ml.cc 55 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761
  1. // SPDX-License-Identifier: GPL-3.0-or-later
  2. #include <dlib/clustering.h>
  3. #include "ml-private.h"
  4. #include <random>
  5. #include "ad_charts.h"
  6. #include "database/sqlite/sqlite3.h"
  7. #define WORKER_TRAIN_QUEUE_POP 0
  8. #define WORKER_TRAIN_ACQUIRE_DIMENSION 1
  9. #define WORKER_TRAIN_QUERY 2
  10. #define WORKER_TRAIN_KMEANS 3
  11. #define WORKER_TRAIN_UPDATE_MODELS 4
  12. #define WORKER_TRAIN_RELEASE_DIMENSION 5
  13. #define WORKER_TRAIN_UPDATE_HOST 6
  14. #define WORKER_TRAIN_FLUSH_MODELS 7
  15. static sqlite3 *db = NULL;
  16. static netdata_mutex_t db_mutex = NETDATA_MUTEX_INITIALIZER;
  17. /*
  18. * Functions to convert enums to strings
  19. */
  20. __attribute__((unused)) static const char *
  21. ml_machine_learning_status_to_string(enum ml_machine_learning_status mls)
  22. {
  23. switch (mls) {
  24. case MACHINE_LEARNING_STATUS_ENABLED:
  25. return "enabled";
  26. case MACHINE_LEARNING_STATUS_DISABLED_DUE_TO_EXCLUDED_CHART:
  27. return "disabled-sp";
  28. default:
  29. return "unknown";
  30. }
  31. }
  32. __attribute__((unused)) static const char *
  33. ml_metric_type_to_string(enum ml_metric_type mt)
  34. {
  35. switch (mt) {
  36. case METRIC_TYPE_CONSTANT:
  37. return "constant";
  38. case METRIC_TYPE_VARIABLE:
  39. return "variable";
  40. default:
  41. return "unknown";
  42. }
  43. }
  44. __attribute__((unused)) static const char *
  45. ml_training_status_to_string(enum ml_training_status ts)
  46. {
  47. switch (ts) {
  48. case TRAINING_STATUS_PENDING_WITH_MODEL:
  49. return "pending-with-model";
  50. case TRAINING_STATUS_PENDING_WITHOUT_MODEL:
  51. return "pending-without-model";
  52. case TRAINING_STATUS_TRAINED:
  53. return "trained";
  54. case TRAINING_STATUS_UNTRAINED:
  55. return "untrained";
  56. case TRAINING_STATUS_SILENCED:
  57. return "silenced";
  58. default:
  59. return "unknown";
  60. }
  61. }
  62. __attribute__((unused)) static const char *
  63. ml_training_result_to_string(enum ml_training_result tr)
  64. {
  65. switch (tr) {
  66. case TRAINING_RESULT_OK:
  67. return "ok";
  68. case TRAINING_RESULT_INVALID_QUERY_TIME_RANGE:
  69. return "invalid-query";
  70. case TRAINING_RESULT_NOT_ENOUGH_COLLECTED_VALUES:
  71. return "missing-values";
  72. case TRAINING_RESULT_NULL_ACQUIRED_DIMENSION:
  73. return "null-acquired-dim";
  74. case TRAINING_RESULT_CHART_UNDER_REPLICATION:
  75. return "chart-under-replication";
  76. default:
  77. return "unknown";
  78. }
  79. }
  80. /*
  81. * Features
  82. */
  83. // subtract elements that are `diff_n` positions apart
  84. static void
  85. ml_features_diff(ml_features_t *features)
  86. {
  87. if (features->diff_n == 0)
  88. return;
  89. for (size_t idx = 0; idx != (features->src_n - features->diff_n); idx++) {
  90. size_t high = (features->src_n - 1) - idx;
  91. size_t low = high - features->diff_n;
  92. features->dst[low] = features->src[high] - features->src[low];
  93. }
  94. size_t n = features->src_n - features->diff_n;
  95. memcpy(features->src, features->dst, n * sizeof(calculated_number_t));
  96. for (size_t idx = features->src_n - features->diff_n; idx != features->src_n; idx++)
  97. features->src[idx] = 0.0;
  98. }
  99. // a function that computes the window average of an array inplace
  100. static void
  101. ml_features_smooth(ml_features_t *features)
  102. {
  103. calculated_number_t sum = 0.0;
  104. size_t idx = 0;
  105. for (; idx != features->smooth_n - 1; idx++)
  106. sum += features->src[idx];
  107. for (; idx != (features->src_n - features->diff_n); idx++) {
  108. sum += features->src[idx];
  109. calculated_number_t prev_cn = features->src[idx - (features->smooth_n - 1)];
  110. features->src[idx - (features->smooth_n - 1)] = sum / features->smooth_n;
  111. sum -= prev_cn;
  112. }
  113. for (idx = 0; idx != features->smooth_n; idx++)
  114. features->src[(features->src_n - 1) - idx] = 0.0;
  115. }
  116. // create lag'd vectors out of the preprocessed buffer
  117. static void
  118. ml_features_lag(ml_features_t *features)
  119. {
  120. size_t n = features->src_n - features->diff_n - features->smooth_n + 1 - features->lag_n;
  121. features->preprocessed_features.resize(n);
  122. unsigned target_num_samples = Cfg.max_train_samples * Cfg.random_sampling_ratio;
  123. double sampling_ratio = std::min(static_cast<double>(target_num_samples) / n, 1.0);
  124. uint32_t max_mt = std::numeric_limits<uint32_t>::max();
  125. uint32_t cutoff = static_cast<double>(max_mt) * sampling_ratio;
  126. size_t sample_idx = 0;
  127. for (size_t idx = 0; idx != n; idx++) {
  128. DSample &DS = features->preprocessed_features[sample_idx++];
  129. DS.set_size(features->lag_n);
  130. if (Cfg.random_nums[idx] > cutoff) {
  131. sample_idx--;
  132. continue;
  133. }
  134. for (size_t feature_idx = 0; feature_idx != features->lag_n + 1; feature_idx++)
  135. DS(feature_idx) = features->src[idx + feature_idx];
  136. }
  137. features->preprocessed_features.resize(sample_idx);
  138. }
  139. static void
  140. ml_features_preprocess(ml_features_t *features)
  141. {
  142. ml_features_diff(features);
  143. ml_features_smooth(features);
  144. ml_features_lag(features);
  145. }
  146. /*
  147. * KMeans
  148. */
  149. static void
  150. ml_kmeans_init(ml_kmeans_t *kmeans)
  151. {
  152. kmeans->cluster_centers.reserve(2);
  153. kmeans->min_dist = std::numeric_limits<calculated_number_t>::max();
  154. kmeans->max_dist = std::numeric_limits<calculated_number_t>::min();
  155. }
  156. static void
  157. ml_kmeans_train(ml_kmeans_t *kmeans, const ml_features_t *features, time_t after, time_t before)
  158. {
  159. kmeans->after = (uint32_t) after;
  160. kmeans->before = (uint32_t) before;
  161. kmeans->min_dist = std::numeric_limits<calculated_number_t>::max();
  162. kmeans->max_dist = std::numeric_limits<calculated_number_t>::min();
  163. kmeans->cluster_centers.clear();
  164. dlib::pick_initial_centers(2, kmeans->cluster_centers, features->preprocessed_features);
  165. dlib::find_clusters_using_kmeans(features->preprocessed_features, kmeans->cluster_centers, Cfg.max_kmeans_iters);
  166. for (const auto &preprocessed_feature : features->preprocessed_features) {
  167. calculated_number_t mean_dist = 0.0;
  168. for (const auto &cluster_center : kmeans->cluster_centers) {
  169. mean_dist += dlib::length(cluster_center - preprocessed_feature);
  170. }
  171. mean_dist /= kmeans->cluster_centers.size();
  172. if (mean_dist < kmeans->min_dist)
  173. kmeans->min_dist = mean_dist;
  174. if (mean_dist > kmeans->max_dist)
  175. kmeans->max_dist = mean_dist;
  176. }
  177. }
  178. static calculated_number_t
  179. ml_kmeans_anomaly_score(const ml_kmeans_t *kmeans, const DSample &DS)
  180. {
  181. calculated_number_t mean_dist = 0.0;
  182. for (const auto &CC: kmeans->cluster_centers)
  183. mean_dist += dlib::length(CC - DS);
  184. mean_dist /= kmeans->cluster_centers.size();
  185. if (kmeans->max_dist == kmeans->min_dist)
  186. return 0.0;
  187. calculated_number_t anomaly_score = 100.0 * std::abs((mean_dist - kmeans->min_dist) / (kmeans->max_dist - kmeans->min_dist));
  188. return (anomaly_score > 100.0) ? 100.0 : anomaly_score;
  189. }
  190. /*
  191. * Queue
  192. */
  193. static ml_queue_t *
  194. ml_queue_init()
  195. {
  196. ml_queue_t *q = new ml_queue_t();
  197. netdata_mutex_init(&q->mutex);
  198. pthread_cond_init(&q->cond_var, NULL);
  199. q->exit = false;
  200. return q;
  201. }
  202. static void
  203. ml_queue_destroy(ml_queue_t *q)
  204. {
  205. netdata_mutex_destroy(&q->mutex);
  206. pthread_cond_destroy(&q->cond_var);
  207. delete q;
  208. }
  209. static void
  210. ml_queue_push(ml_queue_t *q, const ml_training_request_t req)
  211. {
  212. netdata_mutex_lock(&q->mutex);
  213. q->internal.push(req);
  214. pthread_cond_signal(&q->cond_var);
  215. netdata_mutex_unlock(&q->mutex);
  216. }
  217. static ml_training_request_t
  218. ml_queue_pop(ml_queue_t *q)
  219. {
  220. netdata_mutex_lock(&q->mutex);
  221. ml_training_request_t req = {
  222. {'\0'}, // machine_guid
  223. NULL, // chart id
  224. NULL, // dimension id
  225. 0, // current time
  226. 0, // first entry
  227. 0 // last entry
  228. };
  229. while (q->internal.empty()) {
  230. pthread_cond_wait(&q->cond_var, &q->mutex);
  231. if (q->exit) {
  232. netdata_mutex_unlock(&q->mutex);
  233. // We return a dummy request because the queue has been signaled
  234. return req;
  235. }
  236. }
  237. req = q->internal.front();
  238. q->internal.pop();
  239. netdata_mutex_unlock(&q->mutex);
  240. return req;
  241. }
  242. static size_t
  243. ml_queue_size(ml_queue_t *q)
  244. {
  245. netdata_mutex_lock(&q->mutex);
  246. size_t size = q->internal.size();
  247. netdata_mutex_unlock(&q->mutex);
  248. return size;
  249. }
  250. static void
  251. ml_queue_signal(ml_queue_t *q)
  252. {
  253. netdata_mutex_lock(&q->mutex);
  254. q->exit = true;
  255. pthread_cond_signal(&q->cond_var);
  256. netdata_mutex_unlock(&q->mutex);
  257. }
  258. /*
  259. * Dimension
  260. */
  261. static std::pair<calculated_number_t *, ml_training_response_t>
  262. ml_dimension_calculated_numbers(ml_training_thread_t *training_thread, ml_dimension_t *dim, const ml_training_request_t &training_request)
  263. {
  264. ml_training_response_t training_response = {};
  265. training_response.request_time = training_request.request_time;
  266. training_response.first_entry_on_request = training_request.first_entry_on_request;
  267. training_response.last_entry_on_request = training_request.last_entry_on_request;
  268. training_response.first_entry_on_response = rrddim_first_entry_s_of_tier(dim->rd, 0);
  269. training_response.last_entry_on_response = rrddim_last_entry_s_of_tier(dim->rd, 0);
  270. size_t min_n = Cfg.min_train_samples;
  271. size_t max_n = Cfg.max_train_samples;
  272. // Figure out what our time window should be.
  273. training_response.query_before_t = training_response.last_entry_on_response;
  274. training_response.query_after_t = std::max(
  275. training_response.query_before_t - static_cast<time_t>((max_n - 1) * dim->rd->rrdset->update_every),
  276. training_response.first_entry_on_response
  277. );
  278. if (training_response.query_after_t >= training_response.query_before_t) {
  279. training_response.result = TRAINING_RESULT_INVALID_QUERY_TIME_RANGE;
  280. return { NULL, training_response };
  281. }
  282. if (rrdset_is_replicating(dim->rd->rrdset)) {
  283. training_response.result = TRAINING_RESULT_CHART_UNDER_REPLICATION;
  284. return { NULL, training_response };
  285. }
  286. /*
  287. * Execute the query
  288. */
  289. struct storage_engine_query_handle handle;
  290. storage_engine_query_init(dim->rd->tiers[0].backend, dim->rd->tiers[0].db_metric_handle, &handle,
  291. training_response.query_after_t, training_response.query_before_t,
  292. STORAGE_PRIORITY_BEST_EFFORT);
  293. size_t idx = 0;
  294. memset(training_thread->training_cns, 0, sizeof(calculated_number_t) * max_n * (Cfg.lag_n + 1));
  295. calculated_number_t last_value = std::numeric_limits<calculated_number_t>::quiet_NaN();
  296. while (!storage_engine_query_is_finished(&handle)) {
  297. if (idx == max_n)
  298. break;
  299. STORAGE_POINT sp = storage_engine_query_next_metric(&handle);
  300. time_t timestamp = sp.end_time_s;
  301. calculated_number_t value = sp.sum / sp.count;
  302. if (netdata_double_isnumber(value)) {
  303. if (!training_response.db_after_t)
  304. training_response.db_after_t = timestamp;
  305. training_response.db_before_t = timestamp;
  306. training_thread->training_cns[idx] = value;
  307. last_value = training_thread->training_cns[idx];
  308. training_response.collected_values++;
  309. } else
  310. training_thread->training_cns[idx] = last_value;
  311. idx++;
  312. }
  313. storage_engine_query_finalize(&handle);
  314. global_statistics_ml_query_completed(/* points_read */ idx);
  315. training_response.total_values = idx;
  316. if (training_response.collected_values < min_n) {
  317. training_response.result = TRAINING_RESULT_NOT_ENOUGH_COLLECTED_VALUES;
  318. return { NULL, training_response };
  319. }
  320. // Find first non-NaN value.
  321. for (idx = 0; std::isnan(training_thread->training_cns[idx]); idx++, training_response.total_values--) { }
  322. // Overwrite NaN values.
  323. if (idx != 0)
  324. memmove(training_thread->training_cns, &training_thread->training_cns[idx], sizeof(calculated_number_t) * training_response.total_values);
  325. training_response.result = TRAINING_RESULT_OK;
  326. return { training_thread->training_cns, training_response };
  327. }
  328. const char *db_models_create_table =
  329. "CREATE TABLE IF NOT EXISTS models("
  330. " dim_id BLOB, after INT, before INT,"
  331. " min_dist REAL, max_dist REAL,"
  332. " c00 REAL, c01 REAL, c02 REAL, c03 REAL, c04 REAL, c05 REAL,"
  333. " c10 REAL, c11 REAL, c12 REAL, c13 REAL, c14 REAL, c15 REAL,"
  334. " PRIMARY KEY(dim_id, after)"
  335. ");";
  336. const char *db_models_add_model =
  337. "INSERT OR REPLACE INTO models("
  338. " dim_id, after, before,"
  339. " min_dist, max_dist,"
  340. " c00, c01, c02, c03, c04, c05,"
  341. " c10, c11, c12, c13, c14, c15)"
  342. "VALUES("
  343. " @dim_id, @after, @before,"
  344. " @min_dist, @max_dist,"
  345. " @c00, @c01, @c02, @c03, @c04, @c05,"
  346. " @c10, @c11, @c12, @c13, @c14, @c15);";
  347. const char *db_models_load =
  348. "SELECT * FROM models "
  349. "WHERE dim_id = @dim_id AND after >= @after ORDER BY before ASC;";
  350. const char *db_models_delete =
  351. "DELETE FROM models "
  352. "WHERE dim_id = @dim_id AND before < @before;";
  353. static int
  354. ml_dimension_add_model(const uuid_t *metric_uuid, const ml_kmeans_t *km)
  355. {
  356. static __thread sqlite3_stmt *res = NULL;
  357. int param = 0;
  358. int rc = 0;
  359. if (unlikely(!db)) {
  360. error_report("Database has not been initialized");
  361. return 1;
  362. }
  363. if (unlikely(!res)) {
  364. rc = prepare_statement(db, db_models_add_model, &res);
  365. if (unlikely(rc != SQLITE_OK)) {
  366. error_report("Failed to prepare statement to store model, rc = %d", rc);
  367. return 1;
  368. }
  369. }
  370. rc = sqlite3_bind_blob(res, ++param, metric_uuid, sizeof(*metric_uuid), SQLITE_STATIC);
  371. if (unlikely(rc != SQLITE_OK))
  372. goto bind_fail;
  373. rc = sqlite3_bind_int(res, ++param, (int) km->after);
  374. if (unlikely(rc != SQLITE_OK))
  375. goto bind_fail;
  376. rc = sqlite3_bind_int(res, ++param, (int) km->before);
  377. if (unlikely(rc != SQLITE_OK))
  378. goto bind_fail;
  379. rc = sqlite3_bind_double(res, ++param, km->min_dist);
  380. if (unlikely(rc != SQLITE_OK))
  381. goto bind_fail;
  382. rc = sqlite3_bind_double(res, ++param, km->max_dist);
  383. if (unlikely(rc != SQLITE_OK))
  384. goto bind_fail;
  385. if (km->cluster_centers.size() != 2)
  386. fatal("Expected 2 cluster centers, got %zu", km->cluster_centers.size());
  387. for (const DSample &ds : km->cluster_centers) {
  388. if (ds.size() != 6)
  389. fatal("Expected dsample with 6 dimensions, got %ld", ds.size());
  390. for (long idx = 0; idx != ds.size(); idx++) {
  391. calculated_number_t cn = ds(idx);
  392. int rc = sqlite3_bind_double(res, ++param, cn);
  393. if (unlikely(rc != SQLITE_OK))
  394. goto bind_fail;
  395. }
  396. }
  397. rc = execute_insert(res);
  398. if (unlikely(rc != SQLITE_DONE)) {
  399. error_report("Failed to store model, rc = %d", rc);
  400. return rc;
  401. }
  402. rc = sqlite3_reset(res);
  403. if (unlikely(rc != SQLITE_OK)) {
  404. error_report("Failed to reset statement when storing model, rc = %d", rc);
  405. return rc;
  406. }
  407. return 0;
  408. bind_fail:
  409. error_report("Failed to bind parameter %d to store model, rc = %d", param, rc);
  410. rc = sqlite3_reset(res);
  411. if (unlikely(rc != SQLITE_OK))
  412. error_report("Failed to reset statement to store model, rc = %d", rc);
  413. return rc;
  414. }
  415. static int
  416. ml_dimension_delete_models(const uuid_t *metric_uuid, time_t before)
  417. {
  418. static __thread sqlite3_stmt *res = NULL;
  419. int rc = 0;
  420. int param = 0;
  421. if (unlikely(!db)) {
  422. error_report("Database has not been initialized");
  423. return 1;
  424. }
  425. if (unlikely(!res)) {
  426. rc = prepare_statement(db, db_models_delete, &res);
  427. if (unlikely(rc != SQLITE_OK)) {
  428. error_report("Failed to prepare statement to delete models, rc = %d", rc);
  429. return rc;
  430. }
  431. }
  432. rc = sqlite3_bind_blob(res, ++param, metric_uuid, sizeof(*metric_uuid), SQLITE_STATIC);
  433. if (unlikely(rc != SQLITE_OK))
  434. goto bind_fail;
  435. rc = sqlite3_bind_int(res, ++param, (int) before);
  436. if (unlikely(rc != SQLITE_OK))
  437. goto bind_fail;
  438. rc = execute_insert(res);
  439. if (unlikely(rc != SQLITE_DONE)) {
  440. error_report("Failed to delete models, rc = %d", rc);
  441. return rc;
  442. }
  443. rc = sqlite3_reset(res);
  444. if (unlikely(rc != SQLITE_OK)) {
  445. error_report("Failed to reset statement when deleting models, rc = %d", rc);
  446. return rc;
  447. }
  448. return 0;
  449. bind_fail:
  450. error_report("Failed to bind parameter %d to delete models, rc = %d", param, rc);
  451. rc = sqlite3_reset(res);
  452. if (unlikely(rc != SQLITE_OK))
  453. error_report("Failed to reset statement to delete models, rc = %d", rc);
  454. return rc;
  455. }
  456. int ml_dimension_load_models(RRDDIM *rd) {
  457. ml_dimension_t *dim = (ml_dimension_t *) rd->ml_dimension;
  458. if (!dim)
  459. return 0;
  460. spinlock_lock(&dim->slock);
  461. bool is_empty = dim->km_contexts.empty();
  462. spinlock_unlock(&dim->slock);
  463. if (!is_empty)
  464. return 0;
  465. std::vector<ml_kmeans_t> V;
  466. static __thread sqlite3_stmt *res = NULL;
  467. int rc = 0;
  468. int param = 0;
  469. if (unlikely(!db)) {
  470. error_report("Database has not been initialized");
  471. return 1;
  472. }
  473. if (unlikely(!res)) {
  474. rc = prepare_statement(db, db_models_load, &res);
  475. if (unlikely(rc != SQLITE_OK)) {
  476. error_report("Failed to prepare statement to load models, rc = %d", rc);
  477. return 1;
  478. }
  479. }
  480. rc = sqlite3_bind_blob(res, ++param, &dim->rd->metric_uuid, sizeof(dim->rd->metric_uuid), SQLITE_STATIC);
  481. if (unlikely(rc != SQLITE_OK))
  482. goto bind_fail;
  483. rc = sqlite3_bind_int(res, ++param, now_realtime_usec() - (Cfg.num_models_to_use * Cfg.max_train_samples));
  484. if (unlikely(rc != SQLITE_OK))
  485. goto bind_fail;
  486. spinlock_lock(&dim->slock);
  487. dim->km_contexts.reserve(Cfg.num_models_to_use);
  488. while ((rc = sqlite3_step_monitored(res)) == SQLITE_ROW) {
  489. ml_kmeans_t km;
  490. km.after = sqlite3_column_int(res, 2);
  491. km.before = sqlite3_column_int(res, 3);
  492. km.min_dist = sqlite3_column_int(res, 4);
  493. km.max_dist = sqlite3_column_int(res, 5);
  494. km.cluster_centers.resize(2);
  495. km.cluster_centers[0].set_size(Cfg.lag_n + 1);
  496. km.cluster_centers[0](0) = sqlite3_column_double(res, 6);
  497. km.cluster_centers[0](1) = sqlite3_column_double(res, 7);
  498. km.cluster_centers[0](2) = sqlite3_column_double(res, 8);
  499. km.cluster_centers[0](3) = sqlite3_column_double(res, 9);
  500. km.cluster_centers[0](4) = sqlite3_column_double(res, 10);
  501. km.cluster_centers[0](5) = sqlite3_column_double(res, 11);
  502. km.cluster_centers[1].set_size(Cfg.lag_n + 1);
  503. km.cluster_centers[1](0) = sqlite3_column_double(res, 12);
  504. km.cluster_centers[1](1) = sqlite3_column_double(res, 13);
  505. km.cluster_centers[1](2) = sqlite3_column_double(res, 14);
  506. km.cluster_centers[1](3) = sqlite3_column_double(res, 15);
  507. km.cluster_centers[1](4) = sqlite3_column_double(res, 16);
  508. km.cluster_centers[1](5) = sqlite3_column_double(res, 17);
  509. dim->km_contexts.push_back(km);
  510. }
  511. if (!dim->km_contexts.empty()) {
  512. dim->ts = TRAINING_STATUS_TRAINED;
  513. }
  514. spinlock_unlock(&dim->slock);
  515. if (unlikely(rc != SQLITE_DONE))
  516. error_report("Failed to load models, rc = %d", rc);
  517. rc = sqlite3_reset(res);
  518. if (unlikely(rc != SQLITE_OK))
  519. error_report("Failed to reset statement when loading models, rc = %d", rc);
  520. return 0;
  521. bind_fail:
  522. error_report("Failed to bind parameter %d to load models, rc = %d", param, rc);
  523. rc = sqlite3_reset(res);
  524. if (unlikely(rc != SQLITE_OK))
  525. error_report("Failed to reset statement to load models, rc = %d", rc);
  526. return 1;
  527. }
  528. static enum ml_training_result
  529. ml_dimension_train_model(ml_training_thread_t *training_thread, ml_dimension_t *dim, const ml_training_request_t &training_request)
  530. {
  531. worker_is_busy(WORKER_TRAIN_QUERY);
  532. auto P = ml_dimension_calculated_numbers(training_thread, dim, training_request);
  533. ml_training_response_t training_response = P.second;
  534. if (training_response.result != TRAINING_RESULT_OK) {
