number	US-201615280825-A
Country	US
Kind code	B2
Filing date	Sep 29, 2016
Priority date	Jun 28, 2016
Publication date	Apr 2, 2019
Grant date	Apr 2, 2019

Abstract

A system monitoring method and apparatus comprises: collecting periodically status indicator data of a monitored system to generate a status indicator data sequence; selecting predetermined pieces of status indicator data according to data collecting time in a reverse chronological order; determining a category from predetermined categories, the predetermined pieces of status indicator data belonging to the determined category; selecting, from the historical status indicator data, status indicator data belonging to the determined category and obtained in a collection period as characteristic data of the determined category; calculating a predicted value of a status indicator of the system at a predicting moment using the characteristic data; and determining whether the system is abnormal, based on a difference between the calculated predicted value and a true value of the status indicator of the system collected at the predicting moment. The present implementation can accurately find the abnormality of the system rapidly.

First claim

What is claimed is:

1. A system monitoring method, comprising:
collecting periodically status indicator data of a system being monitored to generate a status indicator data sequence;
selecting, from the status indicator data sequence, predetermined pieces of status indicator data according to data collecting time in a reverse chronological order;
determining a category from predetermined categories, the predetermined pieces of status indicator data belonging to the determined category, the predetermined categories obtained by performing clustering analysis on historical status indicator data;
selecting, from the historical status indicator data, status indicator data belonging to the determined category and obtained in a collection period as characteristic data of the determined category;
calculating a predicted value of a status indicator of the system at a predicting moment using the characteristic data, comprising
replacing suspected abnormal data with the characteristic data obtained at a data collecting moment and corresponding to the suspected abnormal data to calculate the predicted value, when the number of the suspected abnormal data in the predetermined pieces of status indicator data is no more than half of the number of the predetermined pieces;
wherein the suspected abnormal data are the status indicator data satisfying the condition that a ratio of the true value of the status indicator data to the predicted value of the status indicator data is less than a preset first threshold or greater than a preset second threshold; and

determining whether the system is abnormal, based on a difference between the calculated predicted value and a true value of the status indicator of the system collected at the predicting moment.

2. The system monitoring method according to claim 1 , wherein the performing clustering analysis on historical status indicator data comprises:
normalizing the historical status indicator data;
calculating a histogram of the normalized historical status indicator data;
calculating a cumulative distribution function of the histogram;
clustering the cumulative distribution function by using a kmeans clustering method; and
determining a classifying rule according to clustering results.

3. The system monitoring method according to claim 1 , wherein the selecting, from the historical status indicator data, status indicator data belonging to the determined category and in a collection period as characteristic data of the determined category comprises:
calculating an average value of the status indicator data of the determined category at the same moment in different periods as the characteristic data of the determined category.

4. The system monitoring method according to claim 1 , wherein the determining whether the system is abnormal, based on a difference between the calculated predicted value and a true value of the status indicator of the system collected at the predicting moment comprises:
determining that the system is abnormal when a ratio of the true value to the predicted value is less than a preset third threshold or greater than a preset fourth threshold, wherein the third threshold is less than the first threshold and the fourth threshold is less than the second threshold.

5. A system monitoring apparatus, comprising:
at least one processor; and
a memory storing instructions, which when executed by the at least one processor, cause the at least one processor to perform operations, the operations comprising:
collecting periodically status indicator data of a system being monitored to generate a status indicator data sequence;
selecting, from the status indicator data sequence, predetermined pieces of status indicator data according to data collecting time in a reverse chronological order;
determining a category from predetermined categories, the predetermined pieces of status indicator data belonging to the determined category, the predetermined categories obtained by performing clustering analysis on historical status indicator data;
selecting, from the historical status indicator data, status indicator data belonging to the determined category and obtained in a collection period as characteristic data of the determined category;
calculating a predicted value of a status indicator of the system at a predicting moment using the characteristic data, comprising
replacing suspected abnormal data with the characteristic data obtained at a data collecting moment and corresponding to the suspected abnormal data to calculate the predicted value, when the number of the suspected abnormal data in the predetermined pieces of status indicator data is no more than half of the number of the predetermined pieces;
wherein the suspected abnormal data are the status indicator data satisfying the condition that a ratio of the true value of the status indicator data to the predicted value of the status indicator data is less than a preset first threshold or greater than a preset second threshold; and

determining whether the system is abnormal, based on a difference between the calculated predicted value of the status indicator of the system at the predicting moment and a true value of the status indicator of the system collected at the predicting moment.

6. The system monitoring apparatus according to claim 5 , wherein the performing clustering analysis on historical status indicator data comprises:
normalizing the historical status indicator data;
calculating a histogram of the normalized historical status indicator data;
calculating a cumulative distribution function of the histogram;
clustering the cumulative distribution function by using a kmeans clustering method; and
determining a classifying rule according to clustering results.

7. The system monitoring apparatus according to claim 5 , wherein the selecting, from the historical status indicator data, status indicator data belonging to the determined category and in a collection period as characteristic data of the determined category comprises:
calculating an average value of the status indicator data of the determined category at the same moment in different periods as the characteristic data of the determined category.

8. The system monitoring apparatus according to claim 5 , wherein the determining whether the system is abnormal, based on a difference between the calculated predicted value and a true value of the status indicator of the system collected at the predicting moment comprises:
determining that the system is abnormal when a ratio of the true value to the predicted value is less than a preset third threshold or greater than a preset fourth threshold, wherein the third threshold is less than the first threshold and the fourth threshold is less than the second threshold.

9. A non-transitory storage medium storing one or more programs, the one or more programs when executed by an apparatus, causing the apparatus to perform a system monitoring method, comprising:
collecting periodically status indicator data of a system being monitored to generate a status indicator data sequence;
selecting, from the status indicator data sequence, predetermined pieces of status indicator data according to data collecting time in a reverse chronological order;
determining a category from predetermined categories, the predetermined pieces of status indicator data belonging to the determined category, the predetermined categories obtained by performing clustering analysis on historical status indicator data;
selecting, from the historical status indicator data, status indicator data belonging to the determined category and obtained in a collection period as characteristic data of the determined category;
calculating a predicte

Assignees

• Beijing Baidu Netcom Science And Tech Ltd
• Beijing Baidu Netcom Sci & Tec

Inventors

• Wang Dong
• Wang Bo
• Miao Beibei
• Chen Yun
• Guo Xuanyou
• Qu Xianping

Classifications

• G06F11/3495

  for systems · CPC title

• G06F11/3006 Primary

  where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50) · CPC title

• G06F11/0721

  within a central processing unit [CPU] · CPC title

• G06F11/3055 Primary

  Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available (error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction of the data by redundancy in operations G06F11/14; error detection or correction by redundancy in hardware G06F11/16) · CPC title

• G06F11/3051

  Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs (verification or detection of system hardware configuration G06F11/2247) · CPC title