WO2021217865A1

WO2021217865A1 - Method and apparatus for locating root cause of alarm, computer device, and storage medium

Info

Publication number: WO2021217865A1
Application number: PCT/CN2020/099434
Authority: WO
Inventors: 陈桢博; 金戈; 徐亮
Original assignee: 平安科技（深圳）有限公司
Priority date: 2020-04-29
Filing date: 2020-06-30
Publication date: 2021-11-04
Also published as: CN111555921A; CN111555921B

Abstract

A method for locating the root cause of an alarm, and a related apparatus, which relate to artificial intelligence. The method comprises: acquiring a particular alarm object in an alarm slice and generating a corresponding alarm cluster; aggregating monitoring indexes in specified alarm objects in the alarm cluster and generating an entry index; acquiring first index time sequence data corresponding to the specified alarm objects and acquiring second index time sequence data corresponding to the specified alarm objects; adjusting a first time window of the first index time sequence data according to a second time window of the second index time sequence data, and calculating a specified Pearson similarity between a specified index and the entry index; according to the specified Pearson similarity corresponding to each specified alarm object and the specified time difference corresponding to each specified Pearson similarity, selecting at least one specified alarm object from among all of the specified alarm objects as a root cause object of the alarm cluster and outputting same. The described method can quickly generate a root cause object related to an alarm object.

Description

Method, device, computer equipment and storage medium for locating root cause of alarm

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on April 29, 2020, the application number is 202010357568.4, and the invention title is "Methods, devices, computer equipment and storage media for locating the root cause of alarms", and its entire contents Incorporated in this application by reference.

Technical field

This application relates to the field of artificial intelligence technology, and in particular to a method, device, computer equipment, and storage medium for locating the root cause of an alarm.

Background technique

With the rapid development of science and technology, business scenarios in the current information age are changing with each passing day. Frequent business function updates and configuration parameter changes will cause endless abnormal alarms, which will lead to security risks and potential losses. In the operation and maintenance system, a fault generated by an object may trigger alarms for multiple objects, and there may be a large number of associated alarms caused by multiple object failures at each moment. Therefore, how to quickly locate the root cause (root cause) of the abnormal alarm and stop the loss in time when an abnormal alarm occurs in the operation and maintenance system has become an urgent problem to be solved. The inventor realized that the existing method of locating the root cause of the alarm requires the operation and maintenance personnel to always pay attention to the operation and maintenance system, and then segment the alarm object at a certain moment to summarize it into different problems, and perform the root cause for each problem. Analyze to determine the fault object, the workload of the operation and maintenance personnel is large, the operation and maintenance work takes a long time, and the operation and maintenance work efficiency is low.

technical problem

The main purpose of this application is to provide a method, device, computer equipment, and storage medium for locating the root cause of an alarm. It aims to solve the existing method of locating the root cause of an alarm. The alarm objects at all times are divided into different problems, and the root cause analysis is performed for each problem to determine the fault object. The workload of the operation and maintenance personnel is large, the operation and maintenance work takes a long time, and the operation and maintenance work efficiency is low. Technical issues.

Technical solutions

In order to achieve the above-mentioned purpose of the invention, in the first aspect, the present application proposes a method for locating the root cause of an alarm, and the method includes the steps:

Acquiring a specific alarm object in an alarm slice, and generating an alarm cluster according to the specific alarm object, where the specific alarm object is any alarm object among all the alarm objects in the alarm slice;

Obtain the specified alarm object in the alarm cluster, and perform indicator aggregation processing on the monitoring indicators in the specified alarm object to generate corresponding entry indicators, where the specified alarm object is all alarm objects in the alarm cluster Any alarm object within;

Acquiring first indicator time series data corresponding to the specified indicator of the specified alarm object, and acquiring second indicator time series data corresponding to the entry indicator of the specified alarm object;

According to the second time window of the second indicator time series data, the first time window of the first indicator time series data is adjusted according to the first preset rule, and the distance between the specified indicator and the entry indicator is calculated. The specified Pearson similarity;

Respectively acquiring a designated Pearson similarity corresponding to each of the designated alarm objects, and a designated time difference corresponding to each of the designated Pearson similarities;

According to all the specified Pearson similarities and the specified time difference corresponding to each of the specified Pearson similarities, at least one specified alarm object is selected from all the specified alarm objects as the alarm according to a second preset rule The root cause object of the cluster, and output the root cause object of the alarm cluster.

In the second aspect, this application also provides a device for locating the root cause of the alarm, including:

The first acquisition module is configured to acquire a specific alarm object in an alarm slice, and generate an alarm cluster according to the specific alarm object, where the specific alarm object is any alarm object among all the alarm objects in the alarm slice ；

The generating module is used to obtain the specified alarm object in the alarm cluster, and perform indicator aggregation processing on the monitoring indicators in the specified alarm object to generate corresponding entry indicators, wherein the specified alarm object is the alarm cluster Any one of the alarm objects in all alarm objects;

The second acquisition module is configured to acquire the first indicator time series data corresponding to the specified indicator of the specified alarm object, and obtain the second indicator time series data corresponding to the entry indicator of the specified alarm object;

The adjustment module is configured to adjust the first time window of the first indicator time series data according to the first preset rule according to the second time window of the second indicator time series data, and calculate the specified indicator and the time window Specify the Pearson similarity between the entry indicators;

The third acquiring module is configured to respectively acquire the designated Pearson similarity degree corresponding to each of the designated alarm objects, and the designated time difference corresponding to each of the designated Pearson similarity degrees;

The first determining module is configured to filter out at least one of all the specified alarm objects according to the second preset rule based on all the specified Pearson similarities and the specified time difference corresponding to each of the specified Pearson similarities. Specify an alarm object as the root cause object of the alarm cluster, and output the root cause object of the alarm cluster.

In a third aspect, the present application also provides a computer device including a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, a method for locating the root cause of an alarm is implemented, wherein: The method for locating the root cause of the alarm includes the following steps:

In a fourth aspect, the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, a method for locating the root cause of an alarm is realized, wherein the root cause of the alarm is The positioning method includes the following steps:

Beneficial effect

The method, device, computer equipment and storage medium for locating the alarm root cause provided in this application can quickly and intelligently generate the root cause object related to the alarm cluster corresponding to the alarm object by clustering and root cause analysis on the alarm object , Effectively avoid the need for manual root cause analysis in a large amount of raw data related to the operation and maintenance system at all times, reduce the workload of operation and maintenance personnel, reduce the time-consuming process of alarm root cause judgment, and increase The efficiency of operation and maintenance work.

Description of the drawings

FIG. 1 is a schematic flowchart of a method for locating the root cause of an alarm according to an embodiment of the present application;

FIG. 2 is a schematic structural diagram of an apparatus for locating the root cause of an alarm according to an embodiment of the present application;

Fig. 3 is a schematic structural diagram of a computer device according to an embodiment of the present application.

The best mode of the present invention

1, a method for locating the root cause of an alarm according to an embodiment of the present application includes:

S1: Obtain a specific alarm object in an alarm slice, and generate an alarm cluster according to the specific alarm object, where the specific alarm object is any alarm object among all alarm objects in the alarm slice;

S2: Obtain the specified alarm object in the alarm cluster, and perform index aggregation processing on the monitoring indicators in the specified alarm object to generate a corresponding entry indicator, wherein the specified alarm object is all of the alarm clusters Any one of the alarm objects in the alarm object;

S3: Acquire first indicator time series data corresponding to the specified indicator of the specified alarm object, and obtain second indicator time series data corresponding to the entry indicator of the specified alarm object;

S4: According to the second time window of the second indicator time series data, adjust the first time window of the first indicator time series data according to the first preset rule, and calculate the specified indicator and the entry indicator The specified Pearson similarity between;

S5: Obtain a designated Pearson similarity corresponding to each of the designated alarm objects, and a designated time difference corresponding to each of the designated Pearson similarities;

S6: According to all the designated Pearson similarities and the designated time difference corresponding to each of the designated Pearson similarities, at least one designated alarm object is selected from all the designated alarm objects according to the second preset rule. The root cause object of the alarm cluster is described, and the root cause object of the alarm cluster is output.

As described in the above steps S1 to S6, the execution subject of this method embodiment is a device for locating the root cause of the alarm. In actual applications, the device for locating the root cause of the alarm can be realized by a virtual device, such as software code, or by a physical device written or integrated with relevant execution codes, and can communicate with the user through a keyboard, mouse, remote control, Human-computer interaction is carried out by means of touchpad or voice control equipment. The device for locating the root cause of alarms provided in this embodiment can quickly and intelligently generate root cause objects related to the alarm cluster corresponding to the alarm object, thereby effectively improving the work efficiency of the operation and maintenance work. Specifically, first obtain a specific alarm object in the alarm slice, and generate an alarm cluster based on the above specific alarm object. When a failure event occurs during the operation of the operation and maintenance system, it may trigger alarms for multiple objects, that is, Generate multiple alarm objects associated with the failure event. In addition, the above alarm slice refers to all the alarm objects generated by the operation and maintenance system in a specific time period. The above specific time period can be set every 10 minutes; and each alarm object in the alarm slice in this example may only belong to one Alarm problems, to eliminate the possibility that the same alarm object in the alarm slice belongs to multiple alarm problems due to time relationships; the above-mentioned specific alarm object is any one of all alarm objects in the above-mentioned alarm slice; the above-mentioned alarm cluster is for specific The alarm object and the target alarm object whose call chain distance from the specific alarm object is not greater than the preset distance threshold is obtained after clustering, and any object in the alarm cluster may be the best explanation for the alarm cluster , Which corresponds to the root cause object of the alarm cluster. After the alarm cluster is obtained, the specified alarm object in the alarm cluster is obtained, and the monitoring indicators corresponding to the application layer object in the specified alarm object are aggregated to generate an entry indicator. Wherein, the above-mentioned designated alarm object is any one of all alarm objects in the alarm cluster, and the above-mentioned process of performing indicator aggregation processing on the monitoring indicators corresponding to the application layer objects in the above-mentioned designated alarm object may include: first obtaining the above All monitoring indicators in the application layer object are then normalized and averaged for all the above monitoring indicators to obtain the above entry indicators. In addition, after all the above monitoring indicators are obtained, all the monitoring indicators can be further screened and processed, a certain number of designated monitoring indicators are selected, and then the normalized addition and average calculation of the designated monitoring indicators are carried out to obtain the above Entry indicators. For example, if there is a monitoring index A=[A ₁ ,A ₂ ,A ₃ ,...,A _n ], and a monitoring index B=[B ₁ ,B ₂ ,B ₃ ,...,B _n ], then the monitoring index After the normalized addition and average calculation of A and monitoring index B, the entry index C=[C ₁ ,C ₂ ,C ₃ ,...,C _n ], and C _n ＝(A _n +B _n )/2 can be obtained . When the entry index is obtained, the first indicator time series data corresponding to the specified indicator of the specified alarm object is then obtained; and the second indicator time series data corresponding to the entry indicator of the specified alarm object is obtained. Among them, the indicator time series data corresponding to the above specified indicators are data values collected in real time, and generally can include at least collected values such as access time, visit volume, and occupancy, and the above specified indicators may specifically be access time consuming indicators. After obtaining the first indicator time series data and the second indicator time series data, according to the second time window of the second indicator time series data, the first time window of the first indicator time series data is performed according to the first preset rule. Adjust, and calculate the specified Pearson similarity between the above-mentioned designated index and the above-mentioned entrance index. Wherein, the first preset rule may refer to adjusting the first time window of the first indicator time series data according to the preset time difference threshold to ensure that the time difference between the first time window and the second time window is within the range of the time difference threshold. within. In addition, the specified Pearson similarity between the above specified index and the above entry index can be calculated by the calculation formula related to the Pearson correlation coefficient, and the calculation formula of the above Pearson correlation coefficient is as follows:

X is the designated index and X is the variable, X=[X ₁ ,X ₂ ,X ₃ ,...,X _n ], Y is the entry index and Y is the variable, Y=[Y ₁ ,Y ₂ ,Y ₃ ,..., Y _n ], cov(X,Y) is the covariance of X and Y, μ is the average value, and σ is the standard deviation. Then, the designated Pearson similarity corresponding to each of the above-mentioned designated alarm objects and the designated time difference corresponding to each of the above-mentioned designated Pearson similarities are respectively obtained. Wherein, after sliding adjustment of the first time window of the first indicator time series data according to the second time window according to the first preset rule, multiple sets of designated first time windows after sliding adjustment will be generated; The alarm object can calculate the Pearson similarity between the multiple sets of specified indicators and the entry indicators corresponding to multiple sets of specified first time windows multiple times according to multiple sets of specified first time windows, and The Pearson similarity degree with the largest numerical value is used as the above-mentioned designated Pearson similarity degree. In addition, after the specified Pearson similarity is obtained, the time difference between the specific first time window and the specific second time window corresponding to the specified Pearson similarity can be calculated to be similar to the specified Pearson Degree corresponds to the above specified time difference. Finally, according to all the above-mentioned designated Pearson similarities and the designated time difference corresponding to each of the above-mentioned designated Pearson similarities, at least one designated alarm object is selected from all the above-mentioned designated alarm objects as the root of the above-mentioned alarm cluster according to the second preset rule. Cause object, and output the root cause object of the above alarm cluster. Among them, the above-mentioned second preset rule is not specifically limited. For example, the above-mentioned second preset rule may be: by acquiring other related features corresponding to the specified alarm object, and then calling the preset supervised learning algorithm to control the other related features , And the specified Pearson similarity obtained above and the specified time difference are predicted to process, and then the root cause judgment probability value of each specified alarm object is calculated, and then the alarm object corresponding to the root cause judgment probability value that meets the condition is used as the alarm cluster The root cause object and output. In addition, other rules can also be used to find the root cause objects of the alarm clusters. For example, the corresponding weighted value can be obtained by weighting the specified Pearson similarity, the specified time difference, and the corresponding weight value, which will then meet the conditions. The alarm object corresponding to the weighted value is output as the root cause object of the alarm cluster, and so on. In this embodiment, clustering and root cause analysis are performed on the alarm objects, so that the root cause objects related to the alarm cluster corresponding to the alarm objects can be quickly and intelligently generated, effectively avoiding the need for manual time in a large number of primitives related to the operation and maintenance system. Root cause analysis in the data reduces the workload of operation and maintenance personnel, reduces the time required for the process of determining the root cause of alarms, and improves the efficiency of operation and maintenance.

Further, in an embodiment of the present application, the above step S1 includes:

S100: Obtain a specific alarm object in the alarm slice;

S101: Calculate the call chain distance between each alarm object except the specific alarm object in the alarm slice and the specific alarm object;

S102: cyclically execute the step of filtering out the target alarm object whose call chain distance to the specific alarm object is not greater than the preset distance threshold from the alarm slice, until there is no contact with the specific alarm object in the alarm slice. The call chain distance between the alarm objects is not greater than the preset distance threshold of the target alarm object;

S103: Place all the target alarm objects and the specific alarm objects obtained through screening in a preset alarm set to obtain the alarm cluster.

As described in the above steps S100 to S103, the step of acquiring a specific alarm object in an alarm slice and generating an alarm cluster based on the specific alarm object may specifically include: first obtaining the specific alarm object in the alarm slice. Then respectively calculate the call chain distance between each alarm object in the alarm slice except the specific alarm object and the specific alarm object. Among them, the above-mentioned call chain distance is the distance value corresponding to the relationship of the number of mutual calls between the alarm objects. Specifically, there will be a call relationship between the alarm objects in the operation and maintenance system. In a certain operation and maintenance system, Alarm object A will call alarm object B, and alarm object B will call alarm object C. If there is a call relationship, there will be an influence relationship. For any two alarm objects that are associated with n calls, then one of the two alarm objects The call chain distance between is n. For example, if A and B are two alarm objects associated with n calls, then the call chain distance between A and B is n; for another example, according to the above-mentioned A call B, B calls C can be obtained Out: A and B are two alarm objects associated with one call, that is, the call chain distance between A and B is 1; in the same way, B and C are two alarm objects associated with one call, That is, the call chain distance between B and C is 1; A and C are two alarm objects that are associated with two calls, that is, the call chain distance between A and C is 2. In addition, when the above-mentioned call chain distance is calculated as n, for any alarm object A among the multiple alarm objects included in a certain alarm impact problem, there is at least one alarm object B and the call chain distance between it is less than or equal to n . After the call chain distance is calculated, the target alarm object whose call chain distance to the specific alarm object is not greater than the preset distance threshold is filtered from the alarm slice. Wherein, the value of the aforementioned preset distance threshold is set according to the aforementioned alarm propagation distance, which can be set according to the actual value of the alarm propagation distance, for example, it can be set to 1. And cyclically execute the steps of screening the target alarm object whose call chain distance to the specific alarm object is not greater than the preset distance threshold from the alarm slice, until there is no call chain with the specific alarm object in the alarm slice The target alarm object whose distance is not greater than the preset distance threshold. Finally, all the above-mentioned target alarm objects and the above-mentioned specific alarm objects obtained by screening are placed in a preset alarm set to obtain the above-mentioned alarm cluster. Among them, an alarm set can be created in advance, and the above-mentioned alarm cluster can be generated by placing the above-mentioned specific alarm object and the above-mentioned target alarm object in the alarm set, so that the specified alarm object in the alarm cluster can be rooted subsequently using relevant algorithm rules. Based on analysis, the root cause object of the alarm cluster can be obtained intelligently and quickly.

Further, in an embodiment of the present application, the above step S4 includes:

S400: Acquire a first time window of the first indicator time series data, and a second time window of the second indicator time series data;

S401: Perform sliding adjustment on the first time window according to the second time window and a preset time difference threshold, so as to control the time difference between the first time window and the second time window to be within the time difference threshold. Within the range, and get multiple sets of designated first time windows after sliding adjustment;

S402: Calculate the Pearson similarity between the multiple sets of the specified indicators and the entry indicators corresponding to the multiple sets of the specified first time windows according to the multiple sets of the specified first time windows;

S403: Filter the Pearson similarity with the largest value from the multiple groups of Pearson similarity;

S404: Determine the Pearson similarity with the largest value as the designated Pearson similarity.

As described in the above steps S400 to S404, the first time window of the first indicator time series data is adjusted according to the first preset rule according to the second time window of the second indicator time series data, and all the time windows are calculated. The step of specifying the Pearson similarity between the specified indicator and the entry indicator may specifically include: first obtaining a first time window of the first indicator time series data and a second time window of the second indicator time series data. Wherein, the numerical values of the first time window and the second time window are in units of minutes. Then, according to the second time window and the preset time difference threshold, the first time window is slidingly adjusted to control the time difference between the first time window and the second time window within the range of the time difference threshold And get multiple sets of designated first time windows after sliding adjustment. Among them, the numerical form of the above-mentioned time difference is an absolute value. Then, according to the multiple sets of the specified first windows, the Pearson similarity between the multiple sets of the specified indicators and the entry indicators respectively corresponding to the multiple sets of the specified first time windows is calculated. Wherein, the above-mentioned first time window and the second time window have the same size. The above-mentioned time difference threshold is a range value, and the specific numerical range of the time difference threshold is not limited, for example, it can be set to 0-60 min. In addition, the first time window can be slidably adjusted according to the preset number of times to obtain multiple sets of designated first time windows with the same preset number of times, and the index data of the designated indicators corresponding to different designated first time windows will be different , And then it is possible to calculate multiple sets of different Pearson similarities between the designated index and the entry index. After the multiple groups of Pearson similarity are obtained, the Pearson similarity with the largest value is selected from the multiple groups of Pearson similarity, and the Pearson similarity with the largest value is determined as the specified Pearson similarity. Spend. In this embodiment, the first time window of the first indicator time series data is used to perform corresponding sliding adjustments through a preset time difference threshold, and then multiple sets of Pearson similarities are calculated according to the obtained multiple sets of designated first time windows, and from multiple sets of Pearson similarities. Accurately filtering out the designated Pearson similarity with the largest value from the group Pearson similarity is beneficial to subsequently accurately determining the root cause object of the alarm cluster based on the designated Pearson similarity and in accordance with preset related rules.

Further, in an embodiment of the present application, the above step S6 includes:

S600: Use the specified Pearson similarity corresponding to the specified alarm object and the specified time difference as the first feature;

S601: Acquire a second characteristic corresponding to the specified alarm object, where the quantity of the second characteristic includes one or more;

S602: Invoke a preset supervised learning algorithm to perform prediction processing on the first feature and the second feature respectively corresponding to each of the specified alarm objects, and calculate the root cause judgment probability value corresponding to each specified alarm object;

S603: Use the at least one designated alarm object with the highest root cause judgment probability value as the root cause object of the alarm cluster, and output the root cause object of the alarm cluster.

As described in the above steps S600 to S603, according to all the specified Pearson similarities and the specified time difference corresponding to each of the specified Pearson similarities, at least one of all the specified alarm objects is selected according to the second preset rule. The step of specifying the alarm object as the root cause object of the alarm cluster and outputting the root cause object of the alarm cluster may specifically include: firstly taking the specified Pearson similarity and the specified time difference corresponding to the specified alarm object as the first feature. Then, a second feature corresponding to the specified alarm object is acquired, where the second feature refers to other related features corresponding to the specified alarm object, and the number of the second features includes one or more. And the above-mentioned second feature may specifically include one or more of the number of object calls, the number of object alarms, and the object hierarchy. Then, a preset supervised learning algorithm is called to predict the first feature and the second feature corresponding to each of the above-mentioned designated alarm objects, and the root cause judgment probability value corresponding to each designated alarm object is calculated. Among them, the above-mentioned supervised learning algorithm can be a random forest algorithm. The random forest algorithm is an ensemble learning algorithm, which constructs multiple weak learners (tree models), and trains any learner by randomly extracting features and samples, and finally obtains Comprehensive judgment result of multiple weak learners. The predictive output of random forest is in the form of a probability value (generally, the probability is greater than 0.5 is 1, otherwise it is 0). The feature of an object is input, and the output is the judgment probability of the object as the root cause. For an alarm cluster, there are multiple alarm objects. When the above first feature and other related features are input into the weak learner constructed by the random forest algorithm, the random forest algorithm will calculate the corresponding root cause judgment probability for each alarm object value. Finally, when the root cause judgment probability value is obtained, at least one designated alarm object with the highest root cause judgment probability value is taken as the root cause object of the alarm cluster, and the root cause object of the alarm cluster is output. In addition, in addition to outputting the root cause object of the alarm cluster, the first feature and the second feature corresponding to the root cause object of the alarm cluster may also be output. In this embodiment, by invoking the supervised learning algorithm, root cause prediction is performed on multiple acquired features, that is, the first feature and the second feature, and at least one designated alarm object with the highest root cause judgment probability value can be output accurately, so that it can be quickly and intelligently The generation of the root cause object of the alarm cluster corresponding to the alarm object effectively reduces the workload of the operation and maintenance personnel and improves the work efficiency of the operation and maintenance work.

Further, in an embodiment of the present application, the above step S603 includes:

S6030: Sort all the root cause judgment probability values in order from high to low to obtain a sorting result;

S6031: Starting from the root cause judgment probability value ranked first in the ranking result, sequentially obtain a preset number of designated root cause judgment probability values;

S6032: Use the alarm object corresponding to the obtained specified root cause judgment probability value as the root cause object of the alarm cluster.

As described in the above steps S6030 to S6032, the step of using at least one designated alarm object with the highest root cause judgment probability value as the root cause object of the alarm cluster and outputting the root cause object of the alarm cluster may specifically include: All the above-mentioned root cause judgment probability values are sorted in order from high to low, and the sorting result is obtained. After obtaining the above ranking result, starting from the root cause judgment probability value ranked first in the above ranking result, a preset number of designated root cause judgment probability values are sequentially obtained. Among them, the above-mentioned preset number is not specifically limited, and can be set according to actual needs, for example, it can be set to five. Finally, the alarm object corresponding to the obtained specified root cause judgment probability value is used as the root cause object of the above alarm cluster, so that the acquired root cause object of the alarm cluster can be subsequently used as the root cause corresponding to the alarm cluster. Personnel output, so that the operation and maintenance personnel can locate the alarm root cause of this alarm cluster according to the output root cause of the alarm cluster. For example, when the above-mentioned preset number is set to 5, it is assumed that the ranking results obtained after sorting all root cause judgment probability values are: root cause judgment probability value 1, root cause judgment probability value 2, root cause judgment probability value 3 , Root cause judgment probability value 4, root cause judgment probability value 5,..., then the above root cause judgment probability value 1, root cause judgment probability value 2, root cause judgment probability value 3, root cause judgment probability value 4, The alarm objects corresponding to the root cause judgment probability value of 5 are used as the root cause objects of the above-mentioned alarm cluster.

In an embodiment of the present application, the foregoing step S6 includes:

S610: Calculate a first weight value corresponding to the specified Pearson similarity based on historical alarm data;

S611: Obtain a second weight value corresponding to the specified time difference;

S612: Perform a weighted calculation on each of the designated Pearson similarities and each corresponding designated time difference according to the first weight value and the second weight value to obtain multiple weighted values;

S613: Use at least one designated alarm object with the highest weight value as the root cause object of the alarm cluster, and output the root cause object of the alarm cluster.

As described in the above steps S610 to S613, according to all the specified Pearson similarities and the specified time difference corresponding to each of the specified Pearson similarities, at least one is selected from all the specified alarm objects according to the second preset rule. The step of specifying the alarm object as the root cause object of the alarm cluster and outputting the root cause object of the alarm cluster may specifically include: first calculating a first weight value corresponding to the specified Pearson similarity based on historical alarm data. Wherein, the first weight value corresponding to the specified Pearson similarity can be calculated according to the frequency of occurrence of the specified alarm object in the historical alarm data. After the first weight value is obtained, the second weight value corresponding to the specified time difference is obtained. Among them, the value of the above-mentioned second weight value is not specifically limited, and can be set according to actual needs, for example, it can be set to 0.5. After the first weight value and the second weight value are obtained, the weighted calculation is performed on each designated Pearson similarity degree and each corresponding designated time difference according to the first weight value and the second weight value, and Get multiple weighted values. Finally, at least one designated alarm object with the highest weighted value is taken as the root cause object of the above-mentioned alarm cluster, and the root cause object of the above-mentioned alarm cluster is output. Wherein, the process of determining at least one designated alarm object with the highest weighted value as the root cause object of the alarm cluster can refer to the above-mentioned setting at least one designated alarm object with the highest root cause judgment probability value as the root cause object of the alarm cluster. No longer. In this embodiment, the obtained first weight value corresponding to the specified Pearson similarity degree and the second weight value corresponding to the specified time difference are weighted and calculated to obtain multiple corresponding weight values, and the accurate output weight value is the highest. At least one designated alarm object is used as the root cause object of the alarm cluster, which effectively realizes that the root cause object of the alarm cluster corresponding to the alarm object can be quickly and intelligently generated, which reduces the workload of operation and maintenance personnel and improves the operation and maintenance work Work efficiency.

Further, in an embodiment of the present application, the above step S610 includes:

S6100: Acquire the historical alarm data and the first quantity of the historical alarm data;

S6101: Respectively filter out the second quantity of the specified historical alarm data containing each specified alarm object from the historical alarm data;

S6102: Calculate the quotient of the second quantity of each of the designated historical alarm data and the first quantity to obtain multiple proportion values corresponding to each of the designated alarm objects;

S6103: Determine each obtained ratio as a first weight value corresponding to each designated alarm object.

As described in the foregoing steps S6100 to S6103, the foregoing step of calculating the first weight value corresponding to the specified Pearson similarity based on the historical alarm data may specifically include: first obtaining the historical alarm data and the first quantity of the foregoing historical alarm data . Among them, a timed task mechanism can be used to read historical alarm data within a preset time period according to a set time period to perform subsequent data processing and analysis. Other task data such as the execution time period of the timing task and the alarm data sampling duration can be stored in a fixed configuration file in advance. When the device for locating the root cause of an alarm in this embodiment is started for the first time, the fixed configuration file is read to obtain the time period for the execution of the timing task and register it in the timing task executor. After the timing task is triggered, the alarm data sampling duration configured in the configuration file is read, and the corresponding historical alarm data is obtained from the historical alarm number record table. Afterwards, the second quantity of the specified historical alarm data containing each specified alarm object is filtered out from the above-mentioned historical alarm data. After the second quantity is obtained, the quotient of the second quantity of each of the designated historical alarm data and the first quantity is calculated to obtain multiple proportion values corresponding to each of the designated alarm objects. Finally, when the multiple ratios are obtained, the obtained ratios are determined as the first weight value corresponding to each of the specified alarm objects, so that the weight value is calculated according to the first weight value, and then the weight value is calculated according to the weight value. Value to determine the root cause of the alarm cluster.

Further, in an embodiment of the present application, after the above step S6, the method includes:

S620: Display the root cause object of the alarm cluster;

S621: Receive a designated root cause object selected by the operation and maintenance personnel from the root cause objects of the alarm cluster;

S622: Determine the specified root cause object as the final root cause object of the alarm cluster.

As described in the above steps S620 to S622, after the root cause object of the alarm cluster is generated, the operation and maintenance personnel can further determine the final root cause object of the alarm cluster from all root cause objects. Specifically, the root cause object of the above-mentioned alarm cluster is first shown to the operation and maintenance personnel. Wherein, in addition to outputting the root cause object of the alarm cluster, the first feature and the second feature corresponding to the root cause object of the alarm cluster can also be output, or the weight value corresponding to the root cause object of the alarm cluster. Then, the designated root cause object selected by the operation and maintenance personnel from the root cause object of the above alarm cluster is received. Among them, the number of the above-mentioned designated root cause object is preferably one. In addition, operation and maintenance personnel can make manual judgments based on the root cause objects, first feature, second feature, or weight value of the above-mentioned alarm clusters, and filter some of the wrong root cause objects among the root cause objects of all alarm clusters. And then get the above-mentioned designated root cause object. Finally, the above-mentioned designated root cause object is determined as the final root cause object of the alarm cluster, so as to obtain the alarm cluster after the operation and maintenance personnel perform the screening and elimination of some of the erroneous root cause objects in the root cause objects of all the alarm clusters. The final root cause object enables the operation and maintenance personnel to locate the root cause of the alarm cluster more quickly and accurately based on the final root cause object of the above alarm cluster. For example, if the root cause object of the alarm cluster that is output and displayed is: root cause object 1, root cause object 2, root cause object 3, root cause object 4, root cause object 5, and the designated root cause selected by the operation and maintenance personnel If the object is root cause object 4, then root cause object 4 is regarded as the final root cause object of the alarm cluster.

Referring to Figure 2, an embodiment of the present application also provides a device for locating the root cause of an alarm, including:

The first obtaining module 1 is configured to obtain a specific alarm object in an alarm slice, and generate an alarm cluster according to the specific alarm object, where the specific alarm object is any alarm among all alarm objects in the alarm slice Object

The generating module 2 is used to obtain the specified alarm object in the alarm cluster, and perform finger aggregation processing on the monitoring indicators in the specified alarm object to generate corresponding entry indicators, wherein the specified alarm object is the alarm Any one of the alarm objects in all the alarm objects in the cluster;

The second obtaining module 3 is configured to obtain first indicator time series data corresponding to the specified indicator of the specified alarm object, and obtain second indicator time series data corresponding to the entry indicator of the specified alarm object;

The adjustment module 4 is configured to adjust the first time window of the first indicator time series data according to the first preset rule according to the second time window of the second indicator time series data, and calculate the specified indicator and The designated Pearson similarity between the entry indicators;

The third acquiring module 5 is configured to respectively acquire the designated Pearson similarity corresponding to each of the designated alarm objects, and the designated time difference corresponding to each of the designated Pearson similarities;

The first determination module 6 is configured to screen out at least all the specified alarm objects according to the second preset rule according to all the specified Pearson similarities and the specified time difference corresponding to each of the specified Pearson similarities. A designated alarm object is used as the root cause object of the alarm cluster, and the root cause object of the alarm cluster is output.

In this embodiment, the implementation process of the functions and roles of the first acquisition module, generation module, second acquisition module, adjustment module, third acquisition module, and first determination module in the device for locating the root cause of the above-mentioned alarm is detailed above. The implementation process corresponding to steps S1 to S6 in the method for locating the root cause of the alarm will not be repeated here.

Further, in an embodiment of the present application, the above-mentioned first acquisition module includes:

The first obtaining unit is used to obtain a specific alarm object in the alarm slice;

The first calculation unit is configured to calculate the call chain distance between each alarm object except the specific alarm object in the alarm slice and the specific alarm object;

The first screening unit is configured to cyclically perform the step of screening out the target alarm object whose call chain distance to the specific alarm object is not greater than a preset distance threshold from the alarm slice, until no target alarm object is found in the alarm slice. There is a target alarm object whose call chain distance to the specific alarm object is not greater than a preset distance threshold;

The placing unit is configured to place all the target alarm objects and the specific alarm objects obtained through screening in a preset alarm set to obtain the alarm cluster.

In this embodiment, the realization process of the functions and roles of the first acquisition unit, the first calculation unit, the first screening unit and the placement unit in the device for locating the root cause of the alarm is detailed in the corresponding method for locating the root cause of the alarm. The implementation process of steps S100 to S103 will not be repeated here.

Further, in an embodiment of the present application, the aforementioned adjustment module includes:

The second acquiring unit is configured to acquire the first time window of the first indicator time series data and the second time window of the second indicator time series data;

The adjustment unit is configured to perform sliding adjustment on the first time window according to the second time window and a preset time difference threshold, so as to control the time difference between the first time window and the second time window within the Within the range of the time difference threshold, and obtain multiple sets of designated first time windows after sliding adjustment;

The second calculation unit is configured to calculate the Pearson difference between the multiple sets of the specified indicators and the entry indicators corresponding to the multiple sets of the specified first time windows, respectively, according to the multiple sets of the specified first time windows Similarity

The second screening unit is used to screen the Pearson similarity with the largest value from the multiple groups of Pearson similarity;

The first determining unit is configured to determine the Pearson similarity degree with the largest value as the designated Pearson similarity degree.

In this embodiment, the implementation process of the functions and roles of the second acquisition unit, the adjustment unit, the second calculation unit, the second screening unit and the first determination unit in the positioning device of the above-mentioned root cause of the alarm is detailed in the above-mentioned root cause of the alarm. The implementation process of corresponding steps S400 to S404 in the positioning method is not repeated here.

Further, in an embodiment of the present application, the above-mentioned first determining module includes:

A second determining unit, configured to use the designated Pearson similarity corresponding to the designated alarm object and the designated time difference as the first feature;

The third acquiring unit is configured to acquire a second characteristic corresponding to the specified alarm object, wherein the quantity of the second characteristic includes one or more;

The calling unit is used to call a preset supervised learning algorithm to perform prediction processing on the first feature and the second feature corresponding to each specified alarm object, and calculate the root cause judgment probability corresponding to each specified alarm object. value;

The third determining unit is configured to use at least one designated alarm object with the highest root cause judgment probability value as the root cause object of the alarm cluster, and output the root cause object of the alarm cluster.

In this embodiment, the functions and functions of the second determining unit, the third acquiring unit, the invoking unit and the third determining unit in the device for locating the root cause of the alarm are detailed in the corresponding method in the method for locating the root cause of the alarm. The implementation process of steps S600 to S603 will not be repeated here.

Further, in an embodiment of the present application, the above-mentioned third determining unit includes:

The sorting subunit is used to sort all the root cause judgment probability values in order from high to low to obtain the sorting result;

The first obtaining subunit is configured to sequentially obtain a preset number of designated root cause judgment probability values starting from the root cause judgment probability value ranked first in the ranking result;

The first determining subunit is configured to use the alarm object corresponding to the obtained specified root cause judgment probability value as the root cause object of the alarm cluster.

In this embodiment, the functions and functions of the sorting subunit, the first acquiring subunit, and the first determining subunit in the device for positioning the root cause of the alarm are realized in detail in the corresponding step S6030 in the method for positioning the root cause of the alarm. The implementation process to S6032 will not be repeated here.

The third calculation unit is configured to calculate the first weight value corresponding to the specified Pearson similarity based on historical alarm data;

A fourth obtaining unit, configured to obtain a second weight value corresponding to the specified time difference;

A fourth calculation unit, configured to perform a weighted calculation on each of the designated Pearson similarity and each corresponding designated time difference according to the first weight value and the second weight value to obtain multiple weighted values;

The fourth determining unit is configured to use at least one designated alarm object with the highest weight value as the root cause object of the alarm cluster, and output the root cause object of the alarm cluster.

In this embodiment, the implementation process of the functions and roles of the third calculation unit, the fourth acquisition unit, the fourth calculation unit, and the fourth determination unit in the device for locating the root cause of the alarm is detailed in the above method for locating the root cause of the alarm. The implementation process of corresponding steps S610 to S613 in, will not be repeated here.

Further, in an embodiment of the present application, the above-mentioned third calculation unit includes:

The second obtaining subunit is configured to obtain the historical alarm data and the first quantity of the historical alarm data;

The screening subunit is used to filter the second quantity of the specified historical alarm data containing each specified alarm object from the historical alarm data;

The calculation subunit is configured to calculate the quotient of the second quantity of each of the designated historical alarm data and the first quantity to obtain multiple proportion values corresponding to each of the designated alarm objects;

The second determining subunit is configured to determine each of the obtained ratios as the first weight value corresponding to each of the designated alarm objects.

The implementation process of the functions and roles of the second acquisition subunit, the screening subunit, the calculation subunit, and the second determination subunit in the device for locating the root cause of the alarm is detailed in the corresponding steps S6100 to S6100 to the method for locating the root cause of the alarm. The implementation process of S6103 will not be repeated here.

Further, in an embodiment of the present application, the device for locating the root cause of the alarm includes:

The display module is used to display the root cause object of the alarm cluster;

The receiving module is configured to receive the designated root cause object selected by the operation and maintenance personnel from the root cause objects of the alarm cluster;

The second determining module is configured to determine the designated root cause object as the final root cause object of the alarm cluster.

In this embodiment, the implementation process of the functions and effects of the display module, the receiving module and the second determining module in the above-mentioned root-cause locating device is detailed in the implementation process corresponding to steps S620 to S622 in the above-mentioned root-cause locating method. , I won’t repeat it here.

Referring to FIG. 3, an embodiment of the present application also provides a computer device. The computer device may be a server, and its internal structure may be as shown in FIG. 3. The computer equipment includes a processor, a memory, a network interface, and a database connected through a system bus. Among them, the processor designed for the computer equipment is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer equipment is used to store data such as designated alarm objects, monitoring indicators, entry indicators, indicator time series data, designated Pearson similarity, and designated time difference. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the method for locating the root cause of the alarm shown in any of the above embodiments is realized.

The steps for the processor to execute the method for locating the root cause of the alarm include:

Those skilled in the art can understand that the structure shown in FIG. 3 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the devices and computer equipment to which the solution of the present application is applied.

An embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium may be non-volatile or volatile, and has a computer program stored thereon, which is realized when the computer program is executed by a processor. In the method for locating the root cause of the alarm shown in any of the above embodiments, the method for locating the root cause of the alarm includes:

A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing relevant hardware through a computer program. The computer program can be stored and a non-volatile computer readable storage. In the medium, when the computer program is executed, it may include the processes of the above-mentioned method embodiments. Wherein, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and/or volatile memory. Non-volatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not a limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual-rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous Link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

The above are only the preferred embodiments of this application, and do not limit the scope of this application. Any equivalent structure or equivalent process transformation made using the content of the specification and drawings of this application, or directly or indirectly applied to other related The technical field is equally included in the scope of patent protection of this application.

Claims

A method for locating the root cause of an alarm, which includes:

Acquiring a specific alarm object in an alarm slice, and generating an alarm cluster according to the specific alarm object, where the specific alarm object is any alarm object among all the alarm objects in the alarm slice;

Obtain the specified alarm object in the alarm cluster, and perform indicator aggregation processing on the monitoring indicators in the specified alarm object to generate corresponding entry indicators, where the specified alarm object is all alarm objects in the alarm cluster Any alarm object within;

Acquiring first indicator time series data corresponding to the specified indicator of the specified alarm object, and acquiring second indicator time series data corresponding to the entry indicator of the specified alarm object;

According to the second time window of the second indicator time series data, the first time window of the first indicator time series data is adjusted according to the first preset rule, and the distance between the specified indicator and the entry indicator is calculated. The specified Pearson similarity;

Respectively acquiring a designated Pearson similarity corresponding to each of the designated alarm objects, and a designated time difference corresponding to each of the designated Pearson similarities;

According to all the specified Pearson similarities and the specified time difference corresponding to each of the specified Pearson similarities, at least one specified alarm object is selected from all the specified alarm objects as the alarm according to a second preset rule The root cause object of the cluster, and output the root cause object of the alarm cluster.
The method for locating the root cause of an alarm according to claim 1, wherein the step of obtaining a specific alarm object in an alarm slice and generating an alarm cluster according to the specific alarm object comprises:

Obtain a specific alarm object in the alarm slice;

Respectively calculating the call chain distance between each alarm object except the specific alarm object in the alarm slice and the specific alarm object;

The step of cyclically performing the step of filtering out the target alarm object whose call chain distance to the specific alarm object is not greater than the preset distance threshold from the alarm slice is performed until there is no contact with the specific alarm object in the alarm slice. The target alarm object whose call chain distance is not greater than the preset distance threshold;

Place all the target alarm objects and the specific alarm objects obtained by screening in a preset alarm set to obtain the alarm cluster.
The method for locating the root cause of an alarm according to claim 1, wherein the first time window of the time series data of the first indicator is calculated according to the first preset rule according to the second time window of the time series data of the second indicator. The step of adjusting the window and calculating the designated Pearson similarity between the designated index and the entry index includes:

Acquiring a first time window of the first indicator time series data, and a second time window of the second indicator time series data;

According to the second time window and the preset time difference threshold, the first time window is slidingly adjusted to control the time difference between the first time window and the second time window to be within the range of the time difference threshold And get multiple sets of designated first time windows after sliding adjustment;

Calculating the Pearson similarity between the multiple sets of the specified indicators and the entry indicators corresponding to the multiple sets of the specified first time windows according to the multiple sets of the specified first time windows;

Selecting the Pearson similarity with the largest value from the multiple groups of Pearson similarity;

The Pearson similarity degree with the largest value is determined as the designated Pearson similarity degree.
The method for locating the root cause of an alarm according to claim 1, wherein the specified time difference corresponding to all the specified Pearson similarities and each of the specified Pearson similarities is determined according to a second preset rule The step of screening out at least one specified alarm object as the root cause object of the alarm cluster from all the specified alarm objects and outputting the root cause object of the alarm cluster includes:

Taking the specified Pearson similarity corresponding to the specified alarm object and the specified time difference as the first feature;

Acquiring a second feature corresponding to the specified alarm object, where the number of the second feature includes one or more;

Invoking a preset supervised learning algorithm to perform prediction processing on the first feature and the second feature corresponding to each specified alarm object, and calculate the root cause judgment probability value corresponding to each specified alarm object;

The at least one designated alarm object with the highest root cause judgment probability value is taken as the root cause object of the alarm cluster, and the root cause object of the alarm cluster is output.
The method for locating the root cause of an alarm according to claim 4, wherein the at least one designated alarm object with the highest root cause judgment probability value is used as the root cause object of the alarm cluster, and the information of the alarm cluster is output The steps for root cause objects include:

Sorting all the root cause judgment probability values in descending order to obtain the sorting result;

Starting from the root cause judgment probability value ranked first in the ranking result, sequentially obtain a preset number of designated root cause judgment probability values;

The alarm object corresponding to the obtained specified root cause judgment probability value is taken as the root cause object of the alarm cluster.
The method for locating the root cause of an alarm according to claim 1, wherein the specified time difference corresponding to all the specified Pearson similarities and each of the specified Pearson similarities is determined according to a second preset rule The step of screening out at least one specified alarm object as the root cause object of the alarm cluster from all the specified alarm objects and outputting the root cause object of the alarm cluster includes:

Calculating a first weight value corresponding to the specified Pearson similarity based on historical alarm data;

Obtaining a second weight value corresponding to the specified time difference;

Performing a weighted calculation on each of the designated Pearson similarity and each corresponding designated time difference according to the first weight value and the second weight value to obtain multiple weighted values;

The at least one designated alarm object with the highest weight value is taken as the root cause object of the alarm cluster, and the root cause object of the alarm cluster is output.
The method for locating the root cause of an alarm according to claim 1, wherein the specified time difference corresponding to all the specified Pearson similarities and each of the specified Pearson similarities is determined according to a second preset rule After filtering out at least one specified alarm object as the root cause object of the alarm cluster from all the specified alarm objects, and outputting the root cause object of the alarm cluster, the step includes:

Display the root cause object of the alarm cluster;

Receiving the designated root cause object selected by the operation and maintenance personnel from the root cause objects of the alarm cluster;

The designated root cause object is determined as the final root cause object of the alarm cluster.
A device for locating the root cause of an alarm, which includes:

The first acquisition module is configured to acquire a specific alarm object in an alarm slice, and generate an alarm cluster according to the specific alarm object, where the specific alarm object is any alarm object among all the alarm objects in the alarm slice ；

The generating module is used to obtain the specified alarm object in the alarm cluster, and perform indicator aggregation processing on the monitoring indicators in the specified alarm object to generate corresponding entry indicators, wherein the specified alarm object is the alarm cluster Any one of the alarm objects in all alarm objects;

The second acquisition module is configured to acquire the first indicator time series data corresponding to the specified indicator of the specified alarm object, and obtain the second indicator time series data corresponding to the entry indicator of the specified alarm object;

The adjustment module is configured to adjust the first time window of the first indicator time series data according to the first preset rule according to the second time window of the second indicator time series data, and calculate the specified indicator and the time window Specify the Pearson similarity between the entry indicators;

The third acquiring module is configured to respectively acquire the designated Pearson similarity degree corresponding to each of the designated alarm objects, and the designated time difference corresponding to each of the designated Pearson similarity degrees;

The first determining module is configured to filter out at least one of all the specified alarm objects according to the second preset rule based on all the specified Pearson similarities and the specified time difference corresponding to each of the specified Pearson similarities. Specify an alarm object as the root cause object of the alarm cluster, and output the root cause object of the alarm cluster.
The device for locating the root cause of an alarm according to claim 8, wherein the first obtaining module comprises:

The first obtaining unit is used to obtain a specific alarm object in the alarm slice;

The first calculation unit is configured to calculate the call chain distance between each alarm object except the specific alarm object in the alarm slice and the specific alarm object;

The first screening unit is configured to cyclically perform the step of screening out the target alarm object whose call chain distance to the specific alarm object is not greater than a preset distance threshold from the alarm slice, until no target alarm object is found in the alarm slice. There is a target alarm object whose call chain distance to the specific alarm object is not greater than a preset distance threshold;

The placing unit is configured to place all the target alarm objects and the specific alarm objects obtained through screening in a preset alarm set to obtain the alarm cluster.
The device for locating the root cause of an alarm according to claim 8, wherein the adjustment module comprises:

The second acquiring unit is configured to acquire the first time window of the first indicator time series data and the second time window of the second indicator time series data;

The adjustment unit is configured to perform sliding adjustment on the first time window according to the second time window and a preset time difference threshold, so as to control the time difference between the first time window and the second time window within the Within the range of the time difference threshold, and obtain multiple sets of designated first time windows after sliding adjustment;

The second calculation unit is configured to calculate the Pearson difference between the multiple sets of the specified indicators and the entry indicators corresponding to the multiple sets of the specified first time windows, respectively, according to the multiple sets of the specified first time windows Similarity

The second screening unit is used to screen the Pearson similarity with the largest value from the multiple groups of Pearson similarity;

The first determining unit is configured to determine the Pearson similarity degree with the largest value as the designated Pearson similarity degree.
A computer device includes a memory and a processor, and a computer program is stored in the memory. When the processor executes the computer program, a method for locating the root cause of an alarm is implemented:

Wherein, the method for locating the root cause of the alarm includes:

Acquiring a specific alarm object in an alarm slice, and generating an alarm cluster according to the specific alarm object, where the specific alarm object is any alarm object among all the alarm objects in the alarm slice;

Obtain the specified alarm object in the alarm cluster, and perform indicator aggregation processing on the monitoring indicators in the specified alarm object to generate corresponding entry indicators, where the specified alarm object is all alarm objects in the alarm cluster Any alarm object within;

Acquiring first indicator time series data corresponding to the specified indicator of the specified alarm object, and acquiring second indicator time series data corresponding to the entry indicator of the specified alarm object;

According to the second time window of the second indicator time series data, the first time window of the first indicator time series data is adjusted according to the first preset rule, and the distance between the specified indicator and the entry indicator is calculated. The specified Pearson similarity;

Respectively acquiring a designated Pearson similarity corresponding to each of the designated alarm objects, and a designated time difference corresponding to each of the designated Pearson similarities;

According to all the specified Pearson similarities and the specified time difference corresponding to each of the specified Pearson similarities, at least one specified alarm object is selected from all the specified alarm objects as the alarm according to a second preset rule The root cause object of the cluster, and output the root cause object of the alarm cluster.
The computer device according to claim 11, wherein the step of obtaining a specific alarm object in an alarm slice, and generating an alarm cluster according to the specific alarm object, comprises:

Obtain a specific alarm object in the alarm slice;

Respectively calculating the call chain distance between each alarm object except the specific alarm object in the alarm slice and the specific alarm object;

The step of cyclically performing the step of filtering out the target alarm object whose call chain distance to the specific alarm object is not greater than the preset distance threshold from the alarm slice is performed until there is no contact with the specific alarm object in the alarm slice. The target alarm object whose call chain distance is not greater than the preset distance threshold;

Place all the target alarm objects and the specific alarm objects obtained by screening in a preset alarm set to obtain the alarm cluster.
11. The computer device according to claim 11, wherein the first time window of the first indicator time series data is adjusted according to a first preset rule according to the second time window of the second indicator time series data, And the step of calculating the designated Pearson similarity between the designated index and the entry index includes:

Acquiring a first time window of the first indicator time series data, and a second time window of the second indicator time series data;

According to the second time window and the preset time difference threshold, the first time window is slidingly adjusted to control the time difference between the first time window and the second time window to be within the range of the time difference threshold And get multiple sets of designated first time windows after sliding adjustment;

Calculating the Pearson similarity between the multiple sets of the specified indicators and the entry indicators corresponding to the multiple sets of the specified first time windows according to the multiple sets of the specified first time windows;

Selecting the Pearson similarity with the largest value from the multiple groups of Pearson similarity;

The Pearson similarity degree with the largest value is determined as the designated Pearson similarity degree.
11. The computer device according to claim 11, wherein the specified time difference corresponding to all the specified Pearson similarities and each of the specified Pearson similarities is selected from all the specified Pearson similarities according to a second preset rule. The step of screening out at least one designated alarm object as the root cause object of the alarm cluster from the alarm objects and outputting the root cause object of the alarm cluster includes:

Taking the specified Pearson similarity corresponding to the specified alarm object and the specified time difference as the first feature;

Acquiring a second feature corresponding to the specified alarm object, where the number of the second feature includes one or more;

Invoking a preset supervised learning algorithm to perform prediction processing on the first feature and the second feature corresponding to each specified alarm object, and calculate the root cause judgment probability value corresponding to each specified alarm object;

The at least one designated alarm object with the highest root cause judgment probability value is taken as the root cause object of the alarm cluster, and the root cause object of the alarm cluster is output.
The computer device according to claim 14, wherein the at least one designated alarm object with the highest root cause judgment probability value is used as the root cause object of the alarm cluster, and the information of the root cause object of the alarm cluster is output The steps include:

Sorting all the root cause judgment probability values in descending order to obtain the sorting result;

Starting from the root cause judgment probability value ranked first in the ranking result, sequentially obtain a preset number of designated root cause judgment probability values;

The alarm object corresponding to the obtained specified root cause judgment probability value is taken as the root cause object of the alarm cluster.
A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, a method for locating the root cause of an alarm is realized, wherein the method for locating the root cause of an alarm includes the following steps:

Acquiring a specific alarm object in an alarm slice, and generating an alarm cluster according to the specific alarm object, where the specific alarm object is any alarm object among all the alarm objects in the alarm slice;

Obtain the specified alarm object in the alarm cluster, and perform indicator aggregation processing on the monitoring indicators in the specified alarm object to generate corresponding entry indicators, where the specified alarm object is all alarm objects in the alarm cluster Any alarm object within;

Acquiring first indicator time series data corresponding to the specified indicator of the specified alarm object, and acquiring second indicator time series data corresponding to the entry indicator of the specified alarm object;

According to the second time window of the second indicator time series data, the first time window of the first indicator time series data is adjusted according to the first preset rule, and the distance between the specified indicator and the entry indicator is calculated. The specified Pearson similarity;

Respectively acquiring a designated Pearson similarity corresponding to each of the designated alarm objects, and a designated time difference corresponding to each of the designated Pearson similarities;

According to all the specified Pearson similarities and the specified time difference corresponding to each of the specified Pearson similarities, at least one specified alarm object is selected from all the specified alarm objects as the alarm according to a second preset rule The root cause object of the cluster, and output the root cause object of the alarm cluster.
The computer-readable storage medium according to claim 16, wherein the step of obtaining a specific alarm object in an alarm slice, and generating an alarm cluster according to the specific alarm object, comprises:

Obtain a specific alarm object in the alarm slice;

Respectively calculating the call chain distance between each alarm object except the specific alarm object in the alarm slice and the specific alarm object;

The step of cyclically performing the step of filtering out the target alarm object whose call chain distance to the specific alarm object is not greater than the preset distance threshold from the alarm slice is performed until there is no contact with the specific alarm object in the alarm slice. The target alarm object whose call chain distance is not greater than the preset distance threshold;

Place all the target alarm objects and the specific alarm objects obtained by screening in a preset alarm set to obtain the alarm cluster.
The computer-readable storage medium according to claim 16, wherein the second time window according to the second indicator time series data is compared to the first time window of the first indicator time series data according to a first preset rule The steps of adjusting and calculating the designated Pearson similarity between the designated index and the entry index include:

Acquiring a first time window of the first indicator time series data, and a second time window of the second indicator time series data;

According to the second time window and the preset time difference threshold, the first time window is slidingly adjusted to control the time difference between the first time window and the second time window to be within the range of the time difference threshold And get multiple sets of designated first time windows after sliding adjustment;

Calculating the Pearson similarity between the multiple sets of the specified indicators and the entry indicators corresponding to the multiple sets of the specified first time windows according to the multiple sets of the specified first time windows;

Selecting the Pearson similarity with the largest value from the multiple groups of Pearson similarity;

The Pearson similarity degree with the largest value is determined as the designated Pearson similarity degree.
15. The computer-readable storage medium according to claim 16, wherein the specified time difference corresponding to all the specified Pearson similarities and each of the specified Pearson similarities is selected from all the specified Pearson similarities according to the second preset rule The step of screening at least one specified alarm object as the root cause object of the alarm cluster from the specified alarm objects and outputting the root cause object of the alarm cluster includes:

Taking the designated Pearson similarity corresponding to the designated alarm object and the designated time difference as the first feature;

Acquiring a second feature corresponding to the specified alarm object, where the number of the second feature includes one or more;

Invoking a preset supervised learning algorithm to perform prediction processing on the first feature and the second feature corresponding to each specified alarm object, and calculate the root cause judgment probability value corresponding to each specified alarm object;

The at least one designated alarm object with the highest root cause judgment probability value is taken as the root cause object of the alarm cluster, and the root cause object of the alarm cluster is output.
The computer-readable storage medium according to claim 19, wherein the at least one designated alarm object with the highest root cause judgment probability value is used as the root cause object of the alarm cluster, and the root cause of the alarm cluster is outputted. Depending on the target's steps, including:

Sorting all the root cause judgment probability values in descending order to obtain the sorting result;

Starting from the root cause judgment probability value ranked first in the ranking result, sequentially obtain a preset number of designated root cause judgment probability values;

The alarm object corresponding to the obtained specified root cause judgment probability value is taken as the root cause object of the alarm cluster.