  535. spinlock_lock(&dim->slock);
  536. dim->mt = METRIC_TYPE_CONSTANT;
  537. switch (dim->ts) {
  538. case TRAINING_STATUS_PENDING_WITH_MODEL:
  539. dim->ts = TRAINING_STATUS_TRAINED;
  540. break;
  541. case TRAINING_STATUS_PENDING_WITHOUT_MODEL:
  542. dim->ts = TRAINING_STATUS_UNTRAINED;
  543. break;
  544. default:
  545. break;
  546. }
  547. dim->suppression_anomaly_counter = 0;
  548. dim->suppression_window_counter = 0;
  549. dim->tr = training_response;
  550. dim->last_training_time = training_response.last_entry_on_response;
  551. enum ml_training_result result = training_response.result;
  552. spinlock_unlock(&dim->slock);
  553. return result;
  554. }
  555. // compute kmeans
  556. worker_is_busy(WORKER_TRAIN_KMEANS);
  557. {
  558. memcpy(training_thread->scratch_training_cns, training_thread->training_cns,
  559. training_response.total_values * sizeof(calculated_number_t));
  560. ml_features_t features = {
  561. Cfg.diff_n, Cfg.smooth_n, Cfg.lag_n,
  562. training_thread->scratch_training_cns, training_response.total_values,
  563. training_thread->training_cns, training_response.total_values,
  564. training_thread->training_samples
  565. };
  566. ml_features_preprocess(&features);
  567. ml_kmeans_init(&dim->kmeans);
  568. ml_kmeans_train(&dim->kmeans, &features, training_response.query_after_t, training_response.query_before_t);
  569. }
  570. // update models
  571. worker_is_busy(WORKER_TRAIN_UPDATE_MODELS);
  572. {
  573. spinlock_lock(&dim->slock);
  574. if (dim->km_contexts.size() < Cfg.num_models_to_use) {
  575. dim->km_contexts.push_back(std::move(dim->kmeans));
  576. } else {
  577. bool can_drop_middle_km = false;
  578. if (Cfg.num_models_to_use > 2) {
  579. const ml_kmeans_t *old_km = &dim->km_contexts[dim->km_contexts.size() - 1];
  580. const ml_kmeans_t *middle_km = &dim->km_contexts[dim->km_contexts.size() - 2];
  581. const ml_kmeans_t *new_km = &dim->kmeans;
  582. can_drop_middle_km = (middle_km->after < old_km->before) &&
  583. (middle_km->before > new_km->after);
  584. }
  585. if (can_drop_middle_km) {
  586. dim->km_contexts.back() = dim->kmeans;
  587. } else {
  588. std::rotate(std::begin(dim->km_contexts), std::begin(dim->km_contexts) + 1, std::end(dim->km_contexts));
  589. dim->km_contexts[dim->km_contexts.size() - 1] = std::move(dim->kmeans);
  590. }
  591. }
  592. dim->mt = METRIC_TYPE_CONSTANT;
  593. dim->ts = TRAINING_STATUS_TRAINED;
  594. dim->suppression_anomaly_counter = 0;
  595. dim->suppression_window_counter = 0;
  596. dim->tr = training_response;
  597. dim->last_training_time = rrddim_last_entry_s(dim->rd);
  598. // Add the newly generated model to the list of pending models to flush
  599. ml_model_info_t model_info;
  600. uuid_copy(model_info.metric_uuid, dim->rd->metric_uuid);
  601. model_info.kmeans = dim->km_contexts.back();
  602. training_thread->pending_model_info.push_back(model_info);
  603. spinlock_unlock(&dim->slock);
  604. }
  605. return training_response.result;
  606. }
  607. static void
  608. ml_dimension_schedule_for_training(ml_dimension_t *dim, time_t curr_time)
  609. {
  610. switch (dim->mt) {
  611. case METRIC_TYPE_CONSTANT:
  612. return;
  613. default:
  614. break;
  615. }
  616. bool schedule_for_training = false;
  617. switch (dim->ts) {
  618. case TRAINING_STATUS_PENDING_WITH_MODEL:
  619. case TRAINING_STATUS_PENDING_WITHOUT_MODEL:
  620. schedule_for_training = false;
  621. break;
  622. case TRAINING_STATUS_UNTRAINED:
  623. schedule_for_training = true;
  624. dim->ts = TRAINING_STATUS_PENDING_WITHOUT_MODEL;
  625. break;
  626. case TRAINING_STATUS_SILENCED:
  627. case TRAINING_STATUS_TRAINED:
  628. if ((dim->last_training_time + (Cfg.train_every * dim->rd->rrdset->update_every)) < curr_time) {
  629. schedule_for_training = true;
  630. dim->ts = TRAINING_STATUS_PENDING_WITH_MODEL;
  631. }
  632. break;
  633. }
  634. if (schedule_for_training) {
  635. ml_training_request_t req;
  636. memcpy(req.machine_guid, dim->rd->rrdset->rrdhost->machine_guid, GUID_LEN + 1);
  637. req.chart_id = string_dup(dim->rd->rrdset->id);
  638. req.dimension_id = string_dup(dim->rd->id);
  639. req.request_time = curr_time;
  640. req.first_entry_on_request = rrddim_first_entry_s(dim->rd);
  641. req.last_entry_on_request = rrddim_last_entry_s(dim->rd);
  642. ml_host_t *host = (ml_host_t *) dim->rd->rrdset->rrdhost->ml_host;
  643. ml_queue_push(host->training_queue, req);
  644. }
  645. }
  646. static bool
  647. ml_dimension_predict(ml_dimension_t *dim, time_t curr_time, calculated_number_t value, bool exists)
  648. {
  649. // Nothing to do if ML is disabled for this dimension
  650. if (dim->mls != MACHINE_LEARNING_STATUS_ENABLED)
  651. return false;
  652. // Don't treat values that don't exist as anomalous
  653. if (!exists) {
  654. dim->cns.clear();
  655. return false;
  656. }
  657. // Save the value and return if we don't have enough values for a sample
  658. unsigned n = Cfg.diff_n + Cfg.smooth_n + Cfg.lag_n;
  659. if (dim->cns.size() < n) {
  660. dim->cns.push_back(value);
  661. return false;
  662. }
  663. // Push the value and check if it's different from the last one
  664. bool same_value = true;
  665. std::rotate(std::begin(dim->cns), std::begin(dim->cns) + 1, std::end(dim->cns));
  666. if (dim->cns[n - 1] != value)
  667. same_value = false;
  668. dim->cns[n - 1] = value;
  669. // Create the sample
  670. assert((n * (Cfg.lag_n + 1) <= 128) &&
  671. "Static buffers too small to perform prediction. "
  672. "This should not be possible with the default clamping of feature extraction options");
  673. calculated_number_t src_cns[128];
  674. calculated_number_t dst_cns[128];
  675. memset(src_cns, 0, n * (Cfg.lag_n + 1) * sizeof(calculated_number_t));
  676. memcpy(src_cns, dim->cns.data(), n * sizeof(calculated_number_t));
  677. memcpy(dst_cns, dim->cns.data(), n * sizeof(calculated_number_t));
  678. ml_features_t features = {
  679. Cfg.diff_n, Cfg.smooth_n, Cfg.lag_n,
  680. dst_cns, n, src_cns, n,
  681. dim->feature
  682. };
  683. ml_features_preprocess(&features);
  684. /*
  685. * Lock to predict and possibly schedule the dimension for training
  686. */
  687. if (spinlock_trylock(&dim->slock) == 0)
  688. return false;
  689. // Mark the metric time as variable if we received different values
  690. if (!same_value)
  691. dim->mt = METRIC_TYPE_VARIABLE;
  692. // Decide if the dimension needs to be scheduled for training
  693. ml_dimension_schedule_for_training(dim, curr_time);
  694. // Nothing to do if we don't have a model
  695. switch (dim->ts) {
  696. case TRAINING_STATUS_UNTRAINED:
  697. case TRAINING_STATUS_PENDING_WITHOUT_MODEL: {
  698. case TRAINING_STATUS_SILENCED:
  699. spinlock_unlock(&dim->slock);
  700. return false;
  701. }
  702. default:
  703. break;
  704. }
  705. dim->suppression_window_counter++;
  706. /*
  707. * Use the KMeans models to check if the value is anomalous
  708. */
  709. size_t sum = 0;
  710. size_t models_consulted = 0;
  711. for (const auto &km_ctx : dim->km_contexts) {
  712. models_consulted++;
  713. calculated_number_t anomaly_score = ml_kmeans_anomaly_score(&km_ctx, features.preprocessed_features[0]);
  714. if (anomaly_score == std::numeric_limits<calculated_number_t>::quiet_NaN())
  715. continue;
  716. if (anomaly_score < (100 * Cfg.dimension_anomaly_score_threshold)) {
  717. global_statistics_ml_models_consulted(models_consulted);
  718. spinlock_unlock(&dim->slock);
  719. return false;
  720. }
  721. sum += 1;
  722. }
  723. dim->suppression_anomaly_counter += sum ? 1 : 0;
  724. if ((dim->suppression_anomaly_counter >= Cfg.suppression_threshold) &&
  725. (dim->suppression_window_counter >= Cfg.suppression_window)) {
  726. dim->ts = TRAINING_STATUS_SILENCED;
  727. }
  728. spinlock_unlock(&dim->slock);
  729. global_statistics_ml_models_consulted(models_consulted);
  730. return sum;
  731. }
  732. /*
  733. * Chart
  734. */
  735. static bool
  736. ml_chart_is_available_for_ml(ml_chart_t *chart)
  737. {
  738. return rrdset_is_available_for_exporting_and_alarms(chart->rs);
  739. }
  740. void
  741. ml_chart_update_dimension(ml_chart_t *chart, ml_dimension_t *dim, bool is_anomalous)
  742. {
  743. switch (dim->mls) {
  744. case MACHINE_LEARNING_STATUS_DISABLED_DUE_TO_EXCLUDED_CHART:
  745. chart->mls.num_machine_learning_status_disabled_sp++;
  746. return;
  747. case MACHINE_LEARNING_STATUS_ENABLED: {
  748. chart->mls.num_machine_learning_status_enabled++;
  749. switch (dim->mt) {
  750. case METRIC_TYPE_CONSTANT:
  751. chart->mls.num_metric_type_constant++;
  752. chart->mls.num_training_status_trained++;
  753. chart->mls.num_normal_dimensions++;
  754. return;
  755. case METRIC_TYPE_VARIABLE:
  756. chart->mls.num_metric_type_variable++;
  757. break;
  758. }
  759. switch (dim->ts) {
  760. case TRAINING_STATUS_UNTRAINED:
  761. chart->mls.num_training_status_untrained++;
  762. return;
  763. case TRAINING_STATUS_PENDING_WITHOUT_MODEL:
  764. chart->mls.num_training_status_pending_without_model++;
  765. return;
  766. case TRAINING_STATUS_TRAINED:
  767. chart->mls.num_training_status_trained++;
  768. chart->mls.num_anomalous_dimensions += is_anomalous;
  769. chart->mls.num_normal_dimensions += !is_anomalous;
  770. return;
  771. case TRAINING_STATUS_PENDING_WITH_MODEL:
  772. chart->mls.num_training_status_pending_with_model++;
  773. chart->mls.num_anomalous_dimensions += is_anomalous;
  774. chart->mls.num_normal_dimensions += !is_anomalous;
  775. return;
  776. case TRAINING_STATUS_SILENCED:
  777. chart->mls.num_training_status_silenced++;
  778. chart->mls.num_training_status_trained++;
  779. chart->mls.num_anomalous_dimensions += is_anomalous;
  780. chart->mls.num_normal_dimensions += !is_anomalous;
  781. return;
  782. }
  783. return;
  784. }
  785. }
  786. }
  787. /*
  788. * Host detection & training functions
  789. */
  790. #define WORKER_JOB_DETECTION_COLLECT_STATS 0
  791. #define WORKER_JOB_DETECTION_DIM_CHART 1
  792. #define WORKER_JOB_DETECTION_HOST_CHART 2
  793. #define WORKER_JOB_DETECTION_STATS 3
  794. static void
  795. ml_host_detect_once(ml_host_t *host)
  796. {
  797. worker_is_busy(WORKER_JOB_DETECTION_COLLECT_STATS);
  798. host->mls = {};
  799. ml_machine_learning_stats_t mls_copy = {};
  800. if (host->ml_running) {
  801. netdata_mutex_lock(&host->mutex);
  802. /*
  803. * prediction/detection stats
  804. */
  805. void *rsp = NULL;
  806. rrdset_foreach_read(rsp, host->rh) {
  807. RRDSET *rs = static_cast<RRDSET *>(rsp);
  808. ml_chart_t *chart = (ml_chart_t *) rs->ml_chart;
  809. if (!chart)
  810. continue;
  811. if (!ml_chart_is_available_for_ml(chart))
  812. continue;
  813. ml_machine_learning_stats_t chart_mls = chart->mls;
  814. host->mls.num_machine_learning_status_enabled += chart_mls.num_machine_learning_status_enabled;
  815. host->mls.num_machine_learning_status_disabled_sp += chart_mls.num_machine_learning_status_disabled_sp;
  816. host->mls.num_metric_type_constant += chart_mls.num_metric_type_constant;
  817. host->mls.num_metric_type_variable += chart_mls.num_metric_type_variable;
  818. host->mls.num_training_status_untrained += chart_mls.num_training_status_untrained;
  819. host->mls.num_training_status_pending_without_model += chart_mls.num_training_status_pending_without_model;
  820. host->mls.num_training_status_trained += chart_mls.num_training_status_trained;
  821. host->mls.num_training_status_pending_with_model += chart_mls.num_training_status_pending_with_model;
  822. host->mls.num_training_status_silenced += chart_mls.num_training_status_silenced;
  823. host->mls.num_anomalous_dimensions += chart_mls.num_anomalous_dimensions;
  824. host->mls.num_normal_dimensions += chart_mls.num_normal_dimensions;
  825. }
  826. rrdset_foreach_done(rsp);
  827. host->host_anomaly_rate = 0.0;
  828. size_t NumActiveDimensions = host->mls.num_anomalous_dimensions + host->mls.num_normal_dimensions;
  829. if (NumActiveDimensions)
  830. host->host_anomaly_rate = static_cast<double>(host->mls.num_anomalous_dimensions) / NumActiveDimensions;
  831. mls_copy = host->mls;
  832. netdata_mutex_unlock(&host->mutex);
  833. } else {
  834. host->host_anomaly_rate = 0.0;
  835. }
  836. worker_is_busy(WORKER_JOB_DETECTION_DIM_CHART);
  837. ml_update_dimensions_chart(host, mls_copy);
  838. worker_is_busy(WORKER_JOB_DETECTION_HOST_CHART);
  839. ml_update_host_and_detection_rate_charts(host, host->host_anomaly_rate * 10000.0);
  840. }
  841. typedef struct {
  842. RRDHOST_ACQUIRED *acq_rh;
  843. RRDSET_ACQUIRED *acq_rs;
  844. RRDDIM_ACQUIRED *acq_rd;
  845. ml_dimension_t *dim;
  846. } ml_acquired_dimension_t;
  847. static ml_acquired_dimension_t
  848. ml_acquired_dimension_get(char *machine_guid, STRING *chart_id, STRING *dimension_id)
  849. {
  850. RRDHOST_ACQUIRED *acq_rh = NULL;
  851. RRDSET_ACQUIRED *acq_rs = NULL;
  852. RRDDIM_ACQUIRED *acq_rd = NULL;
  853. ml_dimension_t *dim = NULL;
  854. rrd_rdlock();
  855. acq_rh = rrdhost_find_and_acquire(machine_guid);
  856. if (acq_rh) {
  857. RRDHOST *rh = rrdhost_acquired_to_rrdhost(acq_rh);
  858. if (rh && !rrdhost_flag_check(rh, RRDHOST_FLAG_ORPHAN | RRDHOST_FLAG_ARCHIVED)) {
  859. acq_rs = rrdset_find_and_acquire(rh, string2str(chart_id));
  860. if (acq_rs) {
  861. RRDSET *rs = rrdset_acquired_to_rrdset(acq_rs);
  862. if (rs && !rrdset_flag_check(rs, RRDSET_FLAG_ARCHIVED | RRDSET_FLAG_OBSOLETE)) {
  863. acq_rd = rrddim_find_and_acquire(rs, string2str(dimension_id));
  864. if (acq_rd) {
  865. RRDDIM *rd = rrddim_acquired_to_rrddim(acq_rd);
  866. if (rd)
  867. dim = (ml_dimension_t *) rd->ml_dimension;
  868. }
  869. }
  870. }
  871. }
  872. }
  873. rrd_unlock();
  874. ml_acquired_dimension_t acq_dim = {
  875. acq_rh, acq_rs, acq_rd, dim
  876. };
  877. return acq_dim;
  878. }
  879. static void
  880. ml_acquired_dimension_release(ml_acquired_dimension_t acq_dim)
  881. {
  882. if (acq_dim.acq_rd)
  883. rrddim_acquired_release(acq_dim.acq_rd);
  884. if (acq_dim.acq_rs)
  885. rrdset_acquired_release(acq_dim.acq_rs);
  886. if (acq_dim.acq_rh)
  887. rrdhost_acquired_release(acq_dim.acq_rh);
  888. }
  889. static enum ml_training_result
  890. ml_acquired_dimension_train(ml_training_thread_t *training_thread, ml_acquired_dimension_t acq_dim, const ml_training_request_t &tr)
  891. {
  892. if (!acq_dim.dim)
  893. return TRAINING_RESULT_NULL_ACQUIRED_DIMENSION;
  894. return ml_dimension_train_model(training_thread, acq_dim.dim, tr);
  895. }
  896. static void *
  897. ml_detect_main(void *arg)
  898. {
  899. UNUSED(arg);
  900. worker_register("MLDETECT");
  901. worker_register_job_name(WORKER_JOB_DETECTION_COLLECT_STATS, "collect stats");
  902. worker_register_job_name(WORKER_JOB_DETECTION_DIM_CHART, "dim chart");
  903. worker_register_job_name(WORKER_JOB_DETECTION_HOST_CHART, "host chart");
  904. worker_register_job_name(WORKER_JOB_DETECTION_STATS, "training stats");
  905. heartbeat_t hb;
  906. heartbeat_init(&hb);
  907. while (!Cfg.detection_stop) {
  908. worker_is_idle();
  909. heartbeat_next(&hb, USEC_PER_SEC);
  910. RRDHOST *rh;
  911. rrd_rdlock();
  912. rrdhost_foreach_read(rh) {
  913. if (!rh->ml_host)
  914. continue;
  915. ml_host_detect_once((ml_host_t *) rh->ml_host);
  916. }
  917. rrd_unlock();
  918. if (Cfg.enable_statistics_charts) {
  919. // collect and update training thread stats
  920. for (size_t idx = 0; idx != Cfg.num_training_threads; idx++) {
  921. ml_training_thread_t *training_thread = &Cfg.training_threads[idx];
  922. netdata_mutex_lock(&training_thread->nd_mutex);
  923. ml_training_stats_t training_stats = training_thread->training_stats;
  924. training_thread->training_stats = {};
  925. netdata_mutex_unlock(&training_thread->nd_mutex);
  926. // calc the avg values
  927. if (training_stats.num_popped_items) {
  928. training_stats.queue_size /= training_stats.num_popped_items;
  929. training_stats.allotted_ut /= training_stats.num_popped_items;
  930. training_stats.consumed_ut /= training_stats.num_popped_items;
  931. training_stats.remaining_ut /= training_stats.num_popped_items;
  932. } else {
  933. training_stats.queue_size = ml_queue_size(training_thread->training_queue);
  934. training_stats.consumed_ut = 0;
  935. training_stats.remaining_ut = training_stats.allotted_ut;
  936. training_stats.training_result_ok = 0;
  937. training_stats.training_result_invalid_query_time_range = 0;
  938. training_stats.training_result_not_enough_collected_values = 0;
  939. training_stats.training_result_null_acquired_dimension = 0;
  940. training_stats.training_result_chart_under_replication = 0;
  941. }
  942. ml_update_training_statistics_chart(training_thread, training_stats);
  943. }
  944. }
  945. }
  946. return NULL;
  947. }
  948. /*
  949. * Public API
  950. */
  951. bool ml_capable()
  952. {
  953. return true;
  954. }
  955. bool ml_enabled(RRDHOST *rh)
  956. {
  957. if (!rh)
  958. return false;
  959. if (!Cfg.enable_anomaly_detection)
  960. return false;
  961. if (simple_pattern_matches(Cfg.sp_host_to_skip, rrdhost_hostname(rh)))
  962. return false;
  963. return true;
  964. }
  965. bool ml_streaming_enabled()
  966. {
  967. return Cfg.stream_anomaly_detection_charts;
  968. }
  969. void ml_host_new(RRDHOST *rh)
  970. {
  971. if (!ml_enabled(rh))
  972. return;
  973. ml_host_t *host = new ml_host_t();
  974. host->rh = rh;
  975. host->mls = ml_machine_learning_stats_t();
  976. host->host_anomaly_rate = 0.0;
  977. static std::atomic<size_t> times_called(0);
  978. host->training_queue = Cfg.training_threads[times_called++ % Cfg.num_training_threads].training_queue;
  979. netdata_mutex_init(&host->mutex);
  980. host->ml_running = true;
  981. rh->ml_host = (rrd_ml_host_t *) host;
  982. }
  983. void ml_host_delete(RRDHOST *rh)
  984. {
  985. ml_host_t *host = (ml_host_t *) rh->ml_host;
  986. if (!host)
  987. return;
  988. netdata_mutex_destroy(&host->mutex);
  989. delete host;
  990. rh->ml_host = NULL;
  991. }
  992. void ml_host_start(RRDHOST *rh) {
  993. ml_host_t *host = (ml_host_t *) rh->ml_host;
  994. if (!host)
  995. return;
  996. host->ml_running = true;
  997. }
  998. void ml_host_stop(RRDHOST *rh) {
  999. ml_host_t *host = (ml_host_t *) rh->ml_host;
  1000. if (!host || !host->ml_running)
  1001. return;
  1002. netdata_mutex_lock(&host->mutex);
  1003. // reset host stats
  1004. host->mls = ml_machine_learning_stats_t();
  1005. // reset charts/dims
  1006. void *rsp = NULL;
  1007. rrdset_foreach_read(rsp, host->rh) {
  1008. RRDSET *rs = static_cast<RRDSET *>(rsp);
  1009. ml_chart_t *chart = (ml_chart_t *) rs->ml_chart;
  1010. if (!chart)
  1011. continue;
  1012. // reset chart
  1013. chart->mls = ml_machine_learning_stats_t();
  1014. void *rdp = NULL;
  1015. rrddim_foreach_read(rdp, rs) {
  1016. RRDDIM *rd = static_cast<RRDDIM *>(rdp);
  1017. ml_dimension_t *dim = (ml_dimension_t *) rd->ml_dimension;
  1018. if (!dim)
  1019. continue;
  1020. spinlock_lock(&dim->slock);
  1021. // reset dim
  1022. // TODO: should we drop in-mem models, or mark them as stale? Is it
  1023. // okay to resume training straight away?
  1024. dim->mt = METRIC_TYPE_CONSTANT;
  1025. dim->ts = TRAINING_STATUS_UNTRAINED;
  1026. dim->last_training_time = 0;
  1027. dim->suppression_anomaly_counter = 0;
  1028. dim->suppression_window_counter = 0;
  1029. dim->cns.clear();
  1030. ml_kmeans_init(&dim->kmeans);
  1031. spinlock_unlock(&dim->slock);
  1032. }
  1033. rrddim_foreach_done(rdp);
  1034. }
  1035. rrdset_foreach_done(rsp);
  1036. netdata_mutex_unlock(&host->mutex);
  1037. host->ml_running = false;
  1038. }
  1039. void ml_host_get_info(RRDHOST *rh, BUFFER *wb)
  1040. {
  1041. ml_host_t *host = (ml_host_t *) rh->ml_host;
  1042. if (!host) {
  1043. buffer_json_member_add_boolean(wb, "enabled", false);
  1044. return;
  1045. }
  1046. buffer_json_member_add_uint64(wb, "version", 1);
  1047. buffer_json_member_add_boolean(wb, "enabled", Cfg.enable_anomaly_detection);
  1048. buffer_json_member_add_uint64(wb, "min-train-samples", Cfg.min_train_samples);
  1049. buffer_json_member_add_uint64(wb, "max-train-samples", Cfg.max_train_samples);
  1050. buffer_json_member_add_uint64(wb, "train-every", Cfg.train_every);
  1051. buffer_json_member_add_uint64(wb, "diff-n", Cfg.diff_n);
  1052. buffer_json_member_add_uint64(wb, "smooth-n", Cfg.smooth_n);
  1053. buffer_json_member_add_uint64(wb, "lag-n", Cfg.lag_n);
  1054. buffer_json_member_add_double(wb, "random-sampling-ratio", Cfg.random_sampling_ratio);
  1055. buffer_json_member_add_uint64(wb, "max-kmeans-iters", Cfg.random_sampling_ratio);
  1056. buffer_json_member_add_double(wb, "dimension-anomaly-score-threshold", Cfg.dimension_anomaly_score_threshold);
  1057. buffer_json_member_add_string(wb, "anomaly-detection-grouping-method",
  1058. time_grouping_method2string(Cfg.anomaly_detection_grouping_method));
  1059. buffer_json_member_add_int64(wb, "anomaly-detection-query-duration", Cfg.anomaly_detection_query_duration);
  1060. buffer_json_member_add_string(wb, "hosts-to-skip", Cfg.hosts_to_skip.c_str());
  1061. buffer_json_member_add_string(wb, "charts-to-skip", Cfg.charts_to_skip.c_str());
  1062. }
  1063. void ml_host_get_detection_info(RRDHOST *rh, BUFFER *wb)
  1064. {
  1065. ml_host_t *host = (ml_host_t *) rh->ml_host;
  1066. if (!host)
  1067. return;
  1068. netdata_mutex_lock(&host->mutex);
  1069. buffer_json_member_add_uint64(wb, "version", 2);
  1070. buffer_json_member_add_uint64(wb, "ml-running", host->ml_running);
  1071. buffer_json_member_add_uint64(wb, "anomalous-dimensions", host->mls.num_anomalous_dimensions);
  1072. buffer_json_member_add_uint64(wb, "normal-dimensions", host->mls.num_normal_dimensions);
  1073. buffer_json_member_add_uint64(wb, "total-dimensions", host->mls.num_anomalous_dimensions +
  1074. host->mls.num_normal_dimensions);
  1075. buffer_json_member_add_uint64(wb, "trained-dimensions", host->mls.num_training_status_trained +
  1076. host->mls.num_training_status_pending_with_model);
  1077. netdata_mutex_unlock(&host->mutex);
  1078. }
  1079. bool ml_host_get_host_status(RRDHOST *rh, struct ml_metrics_statistics *mlm) {
  1080. ml_host_t *host = (ml_host_t *) rh->ml_host;
  1081. if (!host) {
  1082. memset(mlm, 0, sizeof(*mlm));
  1083. return false;
  1084. }
  1085. netdata_mutex_lock(&host->mutex);
  1086. mlm->anomalous = host->mls.num_anomalous_dimensions;
  1087. mlm->normal = host->mls.num_normal_dimensions;
  1088. mlm->trained = host->mls.num_training_status_trained + host->mls.num_training_status_pending_with_model;
  1089. mlm->pending = host->mls.num_training_status_untrained + host->mls.num_training_status_pending_without_model;
  1090. mlm->silenced = host->mls.num_training_status_silenced;
  1091. netdata_mutex_unlock(&host->mutex);
  1092. return true;
  1093. }
  1094. bool ml_host_running(RRDHOST *rh) {
  1095. ml_host_t *host = (ml_host_t *) rh->ml_host;
  1096. if(!host)
  1097. return false;
  1098. return true;
  1099. }
  1100. void ml_host_get_models(RRDHOST *rh, BUFFER *wb)
  1101. {
  1102. UNUSED(rh);
  1103. UNUSED(wb);
  1104. // TODO: To be implemented
  1105. netdata_log_error("Fetching KMeans models is not supported yet");
  1106. }
  1107. void ml_chart_new(RRDSET *rs)
  1108. {
  1109. ml_host_t *host = (ml_host_t *) rs->rrdhost->ml_host;
  1110. if (!host)
  1111. return;
  1112. ml_chart_t *chart = new ml_chart_t();
  1113. chart->rs = rs;
  1114. chart->mls = ml_machine_learning_stats_t();
  1115. rs->ml_chart = (rrd_ml_chart_t *) chart;
  1116. }
  1117. void ml_chart_delete(RRDSET *rs)
  1118. {
  1119. ml_host_t *host = (ml_host_t *) rs->rrdhost->ml_host;
  1120. if (!host)
  1121. return;
  1122. ml_chart_t *chart = (ml_chart_t *) rs->ml_chart;
  1123. delete chart;
  1124. rs->ml_chart = NULL;
  1125. }
  1126. bool ml_chart_update_begin(RRDSET *rs)
  1127. {
  1128. ml_chart_t *chart = (ml_chart_t *) rs->ml_chart;
  1129. if (!chart)
  1130. return false;
  1131. chart->mls = {};
  1132. return true;
  1133. }
  1134. void ml_chart_update_end(RRDSET *rs)
  1135. {
  1136. ml_chart_t *chart = (ml_chart_t *) rs->ml_chart;
  1137. if (!chart)
  1138. return;
  1139. }
  1140. void ml_dimension_new(RRDDIM *rd)
  1141. {
  1142. ml_chart_t *chart = (ml_chart_t *) rd->rrdset->ml_chart;
  1143. if (!chart)
  1144. return;
  1145. ml_dimension_t *dim = new ml_dimension_t();
  1146. dim->rd = rd;
  1147. dim->mt = METRIC_TYPE_CONSTANT;
  1148. dim->ts = TRAINING_STATUS_UNTRAINED;
  1149. dim->last_training_time = 0;
  1150. dim->suppression_anomaly_counter = 0;
  1151. dim->suppression_window_counter = 0;
  1152. ml_kmeans_init(&dim->kmeans);
  1153. if (simple_pattern_matches(Cfg.sp_charts_to_skip, rrdset_name(rd->rrdset)))
  1154. dim->mls = MACHINE_LEARNING_STATUS_DISABLED_DUE_TO_EXCLUDED_CHART;
  1155. else
  1156. dim->mls = MACHINE_LEARNING_STATUS_ENABLED;
  1157. spinlock_init(&dim->slock);
  1158. dim->km_contexts.reserve(Cfg.num_models_to_use);
  1159. rd->ml_dimension = (rrd_ml_dimension_t *) dim;
  1160. metaqueue_ml_load_models(rd);
  1161. }
  1162. void ml_dimension_delete(RRDDIM *rd)
  1163. {
  1164. ml_dimension_t *dim = (ml_dimension_t *) rd->ml_dimension;
  1165. if (!dim)
  1166. return;
  1167. delete dim;
  1168. rd->ml_dimension = NULL;
  1169. }
  1170. bool ml_dimension_is_anomalous(RRDDIM *rd, time_t curr_time, double value, bool exists)
  1171. {
  1172. ml_dimension_t *dim = (ml_dimension_t *) rd->ml_dimension;
  1173. if (!dim)
  1174. return false;
  1175. ml_host_t *host = (ml_host_t *) rd->rrdset->rrdhost->ml_host;
  1176. if (!host->ml_running)
  1177. return false;
  1178. ml_chart_t *chart = (ml_chart_t *) rd->rrdset->ml_chart;
  1179. bool is_anomalous = ml_dimension_predict(dim, curr_time, value, exists);
  1180. ml_chart_update_dimension(chart, dim, is_anomalous);
  1181. return is_anomalous;
  1182. }
  1183. static void ml_flush_pending_models(ml_training_thread_t *training_thread) {
  1184. int rc = db_execute(db, "BEGIN TRANSACTION;");
  1185. int op_no = 1;
  1186. if (!rc) {
  1187. op_no++;
  1188. for (const auto &pending_model: training_thread->pending_model_info) {
  1189. if (!rc)
  1190. rc = ml_dimension_add_model(&pending_model.metric_uuid, &pending_model.kmeans);
  1191. if (!rc)
  1192. rc = ml_dimension_delete_models(&pending_model.metric_uuid, pending_model.kmeans.before - (Cfg.num_models_to_use * Cfg.train_every));
  1193. }
  1194. }
  1195. if (!rc) {
  1196. op_no++;
  1197. rc = db_execute(db, "COMMIT TRANSACTION;");
  1198. }
  1199. // try to rollback transaction if we got any failures
  1200. if (rc) {
  1201. netdata_log_error("Trying to rollback ML transaction because it failed with rc=%d, op_no=%d", rc, op_no);
  1202. op_no++;
  1203. rc = db_execute(db, "ROLLBACK;");
  1204. if (rc)
  1205. netdata_log_error("ML transaction rollback failed with rc=%d", rc);
  1206. }
  1207. training_thread->pending_model_info.clear();
  1208. }
  1209. static void *ml_train_main(void *arg) {
  1210. ml_training_thread_t *training_thread = (ml_training_thread_t *) arg;
  1211. char worker_name[1024];
  1212. snprintfz(worker_name, 1024, "training_thread_%zu", training_thread->id);
  1213. worker_register("MLTRAIN");
  1214. worker_register_job_name(WORKER_TRAIN_QUEUE_POP, "pop queue");
  1215. worker_register_job_name(WORKER_TRAIN_ACQUIRE_DIMENSION, "acquire");
  1216. worker_register_job_name(WORKER_TRAIN_QUERY, "query");
  1217. worker_register_job_name(WORKER_TRAIN_KMEANS, "kmeans");
  1218. worker_register_job_name(WORKER_TRAIN_UPDATE_MODELS, "update models");
  1219. worker_register_job_name(WORKER_TRAIN_RELEASE_DIMENSION, "release");
  1220. worker_register_job_name(WORKER_TRAIN_UPDATE_HOST, "update host");
  1221. worker_register_job_name(WORKER_TRAIN_FLUSH_MODELS, "flush models");
  1222. while (!Cfg.training_stop) {
  1223. worker_is_busy(WORKER_TRAIN_QUEUE_POP);
  1224. ml_training_request_t training_req = ml_queue_pop(training_thread->training_queue);
  1225. // we know this thread has been cancelled, when the queue starts
  1226. // returning "null" requests without blocking on queue's pop().
  1227. if (training_req.chart_id == NULL)
  1228. break;
  1229. size_t queue_size = ml_queue_size(training_thread->training_queue) + 1;
  1230. usec_t allotted_ut = (Cfg.train_every * USEC_PER_SEC) / queue_size;
  1231. if (allotted_ut > USEC_PER_SEC)
  1232. allotted_ut = USEC_PER_SEC;
  1233. usec_t start_ut = now_monotonic_usec();
  1234. enum ml_training_result training_res;
  1235. {
  1236. worker_is_busy(WORKER_TRAIN_ACQUIRE_DIMENSION);
  1237. ml_acquired_dimension_t acq_dim = ml_acquired_dimension_get(
  1238. training_req.machine_guid,
  1239. training_req.chart_id,
  1240. training_req.dimension_id);
  1241. training_res = ml_acquired_dimension_train(training_thread, acq_dim, training_req);
  1242. string_freez(training_req.chart_id);
  1243. string_freez(training_req.dimension_id);
  1244. worker_is_busy(WORKER_TRAIN_RELEASE_DIMENSION);
  1245. ml_acquired_dimension_release(acq_dim);
  1246. }
  1247. usec_t consumed_ut = now_monotonic_usec() - start_ut;
  1248. usec_t remaining_ut = 0;
  1249. if (consumed_ut < allotted_ut)
  1250. remaining_ut = allotted_ut - consumed_ut;
  1251. if (Cfg.enable_statistics_charts) {
  1252. worker_is_busy(WORKER_TRAIN_UPDATE_HOST);
  1253. netdata_mutex_lock(&training_thread->nd_mutex);
  1254. training_thread->training_stats.queue_size += queue_size;
  1255. training_thread->training_stats.num_popped_items += 1;
  1256. training_thread->training_stats.allotted_ut += allotted_ut;
  1257. training_thread->training_stats.consumed_ut += consumed_ut;
  1258. training_thread->training_stats.remaining_ut += remaining_ut;
  1259. switch (training_res) {
  1260. case TRAINING_RESULT_OK:
  1261. training_thread->training_stats.training_result_ok += 1;
  1262. break;
  1263. case TRAINING_RESULT_INVALID_QUERY_TIME_RANGE:
  1264. training_thread->training_stats.training_result_invalid_query_time_range += 1;
  1265. break;
  1266. case TRAINING_RESULT_NOT_ENOUGH_COLLECTED_VALUES:
  1267. training_thread->training_stats.training_result_not_enough_collected_values += 1;
  1268. break;
  1269. case TRAINING_RESULT_NULL_ACQUIRED_DIMENSION:
  1270. training_thread->training_stats.training_result_null_acquired_dimension += 1;
  1271. break;
  1272. case TRAINING_RESULT_CHART_UNDER_REPLICATION:
  1273. training_thread->training_stats.training_result_chart_under_replication += 1;
  1274. break;
  1275. }
  1276. netdata_mutex_unlock(&training_thread->nd_mutex);
  1277. }
  1278. if (training_thread->pending_model_info.size() >= Cfg.flush_models_batch_size) {
  1279. worker_is_busy(WORKER_TRAIN_FLUSH_MODELS);
  1280. netdata_mutex_lock(&db_mutex);
  1281. ml_flush_pending_models(training_thread);
  1282. netdata_mutex_unlock(&db_mutex);
  1283. continue;
  1284. }
  1285. worker_is_idle();
  1286. std::this_thread::sleep_for(std::chrono::microseconds{remaining_ut});
  1287. }
  1288. return NULL;
  1289. }
  1290. void ml_init()
  1291. {
  1292. // Read config values
  1293. ml_config_load(&Cfg);
  1294. if (!Cfg.enable_anomaly_detection)
  1295. return;
  1296. // Generate random numbers to efficiently sample the features we need
  1297. // for KMeans clustering.
  1298. std::random_device RD;
  1299. std::mt19937 Gen(RD());
  1300. Cfg.random_nums.reserve(Cfg.max_train_samples);
  1301. for (size_t Idx = 0; Idx != Cfg.max_train_samples; Idx++)
  1302. Cfg.random_nums.push_back(Gen());
  1303. // init training thread-specific data
  1304. Cfg.training_threads.resize(Cfg.num_training_threads);
  1305. for (size_t idx = 0; idx != Cfg.num_training_threads; idx++) {
  1306. ml_training_thread_t *training_thread = &Cfg.training_threads[idx];
  1307. size_t max_elements_needed_for_training = (size_t) Cfg.max_train_samples * (size_t) (Cfg.lag_n + 1);
  1308. training_thread->training_cns = new calculated_number_t[max_elements_needed_for_training]();
  1309. training_thread->scratch_training_cns = new calculated_number_t[max_elements_needed_for_training]();
  1310. training_thread->id = idx;
  1311. training_thread->training_queue = ml_queue_init();
  1312. training_thread->pending_model_info.reserve(Cfg.flush_models_batch_size);
  1313. netdata_mutex_init(&training_thread->nd_mutex);
  1314. }
  1315. // open sqlite db
  1316. char path[FILENAME_MAX];
  1317. snprintfz(path, FILENAME_MAX - 1, "%s/%s", netdata_configured_cache_dir, "ml.db");
  1318. int rc = sqlite3_open(path, &db);
  1319. if (rc != SQLITE_OK) {
  1320. error_report("Failed to initialize database at %s, due to \"%s\"", path, sqlite3_errstr(rc));
  1321. sqlite3_close(db);
  1322. db = NULL;
  1323. }
  1324. if (db) {
  1325. char *err = NULL;
  1326. int rc = sqlite3_exec(db, db_models_create_table, NULL, NULL, &err);
  1327. if (rc != SQLITE_OK) {
  1328. error_report("Failed to create models table (%s, %s)", sqlite3_errstr(rc), err ? err : "");
  1329. sqlite3_close(db);
  1330. sqlite3_free(err);
  1331. db = NULL;
  1332. }
  1333. }
  1334. }
  1335. void ml_fini() {
  1336. if (!Cfg.enable_anomaly_detection)
  1337. return;
  1338. int rc = sqlite3_close_v2(db);
  1339. if (unlikely(rc != SQLITE_OK))
  1340. error_report("Error %d while closing the SQLite database, %s", rc, sqlite3_errstr(rc));
  1341. }
  1342. void ml_start_threads() {
  1343. if (!Cfg.enable_anomaly_detection)
  1344. return;
  1345. // start detection & training threads
  1346. Cfg.detection_stop = false;
  1347. Cfg.training_stop = false;
  1348. char tag[NETDATA_THREAD_TAG_MAX + 1];
  1349. snprintfz(tag, NETDATA_THREAD_TAG_MAX, "%s", "PREDICT");
  1350. netdata_thread_create(&Cfg.detection_thread, tag, NETDATA_THREAD_OPTION_JOINABLE, ml_detect_main, NULL);
  1351. for (size_t idx = 0; idx != Cfg.num_training_threads; idx++) {
  1352. ml_training_thread_t *training_thread = &Cfg.training_threads[idx];
  1353. snprintfz(tag, NETDATA_THREAD_TAG_MAX, "TRAIN[%zu]", training_thread->id);
  1354. netdata_thread_create(&training_thread->nd_thread, tag, NETDATA_THREAD_OPTION_JOINABLE, ml_train_main, training_thread);
  1355. }
  1356. }
  1357. void ml_stop_threads()
  1358. {
  1359. if (!Cfg.enable_anomaly_detection)
  1360. return;
  1361. Cfg.detection_stop = true;
  1362. Cfg.training_stop = true;
  1363. netdata_thread_cancel(Cfg.detection_thread);
  1364. netdata_thread_join(Cfg.detection_thread, NULL);
  1365. // signal the training queue of each thread
  1366. for (size_t idx = 0; idx != Cfg.num_training_threads; idx++) {
  1367. ml_training_thread_t *training_thread = &Cfg.training_threads[idx];
  1368. ml_queue_signal(training_thread->training_queue);
  1369. }
  1370. // cancel training threads
  1371. for (size_t idx = 0; idx != Cfg.num_training_threads; idx++) {
  1372. ml_training_thread_t *training_thread = &Cfg.training_threads[idx];
  1373. netdata_thread_cancel(training_thread->nd_thread);
  1374. }
  1375. // join training threads
  1376. for (size_t idx = 0; idx != Cfg.num_training_threads; idx++) {
  1377. ml_training_thread_t *training_thread = &Cfg.training_threads[idx];
  1378. netdata_thread_join(training_thread->nd_thread, NULL);
  1379. }
  1380. // clear training thread data
  1381. for (size_t idx = 0; idx != Cfg.num_training_threads; idx++) {
  1382. ml_training_thread_t *training_thread = &Cfg.training_threads[idx];
  1383. delete[] training_thread->training_cns;
  1384. delete[] training_thread->scratch_training_cns;
  1385. ml_queue_destroy(training_thread->training_queue);
  1386. netdata_mutex_destroy(&training_thread->nd_mutex);
  1387. }
  1388. }