Disclosure of Invention
The technical scheme adopted by the invention is as follows:
a method for monitoring the abnormity of an SAAS platform in real time comprises the following steps:
according to the type of the SAAS platform abnormal log, carrying out data recording on the SAAS platform to obtain the SAAS platform abnormal log, and monitoring the abnormity by analyzing the abnormal log or dynamically monitoring the real-time use condition of the JVM by using a JVM plug-in;
the plug-in may be jvisualvm, and the abnormal condition of the SAAS platform is monitored in real time according to the use conditions of the memory, the hard disk and the like monitored by the JVM plug-in, specifically: configuring jvirusalvm in PATH environment variables, starting a jvirusalvm local process, entering a monitoring mode for monitoring the jvirusalvm or adding a connection port of the jvirusalvm in JVM starting parameters, starting a response port in a Server section, configuring authentication information in a configuration file, starting a monitoring panel of the jvirusalvm, and identifying conditions such as process ID, category information, CPU utilization rate, heap information, loader information, thread number and the like.
Specifically, the CPU occupied time can be positioned to the method by utilizing a CPU sampler in jvisualvm. It can be seen what the method currently occupies more CPU and how the thread occupies CPU time. The memory sampler can be used for seeing the occupation condition of the heap object of the current thread and the situation of the independent occupation of each thread.
And sending the abnormal detection result according to a predefined sending mode.
As a further improvement of the method for monitoring the SAAS platform anomaly in real time, the SAAS platform anomaly log includes a program anomaly log, and when the SAAS platform anomaly log to be recorded is the program anomaly log, the method performs data recording on the SAAS platform according to the type of the SAAS platform anomaly log to obtain the SAAS platform anomaly log, and the step specifically includes:
and recording the system abnormal log through an abnormal log recording tool according to a predefined output specification to obtain a program abnormal log or automatically outputting an abnormal monitoring file through a JVM abnormal monitoring plug-in.
As a further improvement of the real-time monitoring method for the SAAS platform anomaly, the SAAS platform anomaly log includes a system anomaly log, and when the SAAS platform anomaly log to be recorded is the system anomaly log, the data recording is performed on the SAAS platform according to the type of the SAAS platform anomaly log to obtain the SAAS platform anomaly log, and the step specifically includes:
and recording the system abnormal log by adopting a corresponding script through an abnormal log recording tool to obtain the system abnormal log.
As a further improvement of the method for monitoring the SAAS platform anomaly in real time, the SAAS platform anomaly log includes an SAAS application anomaly log, and when the SAAS platform anomaly log to be recorded is the SAAS application anomaly log, the data recording is performed on the SAAS platform according to the type of the SAAS platform anomaly log to obtain the SAAS platform anomaly log, and the step specifically includes:
and outputting the SAAS application abnormal log to an abnormal log recording tool by adopting the script with the corresponding format to obtain the SAAS application abnormal log.
As a further improvement of the real-time monitoring method for the SAAS platform anomaly, the step of performing anomaly detection on the SAAS platform anomaly log to obtain an anomaly detection result specifically includes:
acquiring corresponding early warning conditions according to the SAAS platform abnormal logs;
judging whether the SAAS platform abnormal log meets an early warning condition, if so, judging that the abnormal detection result is abnormal; otherwise, the abnormal detection result is normal operation.
The method for judging whether the SAAS platform abnormal log meets the early warning condition comprises the following steps:
step1, presetting an abnormal entity set X and a weight set W (X), wherein X is an element in the set X, i.e. X is an abnormal entity, and w (X) is an element in the set W (X), i.e. w (X) is the weight of X;
step2, acquiring an abnormal log within a threshold T of a past period of time;
step3, identifying abnormal entities in the abnormal logs within the past time threshold T by using a named entity identification algorithm;
step4, counting the occurrence frequency of different abnormal entities in a past period T;
step5, obtaining entropy weights e (x) of different abnormal entities by using an entropy weight method according to the result obtained in Step 4;
step6, obtaining early warning weights m (x) = w (x) e (x) of different abnormal entities according to the results of Step1 and Step 5;
step7, normalizing the early warning weights of the different abnormal entities to obtain normalized early warning weights g (x) of the different entities;
step8, setting an early warning weight threshold tw and an early warning weight number threshold tc, if the number of abnormal entities corresponding to g (x) > tw exceeds tc, meeting an early warning condition, otherwise not meeting the early warning condition;
as a further improvement of the SAAS platform abnormity real-time monitoring method, the sending mode comprises short messages, mails, enterprise WeChat push and flybook push.
The other technical scheme adopted by the invention is as follows:
an abnormal real-time monitoring device for an SAAS platform comprises:
the data recording unit is used for carrying out data recording on the SAAS platform according to the type of the SAAS platform abnormal log to obtain the SAAS platform abnormal log;
the anomaly detection unit is used for carrying out anomaly detection on the SAAS platform anomaly log to obtain an anomaly detection result;
and the sending unit is used for sending the abnormity detection result according to a predefined sending mode.
As a further improvement of the apparatus for monitoring the SAAS platform anomaly in real time, the anomaly detection unit includes:
the condition acquisition unit is used for acquiring corresponding early warning conditions according to the SAAS platform abnormal logs;
the judging unit is used for judging whether the SAAS platform abnormal log meets the early warning condition or not, and if so, the abnormal detection result is abnormal; otherwise, the abnormal detection result is normal operation.
The method for judging whether the SAAS platform abnormal log meets the early warning condition comprises the following steps:
step1, presetting an abnormal entity set X and a weight set W (X), wherein X is an element in the set X, i.e. X is an abnormal entity, and w (X) is an element in the set W (X), i.e. w (X) is the weight of X;
step2, acquiring an abnormal log within a threshold T of a past period of time;
step3, identifying abnormal entities in the abnormal logs within the past time threshold T by using a named entity identification algorithm;
step4, counting the occurrence frequency of different abnormal entities in a past period T;
step5, obtaining entropy weights e (x) of different abnormal entities by using an entropy weight method according to the result obtained in Step 4;
step6, obtaining early warning weights m (x) = w (x) e (x) of different abnormal entities according to the results of Step1 and Step 5;
step7, normalizing the early warning weights of the different abnormal entities to obtain normalized early warning weights g (x) of the different entities;
step8, setting an early warning weight threshold tw and an early warning weight number threshold tc, if the number of abnormal entities corresponding to g (x) > tw exceeds tc, meeting an early warning condition, otherwise, not meeting the early warning condition.
Detailed Description
The following further describes embodiments of the present invention with reference to the accompanying drawings:
referring to fig. 1, the present embodiment provides a method for monitoring an abnormal condition of an SAAS platform in real time, including the following steps:
s1, according to the type of the SAAS platform abnormal log, carrying out data recording on the SAAS platform to obtain the SAAS platform abnormal log;
in this embodiment, the SAAS platform exception log specifically includes a program exception log, a system exception log, and an SAAS application exception log, and when data is recorded, the SAAS platform exception log needs to be recorded in a corresponding data recording manner according to different types of the SAAS platform exception logs.
S2, carrying out anomaly detection on the SAAS platform anomaly log to obtain an anomaly detection result;
in the embodiment, early warning conditions for different types of SAAS platform abnormal logs are preset, when the SAAS platform abnormal logs reach the early warning conditions, the SAAS platform reaches a risk control level and belongs to an abnormal condition, and an abnormal detection result is abnormal; if the SAAS platform abnormal log does not reach the early warning condition, the SAAS platform is indicated to be in normal operation, and the abnormal detection result is normal operation at the moment.
And S3, transmitting the abnormal detection result according to the predefined transmission mode.
The sending modes in the embodiment include short messages, mails, enterprise WeChat pushing, flybook pushing and the like, and after the abnormal detection result is obtained, the abnormal detection result can be sent to corresponding personnel through the predefined sending mode, so that the personnel can timely acquire the abnormal condition, and follow-up targeted processing measures can be conveniently made.
Further, as a preferred embodiment, the SAAS platform exception log in this embodiment includes a program exception log, and when the SAAS platform exception log to be recorded is the program exception log, the data recording is performed on the SAAS platform according to the type of the SAAS platform exception log to obtain the SAAS platform exception log, where the step is specifically:
and recording the system abnormal log through an abnormal log recording tool according to a predefined output specification to obtain a program abnormal log.
Further, as a preferred embodiment, the SAAS platform exception log in this embodiment includes a system exception log, and when the SAAS platform exception log to be recorded is the system exception log, the data recording is performed on the SAAS platform according to the type of the SAAS platform exception log to obtain the SAAS platform exception log, where the step is specifically:
and recording the system abnormal log by adopting a corresponding script through an abnormal log recording tool to obtain the system abnormal log.
Further, as a preferred embodiment, the SAAS platform exception log in this embodiment includes an SAAS application exception log, and when the SAAS platform exception log to be recorded is the SAAS application exception log, the data recording is performed on the SAAS platform according to the type of the SAAS platform exception log to obtain the SAAS platform exception log, where the step is specifically:
and outputting the SAAS application abnormal log to an abnormal log recording tool by adopting the script with the corresponding format to obtain the SAAS application abnormal log.
