CN112699007B - Method, system, network device and storage medium for monitoring machine performance - Google Patents

Abstract

The embodiment of the invention relates to the technical field of computers, and discloses a method, a system, network equipment and a storage medium for monitoring machine performance. The method comprises the following steps: acquiring respective resource operation data of at least two monitored machines in a preset period, wherein the resource operation data comprises alarms generated when each resource block in the machine operates and alarm detection information corresponding to the alarms, and acquiring tag information of each alarm in the resource operation data, wherein the tag information is used for indicating the category of the alarms; acquiring alarms belonging to abnormal categories from the resource operation data as abnormal alarms according to the label information of each alarm; determining analysis data of each abnormal category according to alarm detection information corresponding to the abnormal alarm and the abnormal alarm; and visualizing the acquired abnormal alarm and/or analysis data according to the received display instruction. By adopting the implementation mode, the performance fault can be positioned in time, and the positioning performance fault can be eliminated conveniently and quickly.

Description

Method, system, network device and storage medium for monitoring machine performance

Technical Field

Embodiments of the present invention relate to the field of computer technology, and in particular to a method, system, network device and storage medium for monitoring machine performance.

Background Art

Enterprises have a large number of machines. If performance problems cannot be located and solved in time, they will continue to exist and affect the operation of the machine. Therefore, it is necessary to monitor machine performance. Machine performance includes problems at the machine software level and hardware problems. From the software level, CPU, memory, disk IO, and load are important indicators that affect machine performance. Therefore, current software performance monitoring usually collects indicator data information at the machine software level and analyzes the machine performance based on the collected indicator data information.

However, the current performance analysis of machines is very simple and is not conducive to timely locating and resolving problems. For example, machine performance monitoring usually extracts and outputs information such as CPU high performance and CPU single-core high performance; however, the collected indicator data information is not analyzed in detail, resulting in the inability of staff/electronic equipment to eliminate performance problems in a timely manner through the output information.

Summary of the invention

The purpose of the embodiments of the present invention is to provide a method, system, network device and storage medium for monitoring machine performance, so that performance faults can be located in a timely manner, performance faults can be quickly eliminated, and the impact time of faulty network devices can be reduced.

To solve the above technical problems, an embodiment of the present invention provides a method for monitoring machine performance, comprising: obtaining resource operation data of each of at least two monitored machines within a preset period, the resource operation data including alarms generated when each resource block in the machine is running and alarm detection information corresponding to the alarm, the alarm detection information including any combination of the following information: information on the duration of the alarm, information on the number of times the alarm lasts, and traffic information when the alarm is triggered; obtaining label information of each alarm in the resource operation data, the label information is used to indicate the category to which the alarm belongs, and is obtained by each of the machines according to the category labeling of the alarm; according to the label information of each of the alarms, obtaining the alarm belonging to the abnormal category from the resource operation data as an abnormal alarm; according to the alarm detection information corresponding to the abnormal alarm and the abnormal alarm, determining the analysis data of each abnormal category, the analysis data including: information on the machine where the abnormal alarm of the abnormal category is located; according to the received display instruction, visualizing the acquired abnormal alarm and/or the analysis data.

An embodiment of the present invention also provides a method for monitoring machine performance, including: obtaining resource data generated when each resource block in the machine is running, the resource data including alarms; according to the analysis strategy corresponding to each resource block, obtaining alarm detection information of the alarm in each resource block and adding label information to the alarm in each resource data, the label information is used to indicate the alarm category to which the alarm belongs; according to the alarm detection information and the resource data, determining the resource operation data of the machine for the monitoring platform to execute the method for monitoring machine performance.

An embodiment of the present invention further provides a system for monitoring machine performance, including: a monitoring platform for the above method, and a machine for executing the above method for monitoring machine performance.

The method for monitoring machine performance in the embodiment of the present application obtains the operation data of each resource to be analyzed within a preset period, so that the obtained resource operation data can reflect the alarm of the monitored machine during operation within a time period and the alarm detection information corresponding to the alarm, and can continuously reproduce the same abnormal problem within the time period, which is convenient for the subsequent accurate positioning of the same problem; and the alarm detection information includes any combination of the following information: information on the duration of the alarm, information on the number of times the alarm lasts, and traffic information when the alarm is triggered, so as to mine alarms that have been in a poor state for a long time, so that the alarm detection information can reflect the impact of the alarm on the machine, and then facilitate the subsequent statistics and analysis of the alarm; because the resource operation data not only includes the alarm but also includes the alarm detection information corresponding to the alarm, it is convenient for the monitoring platform to perform fault analysis; according to the alarm detection information of the abnormal alarm and the abnormal alarm, the analysis data is determined, and It is not just a unilateral acquisition of alarm data, but also a display combining analysis data and abnormal alarms, which is helpful for staff to locate abnormal alarms. Due to the monitoring of a large number of machines, including the resource operation data of multiple machines, each alarm has corresponding label information, which indicates the category of the alarm. Based on the label information, alarms belonging to the same abnormal category can be filtered out, so that the monitoring platform can obtain abnormal alarms of each abnormal category from multiple monitored machines according to the label information of the alarm. Since the abnormal alarm of a single machine is not obtained, it is beneficial for subsequent staff to locate the accurate cause of the abnormality according to the information of the machine where the abnormal alarm is located, and the category of each abnormal alarm can be obtained through the label information of the abnormal alarm, without the need for re-classification, reducing the time for abnormal alarm classification, and facilitating timely positioning of the abnormal position according to the category of the abnormal alarm, reducing the duration of the abnormal alarm.

In addition, according to the label information of each alarm, alarms belonging to the abnormal category are obtained from the resource operation data as abnormal alarms, including: if the label information is used to indicate that the alarm belongs to the traffic alarm category, then an alarm that the cumulative value of the number of connections per minute exceeds the connection number threshold is obtained as the abnormal alarm, or, the alarm that the inflow flow per minute exceeds the inflow flow threshold is obtained as the abnormal alarm, or, the alarm that the outflow flow per minute exceeds the outflow threshold is obtained as the abnormal alarm; if the label information is used to indicate that the alarm belongs to the hardware alarm category, then the alarm corresponding to the label information is used as the abnormal alarm; if the alarm label is used to indicate that the alarm belongs to the processor running high category, then the alarm that the number of running high times exceeds the running high threshold in the current cycle is obtained as the abnormal alarm; if the alarm label includes an indication that the alarm belongs to the process running high category, then the alarm that the number of process running high times exceeds the process running high threshold in the current cycle is obtained as the abnormal alarm. By processing the alarms corresponding to different tag information, you can quickly filter out data that is useful for alarm analysis, delete alarms that are less related to abnormal alarms, and reduce the amount of data for subsequent analysis.

In addition, according to the alarm detection information and abnormal alarm corresponding to the abnormal alarm, the analysis data related to each abnormal category is determined, including: according to each alarm detection information and abnormal alarm, the duration of the abnormal alarm in each abnormal category, the location information of the machine where the abnormal alarm is located, and the type distribution information of the machine where the abnormal alarm is located; or, according to each alarm detection information and abnormal alarm, the process that meets the preset analysis conditions is obtained as the key process, and the duration of the abnormal alarm in the key process, the type of the machine where each abnormal alarm is located, and the location information of the machine where the abnormal alarm is located; or, according to each alarm detection information and abnormal alarm, the number of machines in each specified time period within the cycle, and the information indicating the proportion of the number of machines to the total number of monitored machines are counted; or, according to each alarm detection information and abnormal alarm, the machine type distributed in each abnormal category, the kernel version information of the machine distributed in the abnormal category, the product line information of the abnormal category, or the abnormal process are counted; or, according to each alarm detection information and abnormal alarm, according to the statistical abnormal alarm, the information of the K worst-performing machines is obtained, where K is an integer greater than 1. According to the alarm detection information and abnormal alarms, different analysis data are obtained to provide data for the subsequent location of the fault cause to meet different fault location requirements.

In addition, the method further includes: obtaining quality change data of the machine when the abnormal alarm is generated, the quality change data being used to indicate the change of quality indicator data during the operation of the machine; associating the quality change data with the abnormal alarm; and visualizing the associated quality change data and the abnormal alarm. By visualizing the associated quality change data and abnormal alarm, the abnormal alarms that have a greater impact on quality can be intuitively viewed so that the staff can focus on them.

In addition, obtaining the resource operation data of at least two monitored machines within a preset period includes: obtaining the resource operation data of the specified machine within the preset period from a summary database, and the summary database is used to receive the resource operation data reported by each monitored machine. Setting up a summary database to store the resource operation data reported by each monitored machine, rather than directly storing the resource operation data of each monitored machine in the monitoring platform, can reduce the amount of data to be processed later. At the same time, storing the resource operation data of each machine in the summary database also facilitates obtaining the resource operation data of other machines from the summary database.

BRIEF DESCRIPTION OF THE DRAWINGS

One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

FIG1 is a flow chart of a method for monitoring machine performance provided in a first embodiment of the present invention;

2 is a flow chart of a method for monitoring machine performance provided in a second embodiment of the present invention;

FIG3 is a graph corresponding to Table 2 in a method for monitoring machine performance provided in a third embodiment of the present invention;

4 is a flow chart of a method for monitoring machine performance provided in a third embodiment of the present invention;

5 is a flow chart of a method for monitoring machine performance provided in a fourth embodiment of the present invention;

6 is a flowchart of an implementation of obtaining an alarm factor according to a fifth embodiment of the present invention;

7 is a flowchart of an implementation of obtaining an alarm factor according to a fifth embodiment of the present invention;

8 is a flowchart of an implementation of obtaining an alarm factor according to a fifth embodiment of the present invention;

9 is a block diagram of a system for monitoring machine performance provided in a sixth embodiment of the present invention;

FIG. 10 is a structural block diagram of a network device provided according to a seventh embodiment of the present invention.

DETAILED DESCRIPTION

In order to make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the various embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the various embodiments of the present invention, many technical details are provided in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented.

The following embodiments are divided for the convenience of description and shall not constitute any limitation on the specific implementation of the present invention. The embodiments may be combined with each other and referenced to each other without contradiction.

The first embodiment of the present invention relates to a method for monitoring machine performance. Applied to a monitoring platform, the process is shown in FIG1 :

Step 101: Obtain resource operation data of at least two monitored machines within a preset period. The resource operation data includes the alarms generated when each resource block in the machine is running and the alarm detection information corresponding to the alarm. The alarm detection information includes any combination of the following information: information on the duration of the alarm, the number of durations, and the traffic information when the alarm is triggered.

Step 102: Obtain label information of each alarm in the resource operation data. The label information is used to indicate the category to which the alarm belongs, and is obtained by each machine according to the category label of the alarm.

Step 103: According to the label information of each alarm, alarms belonging to the abnormal category are obtained from the resource operation data as abnormal alarms.

Step 104: Determine analysis data for each abnormality category based on the alarm detection information corresponding to the abnormal alarm and the abnormal alarm, where the analysis data includes: information on the machine where the abnormal alarm of the abnormal category is located.

Step 105: Visualize the acquired abnormal alarm and/or analysis data according to the received display instruction.

The method for monitoring machine performance in the embodiment of the present application obtains the operation data of each resource to be analyzed within a preset period, so that the obtained resource operation data can reflect the alarm of the monitored machine during operation within a time period and the alarm detection information corresponding to the alarm, and can continuously reproduce the same abnormal problem within the time period, which is convenient for the subsequent accurate positioning of the same problem; and the alarm detection information includes any combination of the following information: information on the duration of the alarm, information on the number of times the alarm lasts, and traffic information when the alarm is triggered, so as to mine alarms that have been in a poor state for a long time, so that the alarm detection information can reflect the impact of the alarm on the machine, and then facilitate the subsequent statistics and analysis of the alarm; because the resource operation data not only includes the alarm but also includes the alarm detection information corresponding to the alarm, it is convenient for the monitoring platform to perform fault analysis; according to the alarm detection information of the abnormal alarm and the abnormal alarm, the analysis data is determined, and It is not just a unilateral acquisition of alarm data, but also a display combining analysis data and abnormal alarms, which is helpful for staff to locate abnormal alarms. Due to the monitoring of a large number of machines, including the resource operation data of multiple machines, each alarm has corresponding label information, which indicates the category of the alarm. Based on the label information, alarms belonging to the same abnormal category can be filtered out, so that the monitoring platform can obtain abnormal alarms of each abnormal category from multiple monitored machines according to the label information of the alarm. Since the abnormal alarm of a single machine is not obtained, it is helpful for subsequent staff to locate the accurate cause of the abnormality according to the information of the machine where the abnormal alarm is located, and the category of each abnormal alarm can be obtained through the label information of the abnormal alarm, without the need for re-classification, reducing the time for abnormal alarm classification, and facilitating timely positioning of the abnormal position according to the category of the abnormal alarm, reducing the duration of the abnormal alarm.

The second embodiment of the present invention relates to a method for monitoring machine performance. The second embodiment is a detailed introduction to the first embodiment, and its process is shown in Figure 2:

Step 201: Obtain resource operation data of at least two monitored machines within a preset period.

Specifically, the method for monitoring machine performance in this example is applied to a monitoring platform, which can be a server or a combination of at least two servers, and the monitoring platform can be provided with a corresponding analysis database. The monitoring platform can be directly connected to the monitored machine for communication, and the monitoring platform receives resource operation data uploaded by each monitored machine, and can store the resource operation data in the analysis database, and obtain the resource operation data of the specified machine running within a preset period from the analysis database. The monitoring platform can also directly receive resource operation data from the specified machine running within a preset period. Among them, the specified machine in this example can be determined based on the IP address information of the machine to be analyzed received. The preset period can be 1 period, 2 periods or more. The resource operation data includes: an alarm and the alarm detection information corresponding to the alarm, and the alarm detection information includes any combination of the following information: information on the duration of the alarm, information on the number of times the alarm lasts, and traffic information when the alarm is triggered, and the alarm detection information is obtained by the monitored machine.

It should be noted that the monitored machine can be a server, on which runs the application used in this example to obtain resource operation data. The alarm may include: CPU alarm, I/O alarm, memory alarm and load alarm in the current server, and may also include time, server IP address, usage rate and other information.

Step 202: Obtain label information of each alarm in the resource operation data. The label information is used to indicate the category to which the alarm belongs, and is obtained by each machine according to the category label of the alarm.

Specifically, each alarm in the resource operation data has corresponding label information, which is obtained by labeling each monitored machine, and the label information is used to indicate the category to which the alarm belongs. For example, in this example, the HW field is used as the category of the hardware alarm, and the label information can also be MEMORY, CPU, IO, etc.; the label information is HW_PARAM, which indicates the category of the specific abnormality of the memory in the corresponding hardware detected, such as LOW_CPU_FREQ, DISK_ERROR, NUMA_TOTAL_UNBALANCE, etc.; the SW label indicates the category of software-related problems that have occurred, such as HIGH_CPU_PART, MEMORY_SUDDEN_CHANGE, etc., and SW_PARAM is the category of the specific value of the detected SW problem; the SW_MORE label information indicates the detailed category of software-related problems, and the SW_MORE specifically includes two meanings, namely, the average per-minute traffic and number of connections in a cycle. If a CPU abnormality occurs and a high-running process is detected, the SW_MORE indicates the average per-minute traffic and number of connections in a cycle, and also includes the high-running process information.

Step 203: According to the label information of each alarm, alarms belonging to the abnormal category are obtained from the resource operation data as abnormal alarms.

Specifically, since the tag information has different meanings, the corresponding abnormal alarm can be obtained through different tag information. Several processes for obtaining abnormal alarms are introduced below.

In one example, if the label information is used to indicate that the alarm belongs to the traffic alarm category, then an alarm that the cumulative value of the number of connections per minute exceeds the connection number threshold is obtained as an abnormal alarm, or an alarm that the incoming traffic per minute exceeds the incoming traffic threshold is obtained as the abnormal alarm, or an alarm that the outgoing traffic per minute exceeds the outgoing threshold is obtained as an abnormal alarm.

Specifically, the performance data of the machine is usually related to the high traffic data of the machine, so in this example, by setting the inflow traffic threshold, outflow traffic threshold and connection number threshold, the abnormal alarms that meet the analysis are filtered out. For example, if the tag information includes the field of TRAFFIC_PER_MIN_xK|yMB|zMB, x represents the cumulative value of the number of connections per minute, y represents the inflow traffic per minute, and z represents the outflow traffic per minute, the values indicated by x, y or z are obtained respectively. If x>3||y>500||z>500 is satisfied, that is, the cumulative value of the number of connections per minute>3K or the inflow traffic per minute>500MB or the outflow traffic per minute>500MB; then it is determined that the alarm is an abnormal alarm.

It is worth mentioning that due to the large number of abnormal high traffic conditions within the preset period, for the entire monitoring system, it indicates that the abnormal problem continues to recur within the preset period. The abnormal situation has a greater impact on the entire system and needs to be analyzed to reduce the number of alarms of the same category. Therefore, in this example, by setting the inflow traffic threshold, outflow traffic threshold and connection number threshold, the alarms of abnormal high traffic conditions are screened out as abnormal alarms to improve the efficiency of subsequent analysis.

In another example, if the tag information is used to indicate that the alarm belongs to the hardware alarm category, the alarm corresponding to the tag information is used as an abnormal alarm. For example, if the tag information includes HW and HW_PARAM fields, the alarm corresponding to the tag information is used as an abnormal alarm, wherein the HW field indicates a hardware problem.

In another example, if the tag information is used to indicate that the alarm belongs to the category of processor high running, then the alarm whose high running times in the current cycle exceeds the high running threshold is obtained as the abnormal alarm.

Specifically, in this example, the HIGH_CPU_PART in the SW_PARAM field corresponds to an alarm that is prone to high running, but when the total number of high running times is small, the impact on the monitored machine is small, so it needs to be filtered out. A high running threshold can be set in advance. When the total number of high running times in HIGH_CPU_PART exceeds the preset high running threshold, the alarm is treated as an abnormal alarm. If other item tags of SW_PARAM are detected, the corresponding alarm is directly treated as an abnormal alarm.

In another example, if the tag information indicates that the alarm belongs to the process high running category, the alarm that the number of process high running times in the current cycle exceeds the process high running threshold is obtained as an abnormal alarm.

For processes in the label SW_MORE, it is easy to have high alarms. Similarly, when the total number of high times is small, the impact on the service of the monitored machine is small, so it needs to be filtered out. The process high threshold can be set in advance. When the total number of high times in the high process exceeds the preset process high threshold, the corresponding alarm will be used as an abnormal alarm. In addition, this embodiment has different attention levels for different processes. For processes with higher attention levels, the process high threshold can be set to a smaller value, and vice versa, the process high threshold can be set to a higher value. For example, for the related processes shark, squid, wsxserver, and appa under the component, the process high threshold is set to 30, and the other process high thresholds are set to 60.

Step 204: Store the abnormal alarm in the analysis database.

In order to facilitate visual analysis and monitoring of the process, this example uses the process as the granularity and stores the process-related data in a table, as shown in Table 1:

Table 1

Step 205: Determine analysis data for each abnormality category according to the alarm detection information corresponding to the abnormal alarm and the abnormal alarm.

In one example, according to each alarm detection information and abnormal alarm, statistics are collected on the duration of the abnormal alarm in each abnormal category, the location information of the machine where the abnormal alarm is located, and the type distribution information of the machine where the abnormal alarm is located.

After obtaining each abnormal alarm, obtain the indicators corresponding to each preset abnormal category and the data such as the number of machines where the running process is located. From the alarm data of all machines obtained, count the abnormal alarms of the sudden increase in the number of running process machines, so that the relevant personnel can be visualized or notified by email to handle it later. By counting the data associated with the abnormal alarms in each abnormal category, the impact of the problem of the abnormal category on the server performance can be tracked in real time, and then the staff can be assisted to find the problem in time. For example, especially after the component of the server is upgraded, by obtaining the analysis data, the problem can be found in time, and the impact of the failure of the abnormal category on the service can be reduced. For example, if the number of process IPs increases suddenly, as shown in Table 2, the duration of the abnormal alarm in the abnormal category, the location information of the machine where the abnormal alarm is located, and the type distribution information of the machine where the abnormal alarm is located can be obtained.

Table 2

It can be seen from Table 2 that the number of machines with abnormal alarms in this process has increased sharply compared with the previous cycle. The distribution information of the types of machines where the abnormal alarms are located is statistically analyzed. Based on the information in Table 2, it is helpful for subsequent staff to locate the fault.

Alternatively, in another example, based on each alarm detection information and abnormal alarm, the process that meets the preset analysis conditions is obtained as the key process, and the duration of the abnormal alarm in the key process, the type of machine where each abnormal alarm is located, and the location information of the machine where the abnormal alarm is located are counted.

Specifically, a preset analysis condition can be set in advance, for example, the preset analysis condition is that the duration of the kernel running high exceeds a preset duration threshold, and the duration threshold is 60S. The process that meets the preset analysis condition is regarded as a key process, and the duration of the abnormal alarm in the key process, the type of the machine where each abnormal alarm is located, and the location information of the machine where the abnormal alarm is located are counted.

By monitoring key processes and related information, it is convenient to proactively troubleshoot the root cause of the fault and perform optimization, thereby ensuring the normal operation of the machine. For example, in this example, statistics on key processes are obtained, as shown in Table 3:

Table 3

Among them, the data format of each process in the process column is further processed. For example, the process with a total duration of high memory usage greater than or equal to 60 seconds is regarded as a key process. The key process ksoftirqd_352 indicates that the total duration of high memory usage of this process in the last cycle (2020-09-05 18:31 to 2020-09-05 18:45) is 352s. There is no subsequent value for ksoftirqd_352, indicating that the total duration of high memory usage of this process in the last two cycles (2020-09-05 18:16 to 2020-09-05 18:30) within the period < 60s, there is no critical process; the first value from left to right in kswapd_588_125 indicates that the process lasted 588s during the previous period, and the second value 125 indicates that the process increased by 125s compared with the previous period; the processes whose total high running duration in the period is greater than the preset threshold are counted as critical processes, so as to remind the staff to focus on the critical processes.

Or, in another example, based on each alarm detection information and abnormal alarm, the number of machines with abnormal alarms in each specified time period within the cycle is counted to indicate the proportion of the number of machines to the total number of monitored machines.

Specifically, if there is a need to obtain detailed information, the number of machines that have abnormal alarms in each specified time period within the cycle can be counted based on different thresholds of the abnormality category, such as the minimum/maximum/total/average duration thresholds, to indicate the proportion of the number of machines to the total number of monitored machines.

Or, in another example, based on each alarm detection information and abnormal alarm, statistics are collected on the machine type of each abnormal category distribution, the kernel version information of the machine of the abnormal category distribution, the product line information of the abnormal category, or the abnormal process.

By counting abnormal alarms, you can obtain the type, product line, and kernel version of the machine with the abnormal alarm, or the abnormal alarms corresponding to each machine type, product line, and kernel version, as well as the process where the abnormal alarm is located, so as to analyze whether the abnormal alarm is caused by a version problem or a problem with the machine itself.

Or, in another example, according to each alarm detection information and abnormal alarm, according to the statistical abnormal alarm, the information of the worst performing K machines is obtained, where K is an integer greater than 1.

Obtain the performance data changes of a single machine to capture the fault site when the machine performance is abnormal, without having to log in to the machine to view the specific situation.

Step 206: Visualize the acquired abnormal alarm and/or analysis data according to the received display instruction.

Visualize the acquired abnormal alarms and analysis data. In this embodiment, the grafana platform is selected as the visualization platform, which supports multiple data sources and various charts, and is convenient and flexible to operate.

According to the input visualization instruction, the visualized abnormal alarm and the analysis data are determined. For example, the data in Table 2 can be visualized, and a related curve chart can be drawn according to the data in Table 2, as shown in FIG3 .

The step division of the above methods is only for clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the protection scope of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the protection scope of the present invention.

The third embodiment of the present invention relates to a method for monitoring machine performance. The third embodiment is another implementation of the step in the above embodiment: obtaining resource operation data of at least two monitored machines within a preset period. The process is shown in FIG4 :

Step 301: Obtain resource operation data of at least two monitored machines within a preset period, and a summary database is used to receive resource operation data reported by each monitored machine.

Specifically, the monitoring platform is connected to the summary database, and each monitored machine is connected to the summary database, which summarizes the resource operation data from each machine. If the number of monitored machines is large, the amount of data to be processed can be further reduced by setting up a summary database and obtaining resource operation data from the summary database.

This example describes in detail the process of a machine obtaining resource operation data. Each monitored machine performs the following processing: obtaining the resource data generated during the operation of each resource block in the machine, the resource data including alarms; obtaining the alarm detection information of the alarm in each resource block and adding label information to the alarm in each resource data according to the analysis strategy corresponding to each resource block, the label information is used to indicate the alarm category to which the alarm belongs; determining the resource operation data of the machine according to the alarm detection information and the resource data.

In one example, if the resource block is a CPU, according to the analysis strategy corresponding to each resource block, label information is added to the alarm in each resource data, including: if it is detected that the alarm corresponding to the CPU reaches a preset high running threshold, label information is added to the alarm to indicate that the alarm belongs to the CPU high running type, and the high running type includes: full-core high running category or partial high running category; and/or, according to the alarm, the high running thread of the CPU is obtained, and it is determined whether the high running thread is a kernel thread. If the high running thread is a kernel thread, it is determined whether the high running thread meets the performance analysis threshold. If so, kernel analysis is performed to obtain field information used to characterize the analysis results, and the field information is used as the label information of the alarm. If the threshold is not met, the alarm is discarded; if the high running thread is a service thread, kernel analysis is performed to obtain field information used to characterize the analysis results, and the field information is used as the label information of the alarm.

You can perform CPU cyclic sampling through an independent process, and detect processes with continuously high CPU usage at a sampling interval of 1s: Detect the high CPU usage of each process based on the CPU snapshot and TOP snapshot. The CPU snapshot and TOP snapshot collection frequencies are synchronized to ensure that the corresponding thread running data is collected during the high CPU usage. The alarm type is determined based on the number of CPU cores that are running high, whether it is all cores running high (HIGH_CPU_ALL) or some cores running high (HIGH_CPU_PART). Based on the thread type, you can determine whether the high CPU usage thread is a kernel thread running high (HIGH_KERNEL_THREAD). Perform performance analysis on service processes and kernel threads whose CPU usage triggers the perf threshold, and report the analysis results to the summary database, service processes, such as web service process shark, cache service process squid, etc.; kernel threads such as kswapd, ksoftirqd, etc. The CPU and thread detection results in the current cycle are summarized every 15 minutes. For example, if HIGH_CPU_PART_1_69_831_17 is detected for some cores, and the process kswapd_1_69_831_17 is further detected, it means that some cores are running high in this cycle, specifically the kswapd thread is running high. Among them, kswapd_1_69_831_17 means that the high running time lasted for a long time in 15 minutes, that is, 831 seconds in 900 seconds. If it is still running high in the next cycle, it means that the abnormality is more likely, and the analysis results are reported.

In another example, if the resource block is an input/output I/O, according to the analysis strategy corresponding to each resource block, label information is added to the alarm in each resource data, including: obtaining the first data in the CPU for indicating the waiting time for I/O completion according to the alarm; if the first data is greater than the I/O threshold, triggering the detection of the I/O, and finding the disk whose second data exceeds the detection threshold as the high disk, and the second data is used to indicate the operating ratio of the disk resources per second; performing the following processing for each high disk: if it is detected that the request service time is greater than the time threshold, adding label information indicating that the service time is abnormal to the alarm; if the queue waiting time exceeds the waiting threshold, adding label information indicating that the waiting time is abnormal to the alarm; if it is detected that the read and write volume per unit time exceeds the preset read and write threshold, adding label information indicating that the throughput is abnormal to the alarm.

Specifically, during CPU sampling, the iowait value of the CPU is obtained. iowait is used to indicate the waiting time for I/O completion. If the iowait value of any CPU is greater than the preset threshold, IO detection is triggered, and the disk whose IOUTIL exceeds the threshold is searched, where IOUTIL indicates the resource operation ratio of the disk per second. The following processing is performed on the found disk: when it is detected that the request service time is greater than the threshold, the alarm factor is determined to be LONG_SERVICE_TIME; when it is detected that the queue waiting time is too long, LONG_WAIT_TIME; when it is detected that the read and write volume per unit time is too large, the alarm factor is determined to be LARGE_THROUGHPUT. In the summary data, the minimum/maximum high running duration, total high running times, and average high running duration of IOWAIT during the period are recorded.

In another example, if the resource block is memory, according to the analysis strategy corresponding to each resource block, label information is added to the alarm in each resource data, including: determining the memory exception category in the machine according to the acquired memory information; judging whether the memory exception category belongs to a specified category, and if so, adding label information indicating the specified category to the alarm, and obtaining the number of durations of memory exception category alarms within a preset time period, the total value of memory highs, and the average number of durations of memory highs, wherein the specified types include any combination of the following: system unreleasable memory mutations, system SLAB allocator unreleasable memory mutations, memory mutations, memory change rate exceeding a preset change rate threshold, and the usage rate of the SLAB allocator exceeding a preset usage rate threshold.

Get the memory information, and determine the type of alarm in the machine based on the memory information. If it is the type of system-wide unreleasable memory mutation, add the label information "UNRECLAIM_SURGE"; if it is the system SLAB unreleasable memory mutation, add the label information "SLAB_UNRECLAIM_SURGE"; if it is a memory mutation, add the label information "MEMORY_SUDDEN_CHANGE"; if it is the type of memory change rate exceeding the preset change rate threshold, add the label information MEMORY_USAGE_HIGH; if it is the type of SLAB allocator usage rate exceeding the preset usage rate threshold, add the label information SLAB_HIGH. Among them, the change rate threshold and the usage rate threshold can be set in advance according to actual needs. If at least one of them exists, further detect the minimum/maximum high-running duration times, total high-running times, and average high-running duration times of the state existing in the 15-minute period.

In another example, if the resource block is a load LOAD, the label information added to the alarm is as follows: when the load of the system within the last minute reaches the preset threshold or the CPU runs high but there is no high-usage thread, determine whether the category of the alarm is a load-specified category. If it is a load-specified category, add label information indicating the load-specified category to the alarm. The load abnormality category includes any combination of the following: abnormal thread category, average waiting queue time exceeds the preset waiting threshold, running state thread exceeds the first thread threshold, D state thread exceeds the second thread threshold. If there is an abnormal thread, add the label information "ABNORMAL_THREAD" to the alarm, if there is an average waiting queue that exceeds the preset waiting threshold, you can add the label "LONG_WAIT_QUEUE" to the alarm, if the running state thread exceeds the corresponding first thread threshold, add the label information "MULTI_R_THREAD" to the alarm, if the D state thread exceeds the second thread threshold, add the label information "MULTI_D_THREAD" to the alarm.

If at least one of the categories exists, the minimum/maximum running height duration times, the total running height times and the average running height duration times of the state existing in the 15-minute period are further detected.

If the resource block is a traffic resource, obtain the average number of connections per minute and import and export traffic in the previous period, such as TRAFFIC_PER_MIN_20.44K|8682.6MB|13426.1MB.

It is worth mentioning that by recording the duration and number of times the alarm occurs, it is possible to determine how long the alarm affects the entire system; at the same time, the duration and number of times the alarm occurs can be used to detect the duration of each alarm when the machine is abnormal, so as to analyze the cause of the machine failure. If the corresponding processing operations are performed to eliminate the fault, it is also possible to determine whether the fault has been resolved or improved by detecting the duration and number of times the alarm occurs. By recording the duration and number of times the alarm occurs, it is also possible to screen out occasional problems and reduce the amount of data for fault analysis.

If the resource block is hardware, check whether the machine has hardware problems such as NUMA node memory imbalance (NUMA_TOTAL_UNBALANCE), memory bad page (MEM_HARDWARE_ERROR), disk failure (DISK_ERROR), CPU overheating (HIGH_CPU_TMP), CPU offline (CPU_OFFLINE), CPU operation mode error (LOW_CPU_PERFORMANCE), CPU frequency reduction (LOW_CPU_FREQ), etc., and add label information of the corresponding category to the alarm. Since hardware problems usually last for a long time once they occur, there is no need to record the duration, only whether they occur.

The alarm factors and resource data of each machine are reported to the summary database as resource operation data.

Step 302: Obtain label information of each alarm in the resource operation data. The label information is used to indicate the category to which the alarm belongs, and is obtained by each machine according to the category label of the alarm.

Step 303: According to the label information of each alarm, alarms belonging to the abnormal category are obtained from the resource operation data as abnormal alarms.

Step 304: Determine analysis data for each abnormal category based on the alarm detection information corresponding to the abnormal alarm and the abnormal alarm, where the analysis data includes: information on the machine where the abnormal alarm of the abnormal category is located.

Step 305: Visualize the acquired abnormal alarm and/or analysis data according to the received display instruction.

Step 306: Acquire quality change data of the machine when an abnormal alarm is generated. The quality change data is used to indicate the quality indicator change data during the operation of the machine.

Specifically, when an abnormal alarm occurs, the quality index of the machine will change. By associating the quality change data with the abnormal alarm, the impact of the abnormal alarm on the operation of the machine can be observed. For example, if the category of the abnormal alarm is a high process run, the abnormal alarm can be associated with the quality change data. Alternatively, when the quality change data is detected, the abnormal alarm generated at this time can be obtained, and the abnormal alarm and the quality change data can be associated.

The quality indicator data can come from the server log or the client log. In this embodiment, the server TCP access log collected in real time is taken to calculate the quality indicator data of different domain names on each machine with the same time (cycle duration) granularity. Since the quality indicators concerned by different domain names may be different, the values of different quality indicators can be calculated at the same time or selected and calculated as needed. The quality indicator data includes but is not limited to: retransmission ratio, transmission speed, >1M transmission speed (for the transmission of small files, the transmission time may be very short, resulting in large speed fluctuations, so an evaluation indicator for the transmission of large files is added), jam rate, first packet duration, first screen duration, quality factor, etc.

Step 307: Associating the quality change data with the abnormality alarm.

For machine performance data with some cores running high, it may not necessarily affect the quality, so you can filter out the items with greater impact based on the results and optimize them.

Step 308: Visualize the associated quality change data and abnormal alarms.

In addition, based on the correlation results, the performance indicators and process information that have a greater impact on quality can be summarized, and the staff can be reminded to pay attention and add them to the monitoring to optimize the problems in time and reduce the impact.

The fourth embodiment of the present invention relates to a method for monitoring machine performance. The method is applied to the monitored machine, and its process is shown in FIG5 :

Step 401: Obtain resource data generated when each resource block in the machine is running, and the resource data includes alarms.

Step 402: According to the analysis strategy corresponding to each resource block, the alarm detection information of the alarm in each resource block is obtained and label information is added to the alarm in each resource data, where the label information is used to indicate the category to which the alarm belongs.

Step 403: Determine the resource operation data of the machine based on the alarm detection information and the resource data, so that the monitoring platform can obtain the resource operation data within a preset period, and obtain the label information of each alarm in the resource operation data; according to the label information of each alarm, obtain the alarm belonging to the abnormal category from the resource operation data as an abnormal alarm, and determine the analysis data of each abnormal category based on the alarm detection information corresponding to the abnormal alarm and the abnormal alarm; visualize the acquired abnormal alarm and/or the analysis data according to the received display instruction; the analysis data includes: information on the machine where the abnormal alarm of the abnormal category is located.

In this embodiment, resource data of the monitored machine is collected in real time. The resource data contains alarms. According to the analysis strategy corresponding to the resource block, the alarm in each resource data is analyzed, label information is added to the alarm, and the alarm detection information of the alarm is obtained. Since the obtained alarm is not simply reported directly, but the alarm detection information corresponding to each alarm is analyzed and label information is added to the alarm, it is beneficial for the subsequent monitoring platform to locate the fault according to the alarm and reduce the duration of the fault.

The fifth embodiment of the present invention relates to a method for monitoring machine performance. This embodiment is a detailed introduction to step 402 in the fourth embodiment. Since each resource block corresponds to a different analysis strategy, step 402 has a different implementation process. The implementation process of step 402 will be introduced below according to the category of each resource block:

1. If the resource block is a CPU, according to the analysis strategy corresponding to each resource block, the process of adding label information to the alarm in each resource data is shown in Figure 6:

Step S51: If it is detected that the alarm corresponding to the CPU reaches the preset high running threshold, then step S51 or step S52 is executed, or step S51 and step S52 are executed simultaneously.

Specifically, the high running threshold corresponding to the CPU can be pre-set, and the CPU can be sampled cyclically through an independent process. For example, the process with a continuously high CPU running can be detected at a sampling interval of 1 second: the high running situation of each process can be detected based on the CPU snapshot and the TOP snapshot, wherein the acquisition frequency of the CPU snapshot and the TOP snapshot is synchronized to ensure that the corresponding thread running data is collected during the high running period. Check whether the CPU high running value in the alarm corresponding to the CPU exceeds the running threshold. If so, further analysis can be performed. If it does not exceed the CPU high running threshold, the alarm can be discarded and other alarms can be analyzed.

Step S52: adding label information indicating that the alarm belongs to the CPU high running type, the high running type includes: all cores high running type or partial cores high running type.

Specifically, the current high running type can be further analyzed. For example, the alarm type can be judged according to the number of CPU cores running high to determine whether it belongs to all cores running high (HIGH_CPU_ALL) or whether the alarm belongs to some cores running high (HIGH_CPU_PART), where HIGH_CPU_PART is a pre-set type, indicating that in the sampled CPU snapshot, the number of CPUs with a usage rate greater than the threshold is greater than 0 and less than the total number of CPUs. The four numbers after HIGH_CPU_PART are the shortest continuous high running time, the maximum continuous high running time, the total continuous high running time, and the average duration of each high running detection that triggers such problems as HIGH_CPU_PART in this cycle, in seconds.

Step S53: Obtain the CPU's high-running thread according to the alarm, and determine whether the high-running thread is a kernel thread. If the high-running thread is a kernel thread, execute step S54; if the high-running thread is a service thread, execute step S55.

Specifically, it can be determined according to the thread type whether the high-running thread is a kernel thread running high (HIGH_KERNEL_THREAD).

In this example, performance analysis is performed only for service processes and kernel threads whose CPU usage triggers the perf threshold, and the analysis results are reported to the summary database. Service processes can be web service processes such as shark and cache service processes such as squid; kernel threads can be such as kswapd and ksoftirqd.

Step S54: Determine whether the high-running thread meets the threshold of performance analysis. If so, execute step S55 to perform kernel analysis and use the analysis result as an alarm factor. If it does not meet the threshold, execute step S56 to discard the alarm.

Step S55: perform kernel analysis, obtain field information used to characterize the analysis result, and use the field information as label information of the alarm.

Step S56: discard the alarm.

2. If the resource block is an input/output I/O, according to the analysis strategy corresponding to each resource block, the process of adding label information to the alarm in each resource data is shown in Figure 7:

Step S61: acquiring first data indicating the waiting time for I/O completion in the CPU according to the alarm.

Specifically, during CPU sampling, the iowait value of the CPU is obtained, and iowait is used to indicate the waiting time for I/O completion.

Step S62: If the first data is greater than the I/O threshold, I/O detection is triggered, and the disk whose second data exceeds the detection threshold is found as a high disk. The second data is used to indicate the operating ratio of the disk resources per second.

Specifically, if the iowait value of any CPU is greater than a preset threshold, IO detection is triggered to find the disk whose IOUTIL exceeds the threshold, where IOUTIL indicates the operation ratio of the disk's resources per second.

Step S63: Perform the following processing for each high disk: if it is detected that the request service time is greater than the time threshold, add label information indicating that the service time is abnormal to the alarm; if the queue waiting time exceeds the waiting threshold, add label information indicating that the waiting time is abnormal to the alarm; if it is detected that the read and write volume per unit time exceeds the preset read and write threshold, add label information indicating that the throughput is abnormal to the alarm.

The following processing is performed on the found disks: when it is detected that the request service time is greater than the threshold, the alarm category is determined to be the service time abnormal category, and the label information added to the alarm is "LONG_SERVICE_TIME"; when it is detected that the queue waiting time is too long, LONG_WAIT_TIME; when it is detected that the read and write volume per unit time is too large, the alarm category is determined to be the waiting time abnormal category, and the label information "LARGE_THROUGHPUT" can be added to the alarm. In addition, if the I/O detection is triggered, the minimum/maximum high-running duration times, total high-running times, and average high-running duration times of IOWAIT in the preset period when the alarm is generated can be recorded, that is, in the summary data, the minimum/maximum high-running duration times, total high-running times, and average high-running duration times of IOWAIT in the period are recorded.

3. If the resource block is memory, according to the analysis strategy corresponding to each resource block, the process of adding label information to the alarm in each resource data is shown in Figure 8:

Step S71: Determine the memory abnormality category of the memory in the machine according to the acquired memory information.

Obtain memory information, and determine the memory exception category of the memory in the machine according to the memory information.

Step S72: Determine whether the memory exception category belongs to the specified category. If it is the specified category, execute step S73; otherwise, execute step S75 and discard the alarm.

Specifically, the designated categories include one or more combinations of the following: system overall unreleasable memory surge (UNRECLAIM_SURGE), system SLAB unreleasable memory surge (SLAB_UNRECLAIM_SURGE), memory surge (MEMORY_SUDDEN_CHANGE), high memory usage (MEMORY_USAGE_HIGH), and high SLAB occupancy (SLAB_HIGH).

If it is determined that the memory exception category is a specified category, step S72 is executed; if it is not a specified category, the alarm is discarded.

Step S73: Add label information indicating a specified type to the alarm.

The label information is used to indicate the category of the alarm. For example, in this example, the HW field is used as the general label of the hardware alarm. Another example is that the label information can be MEMORY, CPU, IO, etc.; the label information is HW_PARAM, which indicates the information of the corresponding specific abnormality detected, such as LOW_CPU_FREQ, DISK_ERROR, NUMA_TOTAL_UNBALANCE, etc.; the SW label indicates the label of the software-related problem that has occurred, such as HIGH_CPU_PART, MEMORY_SUDDEN_CHANGE, etc., and SW_PARAM is the specific value of the corresponding SW problem detected; SW_MORE contains two meanings, which respectively indicate the average per-minute traffic and number of connections in a cycle. If a CPU problem occurs and a high-running process is detected, then SW_MORE indicates the average per-minute traffic and number of connections in a cycle, and also includes the high-running process information.

Report the processed resource operation data to the summary database.

The label information of the alarm in the resource operation data makes it easier to quickly obtain the resource operation data of the specified type from the summary database, thereby improving the subsequent processing speed of the resource operation data.

If it is a category of system overall unreleasable memory mutation, add label information "UNRECLAIM_SURGE", if it is a system SLAB unreleasable memory mutation, add label information "SLAB_UNRECLAIM_SURGE"; if it is a memory mutation, add label information "MEMORY_SUDDEN_CHANGE"; if it is a category of memory change rate exceeding the preset change rate threshold, add label information MEMORY_USAGE_HIGH; if it is a category of SLAB allocator usage exceeding the preset usage threshold, add label information SLAB_HIGH. Among them, the change rate threshold and usage threshold can be set in advance according to actual needs.

Specifically, the minimum/maximum number of high-running durations, the total number of high-running durations, and the average number of high-running durations of the existence state of the memory within the current 15-minute period can be detected.

In another example, if the resource block is a load, then the label information added to the alarm is as follows: when the system load within the last minute reaches a preset threshold or the CPU runs high but there is no high-usage thread, determine whether the category of the alarm is a load-specified category. If it is a load-specified category, add label information indicating the load-specified category to the alarm. The load abnormality category includes any combination of the following: abnormal thread category, average waiting queue duration exceeds a preset waiting threshold, running state thread exceeds the first thread threshold, and D state thread exceeds the second thread threshold. If there is an abnormal thread, add the label information "ABNORMAL_THREAD" to the alarm; if there is an average waiting queue that exceeds the preset waiting threshold, add the label "LONG_WAIT_QUEUE" to the alarm; if the running state thread exceeds the corresponding first thread threshold, add the label information "MULTI_R_THREAD" to the alarm; if the D state thread exceeds the second thread threshold, add the label information "MULTI_D_THREAD" to the alarm.

Step S74: Obtain the number of continuation of memory abnormality category alarms, the total value of memory highs, and the average number of continuation of memory highs within a preset period of time.

The minimum/maximum number of durations of running high, the total number of durations of running high, and the average number of durations of running high stored in the memory when the alarm is generated within the 15-minute period can be further detected, and the detected information can be used as alarm detection information for the alarm.

It should be noted that if the resource block is a traffic resource, the average number of connections per minute and import and export traffic in the previous cycle are obtained, such as TRAFFIC_PER_MIN_20.44K|8682.6MB|13426.1MB.

If the resource block is hardware, check whether the machine has hardware problems such as NUMA node memory imbalance (NUMA_TOTAL_UNBALANCE), memory bad page (MEM_HARDWARE_ERROR), disk failure (DISK_ERROR), CPU overheating (HIGH_CPU_TMP), CPU offline (CPU_OFFLINE), CPU operation mode error (LOW_CPU_PERFORMANCE), CPU frequency reduction (LOW_CPU_FREQ), etc. Since hardware problems usually last for a long time once they occur, there is no need to record the duration, only record whether they occur.

The alarm detection information and resource data of each machine are reported to the summary database as resource operation data.

Step S75: discard the alarm.

The sixth embodiment of the present invention relates to a system for monitoring machine performance, and its structural block diagram is shown in FIG9 , which includes: a monitoring platform 61 for executing the above-mentioned method for monitoring machine performance, and a machine 62 for executing the above-mentioned method for monitoring machine performance.

The number of monitored machines is at least 2, and may be multiple machines, for example, more than 1,000 monitored machines.

The monitoring platform can be a server or a combination of multiple servers. In addition, the system can also include a summary database. The monitored machines are connected to the summary database, and the summary database is connected to the monitoring platform.

The seventh embodiment of the present invention relates to a network device, a structural block diagram of which is shown in Figure 10, including: at least one processor 701; and a memory 702 communicatively connected to the at least one processor 701; wherein the memory stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor 701 so that at least one processor 701 can execute the above-mentioned method for monitoring machine performance, or execute the above-mentioned method for monitoring machine performance.

Among them, the memory and the processor are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus links various circuits of one or more processors and memories together. The bus can also link various other circuits such as peripherals, voltage regulators, and power management circuits together, which are all well known in the art, so they are not further described in this article. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor is transmitted on a wireless medium through an antenna, and further, the antenna also receives data and transmits the data to the processor.

The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

The eighth embodiment of the present invention relates to a computer-readable storage medium storing a computer program, which implements the above-mentioned method for monitoring machine performance when executed by a processor, or implements the above-mentioned method for monitoring machine performance.

Those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

Those skilled in the art will appreciate that the above-mentioned embodiments are specific examples for implementing the present invention, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present invention.

Claims (11)

1. A method for monitoring machine performance, comprising: Obtain resource operation data of at least two monitored machines within a preset period, the resource operation data including an alarm generated when each resource block in the machine is running and alarm detection information corresponding to the alarm, the alarm detection information including any combination of the following information: information on the duration of the alarm, information on the number of durations, and traffic information when the alarm is triggered; Acquire label information of each alarm in the resource operation data, where the label information is used to indicate the category to which the alarm belongs, and is obtained by each of the machines according to the category label of the alarm; According to the label information of each of the alarms, the alarm belonging to the abnormal category is obtained from the resource operation data as an abnormal alarm; Determine analysis data for each of the abnormal categories according to the alarm detection information corresponding to the abnormal alarm and the abnormal alarm, the analysis data including: information of the machine where the abnormal alarm of the abnormal category is located; Visualizing the acquired abnormal alarm and/or the analysis data according to the received display instruction; The determining, according to the alarm detection information corresponding to the abnormal alarm and the abnormal alarm, analysis data related to each abnormal category includes: According to each of the alarm detection information and the abnormal alarm, statistics are collected on the duration of the abnormal alarm in each of the abnormal categories, the location information of the machine where the abnormal alarm is located, and the type distribution information of the machine where the abnormal alarm is located; or, According to each of the alarm detection information and the abnormal alarm, a process that meets the preset analysis conditions is obtained as a key process, and the duration of the abnormal alarm in the key process, the type of each machine where the abnormal alarm is located, and the location information of the machine where the abnormal alarm is located are counted; or, According to each of the alarm detection information and the abnormal alarm, count the number of machines of the abnormal alarm in each specified time period within the cycle, and use the information indicating the proportion of the number of machines to the total number of monitored machines; or According to each of the alarm detection information and the abnormal alarm, statistics are collected on the machine type of each abnormal category distribution, the kernel version information of the machine of the abnormal category distribution, the product line information of the abnormal category, or the abnormal process; or, According to each of the alarm detection information and the abnormal alarm, and according to the statistical abnormal alarm, obtain information of the worst-performing K machines, where K is an integer greater than 1; The abnormal categories include traffic alarm category, hardware alarm category, processor high running category, and process high running category. 2. The method for monitoring machine performance according to claim 1, characterized in that the step of obtaining the alarm belonging to the abnormal category from the resource operation data as the abnormal alarm according to the label information of each alarm comprises: If the label information is used to indicate that the alarm belongs to the flow alarm category, then an alarm that the cumulative value of the number of connections per minute exceeds the connection number threshold is obtained as the abnormal alarm, or an alarm that the inflow flow per minute exceeds the inflow flow threshold is obtained as the abnormal alarm, or an alarm that the outflow flow per minute exceeds the outflow threshold is obtained as the abnormal alarm; If the label information is used to indicate that the alarm belongs to the hardware alarm category, the alarm corresponding to the label information is used as the abnormal alarm; If the tag information is used to indicate that the alarm belongs to the category of processor high running, then obtaining the alarm whose high running times in the current cycle exceeds the high running threshold as the abnormal alarm; If the tag information includes an indication that the alarm belongs to a process high running category, the alarm whose process high running times exceed a process high running threshold in the current cycle is obtained as the abnormal alarm. 3. The method for monitoring machine performance according to claim 1, characterized in that the method further comprises: obtaining quality change data of the machine when the abnormal alarm is generated, the quality change data being used to indicate the change of quality indicator data during the operation of the machine; Associating the quality change data with the abnormal alarm; The quality change data and the abnormal alarm associated with each other are visualized. 4. The method for monitoring machine performance according to claim 1, wherein the step of obtaining resource operation data of at least two monitored machines within a preset period comprises: The resource operation data of the specified machine within the preset period is obtained from the summary database, and the summary database is used to receive the resource operation data reported by each monitored machine. 5. A method for monitoring machine performance, characterized in that it is applied to the monitored machine and comprises: Acquire resource data generated when each resource block in the machine is running, wherein the resource data includes alarms; According to the analysis strategy corresponding to each resource block, alarm detection information of the alarm in each resource block is obtained and label information is added to the alarm in each resource data, where the label information is used to indicate the category to which the alarm belongs; The resource operation data of the machine is determined according to the alarm detection information and the resource data, so that the monitoring platform can execute the method for monitoring machine performance as described in any one of claims 1 to 4. 6. The method for monitoring machine performance according to claim 5, characterized in that if the resource block is a CPU, adding label information to the alarm in each resource data according to the analysis strategy corresponding to each resource block comprises: If it is detected that the alarm corresponding to the CPU reaches a preset high threshold, label information indicating that the alarm belongs to the CPU high type is added to the alarm, and the high type includes: full core high category or partial high category; and/or, According to the alarm, the high-running thread of the CPU is obtained, and it is determined whether the high-running thread is a kernel thread. If the high-running thread is a kernel thread, it is determined whether the high-running thread meets the threshold of performance analysis. If so, kernel analysis is performed to obtain field information used to characterize the analysis result, and the field information is used as label information of the alarm. If the threshold is not met, the alarm is discarded; if the high-running thread is a service thread, the kernel analysis is performed to obtain field information used to characterize the analysis result, and the field information is used as label information of the alarm. 7. The method for monitoring machine performance according to claim 5, characterized in that if the resource block is an input/output I/O, adding label information to the alarm in each resource data according to the analysis strategy corresponding to each resource block comprises: Acquire first data indicating the waiting time for I/O completion in the CPU according to the alarm; If the first data is greater than the I/O threshold, the I/O detection is triggered, and the disk whose second data exceeds the detection threshold is found as the high disk, and the second data is used to indicate the operation ratio of the disk resources per second; The following processing is performed for each high disk: if it is detected that the request service time is greater than the time threshold, label information indicating that the service time is abnormal is added to the alarm; if the queue waiting time exceeds the waiting threshold, label information indicating that the waiting time is abnormal is added to the alarm; if it is detected that the read and write volume per unit time exceeds the preset read and write threshold, label information indicating that the throughput is abnormal is added to the alarm. 8. The method for monitoring machine performance according to claim 5, characterized in that if the resource block is a memory, adding label information to the alarm in each resource data according to the analysis strategy corresponding to each resource block comprises: Determining a memory anomaly category in the machine based on the acquired memory information; Determine whether the memory exception category belongs to a specified category. If so, add label information indicating the specified category to the alarm, and obtain the number of durations of the memory exception category alarms, the total value of memory highs, and the average number of durations of memory highs within a preset time period. The specified category includes any combination of the following: system unreleasable memory mutation, system SLAB allocator unreleasable memory mutation, memory mutation, memory change rate exceeding a preset change rate threshold, and the usage rate of the SLAB allocator exceeding a preset usage rate threshold. 9. A system for monitoring machine performance, characterized in that it comprises: a monitoring platform for executing the method for monitoring machine performance as described in any one of claims 1-4, and a machine for executing the method for monitoring machine performance as described in any one of claims 5-8. 10. A network device, comprising: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for monitoring machine performance as described in any one of claims 1-4, or execute the method for monitoring machine performance as described in any one of claims 5-8. 11. A computer-readable storage medium storing a computer program, characterized in that when the computer program is executed by a processor, the method for monitoring machine performance described in any one of claims 1 to 4 is implemented, or the method for monitoring machine performance described in any one of claims 5 to 8 is implemented.