CN116089231A - Fault alarm method and device, electronic equipment and storage medium - Google Patents
Fault alarm method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN116089231A CN116089231A CN202310151274.XA CN202310151274A CN116089231A CN 116089231 A CN116089231 A CN 116089231A CN 202310151274 A CN202310151274 A CN 202310151274A CN 116089231 A CN116089231 A CN 116089231A
- Authority
- CN
- China
- Prior art keywords
- fault
- log
- alarm
- data
- current
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/32—Monitoring with visual or acoustical indication of the functioning of the machine
- G06F11/324—Display of status information
- G06F11/327—Alarm or error message display
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/079—Root cause analysis, i.e. error or fault diagnosis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Abstract
The embodiment of the invention discloses a fault alarm method, a fault alarm device, electronic equipment and a storage medium. The fault warning method specifically comprises the following steps: obtaining a target fault log, and storing the target fault log into a fault search engine; when the timing event is triggered, acquiring a current fault log from the fault search engine; the current fault log is determined according to the newly-added fault log in the fault search engine; and inputting the current fault log into a pre-trained alarm information generation model to generate fault alarm information corresponding to the current fault log through the alarm information generation model. The technical scheme of the embodiment of the invention can quickly identify the fault cause, thereby improving the fault alarm efficiency, reducing the log analysis time and lowering the operation and maintenance cost.
Description
Technical Field
The embodiment of the invention relates to the technical field of computers, in particular to a fault alarming method, a device, electronic equipment and a storage medium.
Background
With the rapid development of informatization, computer systems have become part of modern enterprises. In recent years, informatization construction of each industry is continuously perfected, and business operation is more and more concentrated on an information system or an information platform. In order to ensure the normal operation of each information system and improve the reliability and safety of the information system, the construction of a monitoring platform is also increasingly important. The monitoring platform can generate alarm information when the information system is abnormal, so that operation and maintenance personnel can discover the abnormality in time and repair and solve the abnormality. When the information system fails, each index is often misplaced, however, as the information system becomes more complex, the number of alarms becomes more and more, and a large number of repeated and invalid alarms often make it difficult for operation and maintenance personnel to find the real failure cause and fully exert the due responsibility of the monitoring system.
In the existing fault troubleshooting process, a specific alarm log is usually found through keyword retrieval, and then the alarm log is analyzed and read by operation and maintenance personnel, however, as monitoring data are more and more huge, an information system is more and more complex, the alarm variety is various and continuously changes, a simple manual keyword retrieval rule cannot fully capture the complex and interactive influence modes among various data factors, and the operation and maintenance personnel need to spend a large amount of manpower for reading alarm information and troubleshooting fault reasons, so that the fault reasons cannot be quickly identified, the fault alarm efficiency is reduced, and the log analysis time and the operation and maintenance cost are improved.
Disclosure of Invention
The embodiment of the invention provides a fault alarming method, a device, electronic equipment and a storage medium, which can rapidly identify a fault cause, thereby improving the fault alarming efficiency, reducing the log analysis time and reducing the operation and maintenance cost.
According to an aspect of the present invention, there is provided a fault alerting method, including:
obtaining a target fault log, and storing the target fault log into a fault search engine;
when the timing event is triggered, acquiring a current fault log from the fault search engine; the current fault log is determined according to a newly-added fault log of an engine in the fault search engine;
and inputting the current fault log into a pre-trained alarm information generation model to generate fault alarm information corresponding to the current fault log through the alarm information generation model.
According to another aspect of the present invention, there is provided a fault alerting device, comprising:
the target fault log storage module is used for acquiring a target fault log and storing the target fault log into the fault search engine;
the current fault log acquisition module is used for acquiring a current fault log from the fault search engine when the timing event is triggered; the current fault log is determined according to a newly-added fault log of an engine in the fault search engine;
and the fault alarm information generation module is used for inputting the current fault log into a pre-trained alarm information generation model so as to generate fault alarm information corresponding to the current fault log through the alarm information generation model.
According to another aspect of the present invention, there is provided an electronic apparatus including:
at least one processor; and
a memory communicatively coupled to the at least one processor; wherein, the liquid crystal display device comprises a liquid crystal display device,
the memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the fault alerting method of any one of the embodiments of the present invention.