Further as a preferred embodiment, the performing abnormality detection on the SAAS platform abnormality log to obtain an abnormality detection result in this embodiment specifically includes:
s21, acquiring corresponding early warning conditions according to the SAAS platform abnormal logs;
s22, judging whether the SAAS platform abnormal log meets the early warning condition, if so, judging that the abnormal detection result is abnormal; otherwise, the abnormal detection result is normal operation;
the method for judging whether the SAAS platform abnormal log meets the early warning condition comprises the following steps:
step1, presetting an abnormal entity set X and a weight set W (X), wherein X is an element in the set X, i.e. X is an abnormal entity, and w (X) is an element in the set W (X), i.e. w (X) is the weight of X;
step2, acquiring an abnormal log within a threshold T of a past period of time;
step3, identifying abnormal entities in the abnormal logs within the past time threshold T by using a named entity identification algorithm;
step4, counting the occurrence frequency of different abnormal entities in a past period T;
step5, obtaining entropy weights e (x) of different abnormal entities by using an entropy weight method according to the result obtained in Step 4;
step6, obtaining early warning weights m (x) = w (x) e (x) of different abnormal entities according to the results of Step1 and Step 5;
step7, normalizing the early warning weights of the different abnormal entities to obtain normalized early warning weights g (x) of the different entities;
step8, setting an early warning weight threshold tw and an early warning weight number threshold tc, if the number of abnormal entities corresponding to g (x) > tw exceeds tc, meeting an early warning condition, otherwise not meeting the early warning condition;
in this embodiment, the set early warning conditions are different for different types of SAAS platform abnormal logs, and when the time in the SAAS platform abnormal log is detected to reach the early warning conditions, an abnormal detection result is obtained as abnormal, and a subsequent notification is sent.
The embodiment provides an abnormal real-time monitoring device for an SAAS platform, which includes:
the data recording unit is used for carrying out data recording on the SAAS platform according to the type of the SAAS platform abnormal log to obtain the SAAS platform abnormal log;
the anomaly detection unit is used for carrying out anomaly detection on the SAAS platform anomaly log to obtain an anomaly detection result;
and the sending unit is used for sending the abnormity detection result according to a predefined sending mode.
The contents in the above method embodiments are all applicable to the present system embodiment, the functions specifically implemented by the present system embodiment are the same as those in the above method embodiment, and the beneficial effects achieved by the present system embodiment are also the same as those achieved by the above method embodiment.
Further preferably, the abnormality detection unit includes:
the condition acquisition unit is used for acquiring corresponding early warning conditions according to the SAAS platform abnormal logs;
the judging unit is used for judging whether the SAAS platform abnormal log meets the early warning condition or not, and if so, the abnormal detection result is abnormal; otherwise, the abnormal detection result is normal operation;
the method for judging whether the SAAS platform abnormal log meets the early warning condition comprises the following steps:
step1, presetting an abnormal entity set X and a weight set W (X), wherein X is an element in the set X, i.e. X is an abnormal entity, and w (X) is an element in the set W (X), i.e. w (X) is the weight of X;
step2, acquiring an abnormal log within a threshold T of a past period of time;
step3, identifying abnormal entities in the abnormal logs within the past time threshold T by using a named entity identification algorithm;
step4, counting the occurrence frequency of different abnormal entities in a past period T;
step5, obtaining entropy weights e (x) of different abnormal entities by using an entropy weight method according to the result obtained in Step 4;
step6, obtaining early warning weights m (x) = w (x) e (x) of different abnormal entities according to the results of Step1 and Step 5;
step7, normalizing the early warning weights of the different abnormal entities to obtain normalized early warning weights g (x) of the different entities;
step8, setting an early warning weight threshold tw and an early warning weight number threshold tc, if the number of abnormal entities corresponding to g (x) > tw exceeds tc, meeting an early warning condition, otherwise, not meeting the early warning condition.
The embodiment further provides an apparatus for monitoring an abnormal condition of an SAAS platform in real time, which specifically includes:
a memory for storing a program;
and the processor is used for executing the program, and the program enables the processor to execute the SAAS platform abnormity real-time monitoring method.
The contents in the above method embodiments are all applicable to the present apparatus embodiment, the functions specifically implemented by the present apparatus embodiment are the same as those in the above method embodiments, and the advantageous effects achieved by the present apparatus embodiment are also the same as those achieved by the above method embodiments.
The present embodiment also provides a computer-readable storage medium, which includes a computer program, when running on a computer, for causing the method for monitoring SAAS platform anomalies in real time to be performed.
The contents in the above method embodiments are all applicable to the present storage medium embodiment, the functions specifically implemented by the present storage medium embodiment are the same as those in the above method embodiments, and the advantageous effects achieved by the present storage medium embodiment are also the same as those achieved by the above method embodiments.
From the above, the method and the device for monitoring the SAAS platform abnormity in real time provided by the invention can rapidly detect the abnormity condition of the SAAS platform and send out a notification through analyzing the SAAS platform abnormity log, so that a developer can timely acquire the abnormity condition and conveniently make subsequent targeted processing measures.
While the invention has been described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention.