A method, system and device for monitoring data. A server receives service running data of a service transmitted from a client. The server acquires a first abnormal strategy corresponding to the service and provides an alarm for the service when the first abnormal strategy is matched according to the service running data. The server can determine for which service running on the client the abnormality occurs and an alarm is provided.