According to another aspect of the present invention, there is provided a computer readable storage medium storing computer instructions for causing a processor to execute the fault alerting method according to any one of the embodiments of the present invention.
According to the technical scheme, the target fault log is obtained and stored in the fault search engine, the current fault log determined according to the newly added fault log of the engine in the fault search engine is obtained in the fault search engine when the timing event is triggered, and the current fault log is input into the pre-trained alarm information generation model, so that the fault alarm information corresponding to the current fault log is generated through the alarm information generation model, the problems that in the prior art, the fault alarm efficiency is low, the log analysis time is long, the operation and maintenance cost is high and the like due to the fact that the fault cause cannot be quickly identified are solved, the fault cause can be quickly identified, the fault alarm efficiency is improved, the log analysis time is shortened, and the operation and maintenance cost is reduced.
It should be understood that the description in this section is not intended to identify key or critical features of the embodiments of the invention or to delineate the scope of the invention. Other features of the present invention will become apparent from the description that follows.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments will be briefly described below, and it is apparent that the drawings in the following description are only some embodiments of the present invention, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is a flow chart of a fault alerting method provided in accordance with a first embodiment of the present invention;
FIG. 2 is a flow chart of a fault alerting method provided in a second embodiment of the present invention;
FIG. 3 is a schematic diagram of a fault alerting device according to a third embodiment of the present invention;
fig. 4 is a schematic structural diagram of an electronic device implementing a fault alerting method according to an embodiment of the present invention.
Detailed Description
In order that those skilled in the art will better understand the present invention, a technical solution in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in which it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the present invention without making any inventive effort, shall fall within the scope of the present invention.
It is noted that the terms "comprises" and "comprising," and any variations thereof, in the description and claims of the present invention and in the foregoing figures, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed or inherent to such process, method, article, or apparatus.
Example 1
Fig. 1 is a flowchart of a fault alarm method provided in an embodiment of the present invention, where the embodiment is applicable to a case of quickly identifying a cause of a fault, the method may be performed by a fault alarm device, and the device may be implemented by software and/or hardware, and may generally be directly integrated in an electronic device that performs the method, where the electronic device may be a terminal device or a server device, and the embodiment of the present invention does not limit a type of electronic device that performs the fault alarm method. Specifically, as shown in fig. 1, the fault warning method specifically includes the following steps:
s110, acquiring a target fault log, and storing the target fault log into a fault search engine.
The target fault log may be one of various fault logs generated by the information system, for example, a fault log corresponding to a specific fault, a fault log of a specific fault occurrence time, a fault log with certain features, or the like, which is not limited in the embodiment of the present invention. The fault search engine may be an engine that retrieves fault logs. Alternatively, the fault search engine may be a vector search engine capable of retrieving fault logs.
In the embodiment of the invention, the target fault log is obtained so as to store the target fault log into the fault search engine.
S120, when a timing event is triggered, acquiring a current fault log from the fault search engine; the current fault log is determined according to a newly added fault log of an engine in the fault search engine.
The timing event trigger may be an event that triggers the current fault log to be obtained in the fault search engine when a preset time interval is reached. The current fault log may be a fault log obtained in a fault search engine when the current timing event triggers. It will be appreciated that the number of current fault logs may be one or more, and embodiments of the present invention are not limited in this regard. The newly added fault log of the engine can be the newly added fault log in the fault search engine in a preset time interval. That is, the engine newly added fault log may be a target fault log stored to the fault search engine at a preset time interval. It may be appreciated that the number of newly added fault logs in the engine is the same as the number of target fault logs stored in the fault search engine in the preset time interval, and may be one or more, which is not limited in the embodiment of the present invention. The preset time interval is the time interval triggered by the timing event.
In the embodiment of the invention, after the target fault log is stored in the fault search engine, the current fault log can be further acquired in the fault search engine when the timing event is triggered. Optionally, obtaining the current fault log in the fault search engine may include: and determining an engine newly-added fault log in the fault search engine so as to determine a current fault log according to the engine newly-added fault log. It will be appreciated that one or more of the engine's newly added fault logs may be determined to be the current fault log.
For example, assuming that the preset time interval is 5 seconds, 10 target fault logs are acquired within 5 seconds, and the 10 target fault logs are stored in the fault search engine, the 10 target fault logs may be determined as an engine newly added fault log. When the timer event triggers, i.e. reaches 5 seconds, one or more of the 10 target fault logs may be determined to be the current fault log.
S130, inputting the current fault log into a pre-trained alarm information generation model to generate fault alarm information corresponding to the current fault log through the alarm information generation model.
The alert information generating model may be a model capable of generating alert information. Alternatively, the alert information generating model may be a vector model based on an attention mechanism in a failed search engine. By way of example, the alert information generating model may be a BERT model, a RoBERTa model, a MiniLM model, or the like, to which embodiments of the present invention are not limited. The fault alarm information may be alarm information of a fault of the information system, for example, alarm level information, fault description information, fault time information, fault source information, etc., which is not limited in the embodiment of the present invention. It can be understood that the operation and maintenance personnel can repair the abnormality of the information system according to the fault alarm information.
In the embodiment of the invention, after the current fault log is acquired in the fault search engine, the current fault log can be further input into the pre-trained alarm information generation model so as to generate the fault alarm information corresponding to the current fault log through the alarm information generation model.
According to the technical scheme, the target fault log is obtained and stored in the fault search engine, and the current fault log determined according to the newly added fault log of the engine in the fault search engine is obtained in the fault search engine when the timing event is triggered, so that the current fault log is input into the pre-trained alarm information generation model, the fault alarm information corresponding to the current fault log is generated through the alarm information generation model, the problems that in the prior art, the fault alarm efficiency is low, the log analysis time is long, the operation and maintenance cost is high and the like due to the fact that the fault cause cannot be quickly identified are solved, the fault cause can be quickly identified, the fault alarm efficiency is improved, the log analysis time is shortened, and the operation and maintenance cost is reduced.
Example two
Fig. 2 is a flowchart of a fault alarm method provided by a second embodiment of the present invention, where the present embodiment is a further refinement of the foregoing technical solutions, and provides various specific alternative implementations before the target fault log is obtained, the current fault log is input to a pre-trained alarm information generation model, and after fault alarm information corresponding to the current fault log is generated by the alarm information generation model. The technical solution in this embodiment may be combined with each of the alternatives in one or more embodiments described above. As shown in fig. 2, the method may include the steps of:
s210, acquiring a newly-added fault log of the system.
S220, determining the system newly-added fault log as the target fault log under the condition that the fault mode of the system newly-added fault log is determined to be an unknown fault mode.
The newly added fault log of the system can be the newly added fault log in the information system. The failure mode may be a mode of failure determined from a failure log. The unknown fault pattern, i.e. the fault pattern, is unknown, i.e. the fault pattern cannot be determined from the fault log.
In the embodiment of the invention, the newly added fault log of the system is obtained, and the fault mode of the newly added fault log of the system is determined, so that when the fault mode of the newly added fault log of the system is an unknown fault mode, the newly added fault log of the system is determined to be a target fault log. It can be understood that if the failure mode of the newly added failure log of the system cannot be determined, the failure mode of the newly added failure log of the system can be determined to be an unknown failure mode.
It should be noted that, the specific implementation manner of determining the fault mode of the new fault log of the system is not limited in the embodiment of the present invention, so long as the determination of the fault mode of the new fault log of the system can be achieved. Optionally, the fault mode of the newly added fault log of the system can be identified in the log abnormality detection process by performing log abnormality detection on the newly added fault log of the system. Specifically, the specific implementation process of the log anomaly detection can comprise log acquisition, algorithm training, pattern recognition, anomaly result detection, anomaly result labeling and algorithm incremental training.
S230, acquiring a target fault log, and storing the target fault log into a fault search engine.
S240, when the timing event is triggered, acquiring a current fault log from the fault search engine.
S250, inputting the current fault log into a pre-trained alarm information generation model to generate fault alarm information corresponding to the current fault log through the alarm information generation model.
Optionally, before the current fault log is input into the pre-trained alarm information generation model, the method may further include: acquiring alarm log sample data and determining sample information data of the alarm log sample data; and carrying out model training on the alarm information generation model according to the sample information data.
The alarm log sample data may be an alarm log serving as training sample data when training the alarm information generation model. The sample information data may be any information data related to the alarm log sample data.
Alternatively, the sample information data may include fault description data, key information data, and log information data. The fault description data may be data describing a specific fault of the information system, among other things. The key information data may be data of a key word or a key field in the fault log. The log information data may be log-related information data. Alternatively, the log information data may include current log data and current log context data. The current log data may be content data of the current fault log. The current log context data may be content data of the context of the current fault log. It may be appreciated that the current log context data may be context data of a preset number of rows corresponding to the current fault log. For example, assuming that the preset number of lines is 2 and the current fault log is line 5, the current log context data may include content data of lines 3, 4 and lines 6, 7.
Specifically, before the current fault log is input into the pre-trained alarm information generation model, alarm log sample data may be acquired to determine sample information data of the alarm log sample data, so that model training is performed on the alarm information generation model according to the sample information data. Alternatively, the sample information data of the alert log sample data may be determined by a marking tool in the fault search page.
Optionally, obtaining the alarm log sample data may include: acquiring a system alarm log and determining key field information of the system alarm log; and carrying out log formatting processing on the system alarm log according to the key field information to obtain alarm log sample data.
The system alarm log may be any alarm log of the information system. The key field information may be information of a key field in a system alarm log, for example, fault description information, alarm level information, etc., which is not limited in the embodiment of the present invention. The log formatting process may be a system alarm log formatting process, for example, a K-V (key-value) formatting process, which is not limited in this embodiment of the present invention.
Specifically, a system alarm log is obtained, key field information of the system alarm log is determined, and log formatting processing is carried out on the system alarm log according to the key field information, so that alarm log sample data is obtained.
Optionally, performing model training on the alarm information generation model according to the sample information data may include: inputting the log information data into an alarm information generation model to generate model output data through the alarm information generation model; training the alarm information generation model according to the fault description data, the key information data and the model output data.
The model output data may be output data generated by the alert information generating model according to the input data.
Specifically, after the alarm log sample data is obtained and the fault description data, the key information data and the log information data of the alarm log sample data are determined, the log information data may be further input into the alarm information generation model to generate model output data through the alarm information generation model, so that the alarm information generation model is trained according to the fault description data, the key information data and the model output data.
Alternatively, the fault description data, the key information data, and the log information data may be correlated as a set of training data to train the alert information generation model. The fault description data can be used as labes, the key information data can be used as labes, content, the log information data can be used as labes, answer, and an alarm information generation model can be built and trained.
According to the technical scheme, a great amount of manual intervention is not needed in the training process of the alarm information generation model, and time and labor cost can be saved.
And S260, generating fault searching page prompt information according to the fault alarm information under the condition that the fault searching page is determined to receive the searching page opening instruction.
Wherein the fault search page may be a page capable of searching for faults. It is understood that the failed search page may be a search page corresponding to a failed search engine. The search page open instruction may be an instruction to open a failed search page. The fault search page prompt information can be prompt information displayed on the fault search page and can be used for prompting operation and maintenance personnel. It is understood that the fault search page hint information may be to hint fault information at the fault search page.
In the embodiment of the invention, after the fault alarm information corresponding to the current fault log is generated through the alarm information generation model, whether the fault search page receives the search page opening instruction or not can be further determined, and when the fault search page receives the search page opening instruction, fault search page prompt information is generated according to the fault alarm information.
In a specific example of the embodiment of the invention, firstly, a system alarm log is collected, key field information of the system alarm log is extracted to perform K-V formatting processing to obtain alarm log sample data, then, fault description, key words, logs and context N rows in the alarm log sample data are determined through a marking tool in a fault search page and are associated to be used as a set of labels training data, and then, a vector model related to alarm information, namely an alarm information generation model is established and trained according to the training data. When the fault log of the unknown fault mode is detected, the fault log is determined to be a target fault log and is stored into a fault search engine as a labels. Answer part, and a Haystack (an open source NLP framework) is operated periodically to automatically generate fault alarm information corresponding to the target fault log, so that when a user logs in a monitoring system and opens a fault search page, fault search page prompt information can be generated according to the fault alarm information.
According to the technical scheme, operation and maintenance personnel can be helped to quickly acquire the fault description of the log of the unknown fault mode, so that the log analysis time is shortened.
According to the technical scheme, the newly-added fault log of the system is obtained, the newly-added fault log of the system is determined to be the target fault log when the fault mode of the newly-added fault log of the system is an unknown fault mode, then the target fault log is obtained, the target fault log is stored in a fault search engine, the current fault log is obtained in the fault search engine when a timing event is triggered, the current fault log is input into a pre-trained alarm information generation model, and the fault alarm information corresponding to the current fault log is generated through the alarm information generation model, so that when a search page opening instruction is received by a fault search page, fault search page prompt information is generated according to the fault alarm information, the problems that fault alarm efficiency is low, log analysis time is long, operation and maintenance cost is high and the like due to the fact that fault causes cannot be quickly identified in the prior art are solved, fault alarm efficiency is improved, log analysis time is shortened, and operation and maintenance cost is reduced.
Example III
Fig. 3 is a schematic diagram of a fault warning device according to a third embodiment of the present invention, as shown in fig. 3, where the device includes: a target fault log storage module 310, a current fault log acquisition module 320, and a fault alert information generation module 330, wherein:
a target fault log storage module 310, configured to obtain a target fault log, and store the target fault log into a fault search engine;
the current fault log obtaining module 320 is configured to obtain a current fault log in the fault search engine when the timing event triggers; the current fault log is determined according to a newly-added fault log of an engine in the fault search engine;
the fault alarm information generating module 330 is configured to input the current fault log into a pre-trained alarm information generating model, so as to generate fault alarm information corresponding to the current fault log through the alarm information generating model.
According to the technical scheme, the target fault log is obtained and stored in the fault search engine, and the current fault log determined according to the newly added fault log in the fault search engine is obtained in the fault search engine when the timing event is triggered, so that the current fault log is input into the pre-trained alarm information generation model, the fault alarm information corresponding to the current fault log is generated through the alarm information generation model, the problems that in the prior art, the fault alarm efficiency is low, the log analysis time is long, the operation and maintenance cost is high and the like due to the fact that the fault cause cannot be quickly identified are solved, the fault cause can be quickly identified, the fault alarm efficiency is improved, the log analysis time is shortened, and the operation and maintenance cost is reduced.
Optionally, the target fault log storage module 310 may be specifically configured to: acquiring a newly added fault log of the system; and under the condition that the fault mode of the system newly-added fault log is an unknown fault mode, determining the system newly-added fault log as the target fault log.
Optionally, the fault alert information generating module 330 may be specifically configured to: acquiring alarm log sample data and determining sample information data of the alarm log sample data; and carrying out model training on the alarm information generation model according to the sample information data.
Optionally, the fault alert information generating module 330 may be further configured to: acquiring a system alarm log and determining key field information of the system alarm log; and carrying out log formatting processing on the system alarm log according to the key field information to obtain the alarm log sample data.
Optionally, the sample information data may include fault description data, key information data, and log information data; wherein, the log information data may include current log data and current log context data; accordingly, the fault alert information generating module 330 may be further configured to: inputting the log information data into the alarm information generation model to generate model output data through the alarm information generation model; training the alarm information generation model according to the fault description data, the key information data and the model output data.
Optionally, the fault alert information generating module 330 may be further specifically configured to: generating fault searching page prompt information according to the fault alarm information under the condition that the fault searching page is determined to receive a searching page opening instruction; the fault search page is a search page corresponding to the fault search engine.
Alternatively, the alert information generating model may be a vector model based on an attention mechanism in the failed search engine.
The fault alarming device provided by the embodiment of the invention can execute the fault alarming method provided by any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the executing method.
Example IV
Fig. 4 shows a schematic diagram of the structure of an electronic device 10 that may be used to implement an embodiment of the invention. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. Electronic equipment may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the inventions described and/or claimed herein.
As shown in fig. 4, the electronic device 10 includes at least one processor 11, and a memory, such as a Read Only Memory (ROM) 12, a Random Access Memory (RAM) 13, etc., communicatively connected to the at least one processor 11, in which the memory stores a computer program executable by the at least one processor, and the processor 11 may perform various appropriate actions and processes according to the computer program stored in the Read Only Memory (ROM) 12 or the computer program loaded from the storage unit 18 into the Random Access Memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 may also be stored. The processor 11, the ROM 12 and the RAM 13 are connected to each other via a bus 14. An input/output (I/O) interface 15 is also connected to bus 14.
Various components in the electronic device 10 are connected to the I/O interface 15, including: an input unit 16 such as a keyboard, a mouse, etc.; an output unit 17 such as various types of displays, speakers, and the like; a storage unit 18 such as a magnetic disk, an optical disk, or the like; and a communication unit 19 such as a network card, modem, wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information/data with other devices via a computer network, such as the internet, and/or various telecommunication networks.
The processor 11 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various processors running machine learning model algorithms, digital Signal Processors (DSPs), and any suitable processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above, such as the fault alerting method.
In some embodiments, the fault alerting method may be implemented as a computer program tangibly embodied on a computer readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 10 via the ROM 12 and/or the communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the fault alerting method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the fault alerting method by any other suitable means (e.g., by means of firmware).
Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuit systems, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), systems On Chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs, the one or more computer programs may be executed and/or interpreted on a programmable system including at least one programmable processor, which may be a special purpose or general-purpose programmable processor, that may receive data and instructions from, and transmit data and instructions to, a storage system, at least one input device, and at least one output device.
A computer program for carrying out methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer programs, when executed by the processor, cause the functions/acts specified in the flowchart and/or block diagram block or blocks to be implemented. The computer program may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.
In the context of the present invention, a computer-readable storage medium may be a tangible medium that can contain, or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. The computer readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, the computer readable storage medium may be a machine readable signal medium. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and a pointing device (e.g., a mouse or a trackball) through which a user can provide input to the electronic device. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic input, speech input, or tactile input.
The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), blockchain networks, and the internet.
The computing system may include clients and servers. The client and server are typically remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also called a cloud computing server or a cloud host, and is a host product in a cloud computing service system, so that the defects of high management difficulty and weak service expansibility in the traditional physical hosts and VPS service are overcome.
It should be appreciated that various forms of the flows shown above may be used to reorder, add, or delete steps. For example, the steps described in the present invention may be performed in parallel, sequentially, or in a different order, so long as the desired results of the technical solution of the present invention are achieved, and the present invention is not limited herein.
The above embodiments do not limit the scope of the present invention. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives are possible, depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of the present invention.
Claims (10)
1. A fault alerting method, comprising:
obtaining a target fault log, and storing the target fault log into a fault search engine;
when the timing event is triggered, acquiring a current fault log from the fault search engine; the current fault log is determined according to a newly-added fault log of an engine in the fault search engine;
and inputting the current fault log into a pre-trained alarm information generation model to generate fault alarm information corresponding to the current fault log through the alarm information generation model.
2. The method of claim 1, further comprising, prior to the obtaining the target fault log:
acquiring a newly added fault log of the system;
and under the condition that the fault mode of the system newly-added fault log is an unknown fault mode, determining the system newly-added fault log as the target fault log.
3. The method of claim 1, further comprising, prior to said entering the current fault log into a pre-trained alert information generating model:
acquiring alarm log sample data and determining sample information data of the alarm log sample data;
and carrying out model training on the alarm information generation model according to the sample information data.
4. A method according to claim 3, wherein said obtaining alert log sample data comprises:
acquiring a system alarm log and determining key field information of the system alarm log;
and carrying out log formatting processing on the system alarm log according to the key field information to obtain the alarm log sample data.
5. A method according to claim 3, wherein the sample information data comprises fault description data, key information data and log information data; the log information data comprises current log data and current log context data;
the model training of the alarm information generation model according to the sample information data comprises the following steps:
inputting the log information data into the alarm information generation model to generate model output data through the alarm information generation model;
training the alarm information generation model according to the fault description data, the key information data and the model output data.
6. The method according to claim 1, further comprising, after the generating, by the alert information generating model, the fault alert information corresponding to the current fault log:
generating fault searching page prompt information according to the fault alarm information under the condition that the fault searching page is determined to receive a searching page opening instruction;
the fault search page is a search page corresponding to the fault search engine.
7. The method of claim 1, wherein the alert information generation model is a vector model based on an attention mechanism in the failed search engine.
8. A fault alerting device, comprising:
the target fault log storage module is used for acquiring a target fault log and storing the target fault log into the fault search engine;
the current fault log acquisition module is used for acquiring a current fault log from the fault search engine when the timing event is triggered; the current fault log is determined according to a newly-added fault log of an engine in the fault search engine;
and the fault alarm information generation module is used for inputting the current fault log into a pre-trained alarm information generation model so as to generate fault alarm information corresponding to the current fault log through the alarm information generation model.
9. An electronic device, the electronic device comprising:
at least one processor; and
a memory communicatively coupled to the at least one processor; wherein, the liquid crystal display device comprises a liquid crystal display device,
the memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the fault alerting method of any one of claims 1-7.
10. A computer readable storage medium storing computer instructions for causing a processor to implement the fault alerting method of any one of claims 1-7 when executed.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310151274.XA CN116089231B (en) | 2023-02-13 | 2023-02-13 | Fault alarm method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310151274.XA CN116089231B (en) | 2023-02-13 | 2023-02-13 | Fault alarm method and device, electronic equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN116089231A true CN116089231A (en) | 2023-05-09 |
| CN116089231B CN116089231B (en) | 2023-09-15 |
Family
ID=86186962
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310151274.XA Active CN116089231B (en) | 2023-02-13 | 2023-02-13 | Fault alarm method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116089231B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116796229A (en) * | 2023-06-21 | 2023-09-22 | 北京优特捷信息技术有限公司 | Equipment fault detection method, device, equipment and storage medium |
| CN116991684A (en) * | 2023-08-03 | 2023-11-03 | 北京优特捷信息技术有限公司 | Alarm information processing method, device, equipment and medium |
Citations (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20060002532A1 (en) * | 2004-06-30 | 2006-01-05 | Microsoft Corporation | Methods and interfaces for probing and understanding behaviors of alerting and filtering systems based on models and simulation from logs |
| CN108664374A (en) * | 2018-05-17 | 2018-10-16 | 腾讯科技（深圳）有限公司 | Fault warning model creation method, apparatus, fault alarming method and device |
| CN109639450A (en) * | 2018-10-23 | 2019-04-16 | 平安壹钱包电子商务有限公司 | Fault alarming method, computer equipment and storage medium neural network based |
| CN112395159A (en) * | 2020-11-17 | 2021-02-23 | 华为技术有限公司 | Log detection method, system, device and medium |
| CN112988501A (en) * | 2019-12-17 | 2021-06-18 | 深信服科技股份有限公司 | Alarm information generation method and device, electronic equipment and storage medium |
| WO2021174835A1 (en) * | 2020-03-04 | 2021-09-10 | 平安科技（深圳）有限公司 | Alarm information processing method and apparatus, and computer apparatus and storage medium |
| CN113986673A (en) * | 2021-10-29 | 2022-01-28 | 中国联合网络通信集团有限公司 | Fault correlation method and device and computer readable storage medium |
| WO2022089202A1 (en) * | 2020-10-27 | 2022-05-05 | 深圳前海微众银行股份有限公司 | Fault identification model training method, fault identification method, apparatus and electronic device |
| CN114528845A (en) * | 2022-02-14 | 2022-05-24 | 中国工商银行股份有限公司 | Abnormal log analysis method and device and electronic equipment |
| CN114968633A (en) * | 2022-04-14 | 2022-08-30 | 阿里巴巴（中国）有限公司 | Abnormal log detection method and device |
| CN115396289A (en) * | 2022-08-31 | 2022-11-25 | 广东电网有限责任公司 | Fault alarm determination method and device, electronic equipment and storage medium |
| CN115687031A (en) * | 2022-11-15 | 2023-02-03 | 北京优特捷信息技术有限公司 | Method, device, equipment and medium for generating alarm description text |
-
2023
- 2023-02-13 CN CN202310151274.XA patent/CN116089231B/en active Active
Patent Citations (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20060002532A1 (en) * | 2004-06-30 | 2006-01-05 | Microsoft Corporation | Methods and interfaces for probing and understanding behaviors of alerting and filtering systems based on models and simulation from logs |
| CN108664374A (en) * | 2018-05-17 | 2018-10-16 | 腾讯科技（深圳）有限公司 | Fault warning model creation method, apparatus, fault alarming method and device |
| CN109639450A (en) * | 2018-10-23 | 2019-04-16 | 平安壹钱包电子商务有限公司 | Fault alarming method, computer equipment and storage medium neural network based |
| CN112988501A (en) * | 2019-12-17 | 2021-06-18 | 深信服科技股份有限公司 | Alarm information generation method and device, electronic equipment and storage medium |
| WO2021174835A1 (en) * | 2020-03-04 | 2021-09-10 | 平安科技（深圳）有限公司 | Alarm information processing method and apparatus, and computer apparatus and storage medium |
| WO2022089202A1 (en) * | 2020-10-27 | 2022-05-05 | 深圳前海微众银行股份有限公司 | Fault identification model training method, fault identification method, apparatus and electronic device |
| CN112395159A (en) * | 2020-11-17 | 2021-02-23 | 华为技术有限公司 | Log detection method, system, device and medium |
| CN113986673A (en) * | 2021-10-29 | 2022-01-28 | 中国联合网络通信集团有限公司 | Fault correlation method and device and computer readable storage medium |
| CN114528845A (en) * | 2022-02-14 | 2022-05-24 | 中国工商银行股份有限公司 | Abnormal log analysis method and device and electronic equipment |
| CN114968633A (en) * | 2022-04-14 | 2022-08-30 | 阿里巴巴（中国）有限公司 | Abnormal log detection method and device |
| CN115396289A (en) * | 2022-08-31 | 2022-11-25 | 广东电网有限责任公司 | Fault alarm determination method and device, electronic equipment and storage medium |
| CN115687031A (en) * | 2022-11-15 | 2023-02-03 | 北京优特捷信息技术有限公司 | Method, device, equipment and medium for generating alarm description text |
Non-Patent Citations (1)
| Title |
|---|
| 牟宸洲;薛质;施勇;: "基于BiLSTM和Attention的命令序列检测方法", 通信技术, vol. 52, no. 12, pages 3016 - 3020 * |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116796229A (en) * | 2023-06-21 | 2023-09-22 | 北京优特捷信息技术有限公司 | Equipment fault detection method, device, equipment and storage medium |
| CN116991684A (en) * | 2023-08-03 | 2023-11-03 | 北京优特捷信息技术有限公司 | Alarm information processing method, device, equipment and medium |
| CN116991684B (en) * | 2023-08-03 | 2024-01-30 | 北京优特捷信息技术有限公司 | Alarm information processing method, device, equipment and medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN116089231B (en) | 2023-09-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN116089231B (en) | Fault alarm method and device, electronic equipment and storage medium | |
| CN111435366A (en) | Equipment fault diagnosis method and device and electronic equipment | |
| CN116049146B (en) | Database fault processing method, device, equipment and storage medium | |
| CN116010220A (en) | Alarm diagnosis method, device, equipment and storage medium | |
| CN115396289B (en) | Fault alarm determining method and device, electronic equipment and storage medium | |
| CN114118295A (en) | Anomaly detection model training method, anomaly detection device and medium | |
| CN114647558A (en) | Method and device for detecting log abnormity | |
| CN116755974A (en) | Cloud computing platform operation and maintenance method and device, electronic equipment and storage medium | |
| CN115687406B (en) | Sampling method, device, equipment and storage medium for call chain data | |
| CN116089197A (en) | Fault equipment switching exercise method, device, equipment and storage medium | |
| CN115168154B (en) | Abnormal log detection method, device and equipment based on dynamic baseline | |
| CN116226644A (en) | Method and device for determining equipment fault type, electronic equipment and storage medium | |
| CN114692778B (en) | Multi-mode sample set generation method, training method and device for intelligent inspection | |
| CN115687031A (en) | Method, device, equipment and medium for generating alarm description text | |
| CN114881112A (en) | System anomaly detection method, device, equipment and medium | |
| CN115130112A (en) | Quick start-stop method, device, equipment and storage medium | |
| CN115544202A (en) | Alarm processing method, device and storage medium | |
| CN117493127B (en) | Application program detection method, device, equipment and medium | |
| CN116185765B (en) | Alarm processing method and device, electronic equipment and storage medium | |
| CN116991684B (en) | Alarm information processing method, device, equipment and medium | |
| CN116820826B (en) | Root cause positioning method, device, equipment and storage medium based on call chain | |
| CN116991683B (en) | Alarm information processing method, device, equipment and medium | |
| CN117009909B (en) | Automatic fault reporting model construction method, automatic fault reporting method and device | |
| CN116560891A (en) | Fault processing method and device, electronic equipment and storage medium | |
| CN114444087A (en) | Unauthorized vulnerability detection method and device, electronic equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |