CN104572391B - Monitoring alarm tactics configuring method and device, monitoring alarm method and device - Google Patents
Monitoring alarm tactics configuring method and device, monitoring alarm method and device Download PDFInfo
- Publication number
- CN104572391B CN104572391B CN201310486294.9A CN201310486294A CN104572391B CN 104572391 B CN104572391 B CN 104572391B CN 201310486294 A CN201310486294 A CN 201310486294A CN 104572391 B CN104572391 B CN 104572391B
- Authority
- CN
- China
- Prior art keywords
- time point
- monitored
- alarm
- monitoring
- index
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Landscapes
- Alarm Systems (AREA)
- Telephonic Communication Services (AREA)
Abstract
The invention discloses a kind of monitoring alarm tactics configuring methods, comprising the following steps: obtains the corresponding historical data of index to be monitored in system and its institute's bearer service；Historical data of the same index to be monitored at each time point is analyzed, determines corresponding monitoring type, and calculates same index to be monitored in the reasonable waving interval at each time point；According to monitoring type and reasonable waving interval calculated, corresponding alarm monitoring strategy is generated.The method and device of alarm is monitored the invention also discloses a kind of monitoring alarm strategy configuration device and using monitoring alarm strategy configuration.The present invention not only realizes the automation and intelligence of the configuration of monitoring alarm strategy, and also improves the accuracy of monitoring.
Description
Technical field
The present invention relates to computer field more particularly to a kind of monitoring alarm tactics configuring methods and device, monitoring alarm
Method and device.
Background technique
Existing monitoring alarm is by manually according to the characteristics of software systems and its business carried and relevant people
The experience of member, is arranged corresponding monitored object, and the corresponding warning strategies of human configuration.In existing monitoring method, alarm
The human configuration of strategy, will expend a large amount of manpower, and the later period also needs constantly to safeguard, the accuracy of configuration strategy is also very
It is difficult to guarantee.
Summary of the invention
The main purpose of technical solution of the present invention is to provide a kind of monitoring alarm tactics configuring method and device, monitoring alarm
Method and device, it is intended to not only realize the automation and intelligence of warning strategies, and also improve the accuracy of monitoring.
To achieve the above object, the invention proposes a kind of monitoring alarm tactics configuring methods, comprising the following steps:
The corresponding historical data of index to be monitored in acquisition system and its institute's bearer service；
Historical data of the same index to be monitored at each time point is analyzed, determines corresponding monitoring type, and calculate same
Reasonable waving interval of the index to be monitored at each time point；
According to monitoring type and reasonable waving interval calculated, corresponding alarm monitoring strategy is generated.
The invention also provides a kind of monitoring alarm method, the monitoring alarm strategy configured based on above-mentioned configuration method；
The monitoring alarm method the following steps are included:
The operation data of index to be monitored is obtained in real time；
For the operation data corresponding time point according to the index to be monitored, the time point corresponding alarm plan is obtained
Slightly；
It is monitored according to the warning strategies according to the operation data that the warning strategies treat monitor control index, and full
When sufficient alarm conditions, alarm is generated.
Accordingly, the present invention also provides a kind of monitoring alarm strategy configuration devices, comprising:
Data acquisition module, for obtaining the corresponding historical data of index to be monitored in system and its institute's bearer service；
Computing module determines corresponding monitoring class for analyzing historical data of the same index to be monitored at each time point
Type, and same index to be monitored is calculated in the reasonable waving interval at each time point；
Policy generation module, for generating corresponding alarm prison according to monitoring type and reasonable waving interval calculated
Control strategy.
Accordingly, the present invention also provides a kind of monitoring alarm devices, comprising:
Data acquisition module, for obtaining the operation data of index to be monitored in real time；
Strategy obtains module and obtains the time for the operation data corresponding time point according to the index to be monitored
The corresponding warning strategies of point；
Alarm module, the operation data for treating monitor control index according to the warning strategies are monitored, and are being met
When alarm conditions, alarm is generated.
The present invention is monitored the historical data of all kinds of indexs of computer software and its business carried, so
Probability statistical analysis is carried out to the historical data monitored afterwards, obtains the fluctuation characteristic of index entirety to be monitored, and according to the wave
Dynamic feature, configures corresponding monitoring alarm strategy, then treats monitor control index using the warning strategies and is monitored and alerts, no
But the automation and intelligence of warning strategies are realized, and also improves the accuracy of monitoring.
Detailed description of the invention
Fig. 1 is the flow diagram of monitoring alarm tactics configuring method first embodiment of the present invention；
Fig. 2 is in monitoring alarm tactics configuring method of the present invention, index to be monitored at some time point on historical data
Schematic diagram；
Fig. 3 is the history that same index to be monitored is analyzed in monitoring alarm tactics configuring method of the present invention on each time point
Data determine corresponding monitoring type, and calculate the process of reasonable waving interval of the same index to be monitored on each time point
Schematic diagram；
Fig. 4 is the flow diagram of monitoring alarm tactics configuring method second embodiment of the present invention；
Fig. 5 is the reasonable waving interval that monitoring alarm tactics configuring method according to a first embodiment of the present invention is configured
Floor map；
Fig. 6 is that reasonable waving interval shown in fig. 5 carries out the result schematic diagram after clustering；
Fig. 7 is that the rationally undulating value up and down of waving interval and the distribution in cluster line of demarcation is illustrated after Fig. 6 carries out clustering
Figure；
Fig. 8 is the result schematic diagram after reasonable waving interval shown in Fig. 7 carries out curve fitting；
Fig. 9 is the flow diagram of monitoring alarm method preferred embodiment of the present invention；
Figure 10 is the functional block diagram of monitoring alarm strategy configuration device first embodiment of the present invention；
Figure 11 is the functional block diagram of computing module in monitoring alarm strategy configuration device of the present invention；
Figure 12 is the functional block diagram of monitoring alarm strategy configuration device second embodiment of the present invention；
Figure 13 is the functional block diagram of monitoring alarm device preferred embodiment of the present invention.
The embodiments will be further described with reference to the accompanying drawings for the realization, the function and the advantages of the object of the present invention.
Specific embodiment
Technical solution of the present invention is further illustrated with reference to the accompanying drawings and specific embodiments of the specification.It should be appreciated that this
Locate described specific embodiment to be only used to explain the present invention, be not intended to limit the present invention.
Main idea is that provide a kind of monitoring method of business, to computer software and its carried
The historical data of all kinds of indexs of business is monitored, and then carries out probability statistical analysis to the historical data monitored, is obtained
The fluctuation characteristic of index entirety to be monitored, and according to the fluctuation characteristic, corresponding monitoring alarm strategy is configured, the announcement is then utilized
It is pithy slightly to treat monitor control index and be monitored and alert, the automation and intelligence of warning strategies are not only realized, but also mention
The high accuracy of monitoring.
Before describing the specific embodiment of the invention, the proprietary term that the present invention uses is introduced one by one:
Monitoring: refer to the monitoring of all kinds of indexs to be monitored to computer software and its institute's bearer service；
Alarm: refer to the warning for monitoring and being issued when all kinds of indexs to be monitored are abnormal；
Monitored object: refer to all kinds of indexs to be monitored of computer software and its institute's bearer service；
Threshold alarm: referring to the algorithm being monitored to the data volume of monitored object, when the data volume of monitored object is more than to set
When fixed threshold value, alert；
Average value alarm: refer to the calculation being monitored to the fluctuation ratio (comparing with historical data) of monitored object data volume
Method is alerted when fluctuating threshold value of the ratio more than setting；
Warning strategies: refer to the setting to the selection for alerting algorithm used in monitored object and the threshold value for alerting algorithm；
Hypothetical inspection: refer in mathematical statistics and a kind of overall method is inferred by sample according to certain assumed condition.Tool
The body practice is: making certain it is assumed that being denoted as H0 to the totality studied according to the needs of problem；Suitable statistic is chosen, this
The selection of statistic will make when assuming that H0 is set up, and be distributed as known；By the sample surveyed, the value of statistic is calculated,
And it is tested according to previously given significance, make refusal or receives to assume the judgement of H0, such as Kolmogorov-
Ke Smirnov(Er Monuofu-Vladimir Smirnov) examine etc.；
Normal distribution: if stochastic variable X one location parameter of obedience is μ, the probability distribution that scale parameter is б, and it is general
Rate density function are as follows:
Then this stochastic variable is known as normal random variable, and the distribution that normal random variable is obeyed is known as normal state point
Cloth is denoted as X~N (μ, б2), claim X Normal Distribution.When μ=0 at that time, б=1, normal distribution just becomes standardized normal distribution；
Limit error: P | X- μ | < б } ≈ 68.26%, P | X- μ | < 2 б } ≈ 95.45%, P | X- μ | < 3 б } ≈ 99.73%,
3 б are referred to as limit error, and the value of X is almost both fallen within centered on μ, using 3 б as in the section of radius, i.e. 3 σ principles；
Clustering: refer to that cluster is to sort data into a process of different class or cluster, so in the same cluster
Object have a very big similitude, and the object between different clusters has a very big diversity, including hierarchical clustering method, decomposition method plus
Enter method, dynamic state clustering, clustering ordered samples, there is overlapping to cluster and fuzzy clustering etc.；
Curve is like conjunction: referring to and selects curve type appropriate to be fitted observation data, and analyzes two with the curvilinear equation of fitting
Relationship between variable, common method such as least square method etc..
Below with reference to above-mentioned proprietary term, the course of work of monitoring alarm of the present invention is described in detail.
Referring to Fig.1, monitoring alarm tactics configuring method first embodiment of the present invention is proposed.The alarm monitoring side of the embodiment
Method the following steps are included:
Step S110, the corresponding historical data of index to be monitored in system and its institute's bearer service is obtained；
When the performance of judgement system and its ability of service bearer, it will be judged by each performance indicator.Therefore, first
Index to be monitored is first set.Then it according to index to be monitored, obtains in system operation, index to be monitored is at each time point
On historical data.As shown in Fig. 2, its index to be monitored is the access request amount of certain business, what which was monitored
Time point is 0-300 time point.Curve 2a is the historical data of the index to be monitored at time point X1, such as before 0-30 days
Historical data.Curve 2b is the historical data of the index to be monitored on 0-300 time point.
Step S120, historical data of the same index to be monitored on each time point is analyzed, determines corresponding monitoring type,
And calculate reasonable waving interval of the same index to be monitored on each time point；
Historical data of the data volume of various indexs at same time point usually exists when by system and its institute's bearer service
Fluctuation in a certain range, i.e., whole fluctuation range are limited.So by according to the historical data monitored, to same index to be monitored
Business datum on each time point carries out probability statistical analysis, so that the fluctuation for finding upper index to be monitored of each time point is special
Sign, then determines corresponding monitoring type and reasonable waving interval according to fluctuation characteristic.
Step S130, according to monitoring type and reasonable waving interval calculated, corresponding alarm monitoring strategy is generated.
Then according to the monitoring type and reasonable waving interval calculated judged, the alarm prison on each time point is generated
Control strategy, for being used when alarm monitoring.
The present invention is monitored the historical data of all kinds of indexs of computer software and its business carried, so
Probability statistical analysis is carried out to the historical data monitored afterwards, obtains the fluctuation characteristic of index entirety to be monitored, and according to the wave
Dynamic feature, configures corresponding monitoring alarm strategy, then treats monitor control index using the warning strategies and is monitored and alerts, no
But the automation and intelligence of warning strategies are realized, and also improves the accuracy of monitoring.
Further, include: referring to Fig. 3, above-mentioned steps S120
Step S121, by assuming that property is examined, judge whether index to be monitored obeys just in the historical data at each time point
State distribution, and count the time point of all Normal Distributions；
By taking the calculating of the historical data on time point X1 as an example, as shown in Fig. 2, curve 2a is the access request amount of certain business
Historical data at time point X1, such as the historical data before 0-30 days.Curve 2b is that the access request amount of certain business exists
Historical data on 0-300 time point.By assuming that property is examined, whether the historical data that judgment curves 2a is indicated obeys normal state
Distribution.Then successively judge other all time points historical data whether Normal Distribution, while counting all obediences
The time point of normal distribution.
Step S122, whether the time point of all Normal Distributions is greater than or equal to a preset threshold；It is to be transferred to step
Otherwise rapid S123 is transferred to step S124；
In the present embodiment, a preset threshold is arranged according to concrete condition, such as A*80%, which is index to be monitored
All time points.If A is 288, find that the time point of all Normal Distributions is 250 after statistics, then the time point
Significantly greater than 288*80%, so judging that the time point of all Normal Distributions is greater than or equal to a preset threshold.
Step S123, setting monitoring type is average value alarm, and it is [- 3 σ/μ ,+3 σ/μ] that reasonable waving interval, which is arranged,；
When being greater than or equal to a preset threshold at the time point of all Normal Distributions, alerted using average value, and set
Setting reasonable waving interval is [- 3 σ/μ ,+3 σ/μ].
Step S124, setting monitoring type is threshold alarm, and it is [+3 σ/of μ -3 σ, μ] that reasonable waving interval, which is arranged,.
When the time point of all Normal Distributions is less than a preset threshold, using threshold alarm, and reasonable wave is set
Dynamic section is [+3 σ/of μ -3 σ, μ].
The present invention will also provide a kind of monitoring alarm tactics configuring method second embodiment.As shown in figure 4, the embodiment
Monitoring alarm tactics configuring method includes:
Step S210, the corresponding historical data of index to be monitored in system and its institute's bearer service is obtained；
Step S220, historical data of the same index to be monitored at each time point is analyzed, determines corresponding monitoring type, and
Same index to be monitored is calculated in the reasonable waving interval at each time point；
Step S230, the undulating value up and down of the reasonable waving interval at each time point is subjected to clustering respectively, obtains wave
The central value and division boundary point value of dynamic value demarcation interval and each demarcation interval；
As shown in figure 5, the fluctuation ratio situation due to different time points often has a certain difference, if each time
Point all configures corresponding warning strategies, then needing a large amount of monitoring alarm strategy configurations in different time periods, is not only unfavorable for accusing
The management of alert configuration, but also certain pressure will also be caused to subsequent monitoring.It therefore, will also be right after step S220
The undulating value up and down of the reasonable waving interval at each time point carries out clustering respectively, obtains undulating value demarcation interval and each division
The central value and division boundary point value in section.As shown in fig. 6, it is the cluster analysis result of reasonable waving interval shown in fig. 5.
It will be appreciated from fig. 6 that most fluctuation ratio concentrates between 5%~60% in reasonable waving interval in Fig. 5, pass through cluster point
Analysis, is segmented into three sections, is respectively:
A, [0,18.5%] cluster centre a0 is 7.96%；
B, (18.5%, 41.5%] cluster centre b0 is 28.93%；
C, (41.5%, 100%] cluster centre c0 is 55.58%.
Then the undulating value that each cluster section is replaced with each cluster centre, so that numerous fluctuation ratios be made to be classified as three classes.
Step S240, according to division boundary point value, by the undulating value up and down of the reasonable waving interval on each time point
It carries out curve fitting respectively, obtains the intersection point of matched curve and each cluster line of demarcation, then obtain the intersection point corresponding time
Point, and according to the time point and the central value of each demarcation interval, repartition reasonable waving interval；
As shown in fig. 7, section a, section b and section c are by three cluster sections after clustering；A0, b0, c0 points
It is not the cluster centre value of section a, section b and section c, also referred to as clusters line of demarcation；Curve 2c is index to be monitored at 0-300
The curve of reasonable waving interval on time point.As shown in Figure 7, after by clustering, curve 2c and cluster line of demarcation are (also
Line represented by a0, b0, c0) intersection position cluster line of demarcation above and below recurrent fluctuations, it is difficult to determine specific separation.
Therefore, after clustering to fluctuation ratio, also by by carrying out 10 rank curve matchings to the fluctuation data in Fig. 7, song is found
The fluctuation data of line 2c and the intersection point of Cluster Decomposition line, to obtain final cluster centre value.As shown in figure 8, section a, area
Between b and section c be by three cluster sections after clustering；A0, b0, c0 are the poly- of section a, section b and section c respectively
Class central value, also referred to as cluster line of demarcation；Curve 2c is the song of reasonable waving interval of the index to be monitored on 0-300 time point
Line；S1, S2, S3, S4 are the fluctuation data of curve 2c and the intersection point of Cluster Decomposition line after curve matching.Then according to being found
Intersection point obtains final time interval and its cluster centre value:
(1), time point [0,163], cluster centre 7.96%；
(2), time point (163,195], cluster centre 28.93%；
(3), time point (195,253], cluster centre 55.58%；
(4), time point (253,288], cluster centre 28.93%.
According to the time interval of above-mentioned acquisition and its cluster centre value, corresponding reasonable waving interval is generated:
(1), (0 point, 13 points 35 minutes], waving interval be up and down fluctuation 7.96%；
(2), (13: 35,16 points 15 minutes], waving interval is fluctuation 28.93% up and down；
(3), (16: 15,21 points 05 minute], waving interval is fluctuation 55.58% up and down；
(4), (21: 05,23 points 55 minutes], waving interval is fluctuation 28.93% up and down.
Step S250, according to monitoring type and reasonable waving interval calculated, corresponding monitoring alarm strategy is generated.
The warning strategies that the present embodiment generates are by the undulating value clustering up and down of the reasonable waving interval on each time point
Afterwards, less undulating value cluster section is formed, to no longer need a large amount of monitoring alarm strategy configurations in different time periods, not only
Conducive to the management of alarm configuration, but also very big pressure will also be mitigated to subsequent monitoring.Moreover, the embodiment of the present invention is also logical
Cross and carry out curve fitting to the undulating value up and down of the reasonable waving interval after clustering, obtain correct time section and rationally
Waving interval improves the accuracy of monitoring alarm strategy configuration, further improves the efficiency of service alarm monitoring.
Based on the warning strategies that above-mentioned business monitoring warning strategies configuration method is configured, the present invention also provides a kind of industry
Business alarm monitoring method.As shown in figure 9, the service alarm monitoring method the following steps are included:
Step S410, the operation data of index to be monitored is obtained in real time；
According to set index to be monitored, its corresponding operation data of detecting real-time.For example, when index to be monitored is certain
The request amount of business then grabs the operation data then when detecting the business and requesting.
Step S420, according to the operation data corresponding time point of the index to be monitored, it is corresponding to obtain the time point
Warning strategies；
According to above-mentioned grabbed operation data, the time point where operation data is obtained, and phase is obtained according to the time
The warning strategies answered.The warning strategies are the strategies of the configured generation of method through the above configuration.The warning strategies include monitoring
It alerts algorithm and alerts the setting of the threshold value of algorithm.
Step S430, it is supervised according to the warning strategies according to the operation data that the warning strategies treat monitor control index
Control, and when meeting alarm conditions, generate alarm.
Then business datum is monitored according to acquired warning strategies, by taking threshold alarm algorithm as an example, if detecting
When the fluctuation ratio of the index to be monitored arrived is greater than the threshold value of setting, then alarm is generated；If the wave of the index to be monitored detected
When dynamic ratio is less than or equal to the threshold value of setting, then alarm is not generated.
The warning strategies that the present invention is generated using above-mentioned configuration method are monitored and alert to business to be monitored, not only
The automation and intelligence of the configuration of monitoring alarm strategy are realized, and also improves the efficiency of business monitoring.
Corresponding above method embodiment, the present invention also provides a kind of monitoring alarm strategy configuration device first embodiments.
As shown in Figure 10, the business monitoring warning strategies configuration device of the embodiment includes:
Data acquisition module 110, for obtaining the corresponding historical data of index to be monitored in system and its institute's bearer service；
Computing module 120, for analyze same index to be monitored at every point of time on historical data, judge corresponding
Alarm type, and calculate same index to be monitored at every point of time on reasonable waving interval；
Policy generation module 130, for generating corresponding alarm according to alarm type and reasonable waving interval calculated
Monitoring strategies.
When the performance of judgement system and its ability of service bearer, it will be judged by each performance indicator.Therefore, first
Index to be monitored is first set.Then data acquisition module 110 obtains in system operation, according to index to be monitored wait supervise
Control historical data of the index on each time point.Computing module 120 is according to the historical data monitored, to same index to be monitored
Business datum on each time point carries out probability statistical analysis, so that the fluctuation for finding upper index to be monitored of each time point is special
Sign, then determines corresponding monitoring type and reasonable waving interval according to fluctuation characteristic.Finally, 130 basis of policy generation module
The monitoring type and reasonable waving interval calculated judged, generates the alarm monitoring strategy on each time point, for alarm
It is used when monitoring.
The present invention is monitored the historical data of all kinds of indexs of computer software and its business carried, so
Probability statistical analysis is carried out to the historical data monitored afterwards, obtains the fluctuation characteristic of index entirety to be monitored, and according to the wave
Dynamic feature, configures corresponding monitoring alarm strategy, then treats monitor control index using the warning strategies and is monitored and alerts, no
But the automation and intelligence of warning strategies are realized, and also improves the accuracy of monitoring.
Further, referring to Fig.1 1, above-mentioned computing module 120 includes:
Computing unit 121, be used for by assuming that property examine, judge index to be monitored each time point historical data whether
Normal Distribution, and count the time point of all Normal Distributions；
Setting unit 123, when the time point for all Normal Distributions is greater than or equal to a preset threshold, using flat
Mean value alarm, and it is [- 3 σ/μ ,+3 σ/μ] that reasonable waving interval, which is arranged,；It is pre- less than one when the time point of all Normal Distributions
If when threshold value, using threshold alarm, and it is [+3 σ/of μ -3 σ, μ] that reasonable waving interval, which is arranged,.
Referring to Fig.1 2, propose business monitoring warning strategies configuration device second embodiment of the present invention.Based on the above embodiment,
The business monitoring warning strategies configuration device of the present embodiment further include:
Cluster Analysis module 140, for clustering the undulating value up and down of the reasonable waving interval at each time point respectively
Analysis obtains the central value of undulating value demarcation interval and each demarcation interval and divides boundary point value；
Curve fitting module 150 is used for point value of demarcating according to the division, by the reasonable waving interval on each time point
Upper and lower undulating value carries out curve fitting respectively, obtains the intersection point of matched curve and each cluster line of demarcation, then obtains the intersection point
Corresponding time point, and according to the time point and the central value of each demarcation interval, repartition reasonable waving interval.
As shown in figure 5, the fluctuation ratio situation due to different time points often has a certain difference, if each time
Point all configures corresponding warning strategies, then needing a large amount of monitoring alarm strategy configurations in different time periods, is not only unfavorable for accusing
The management of alert configuration, but also certain pressure will also be caused to subsequent monitoring.Therefore, Cluster Analysis module 140 will also be right
The undulating value up and down of the reasonable waving interval at each time point carries out clustering respectively, obtains undulating value demarcation interval and each division
The central value and division boundary point value in section.As shown in fig. 6, it is the cluster analysis result of reasonable waving interval shown in fig. 5.
It will be appreciated from fig. 6 that most fluctuation ratio concentrates between 5%~60% in reasonable waving interval in Fig. 5, pass through cluster point
Analysis, is segmented into three sections, is respectively:
A, [0,18.5%] cluster centre a0 is 7.96%；
B, (18.5%, 41.5%] cluster centre b0 is 28.93%；
C, (41.5%, 100%] cluster centre c0 is 55.58%.
Then the undulating value that each cluster section is replaced with each cluster centre, so that numerous fluctuation ratios be made to be classified as three classes.
As shown in fig. 7, section a, section b and section c are by three cluster sections after clustering；A0, b0, c0 points
It is not the cluster centre value of section a, section b and section c, also referred to as clusters line of demarcation；Curve 2c is index to be monitored at 0-300
The curve of reasonable waving interval on time point.As shown in Figure 7, after by clustering, curve 2c and cluster line of demarcation are (also
Line represented by a0, b0, c0) intersection position cluster line of demarcation above and below recurrent fluctuations, it is difficult to determine specific separation.
Therefore, after clustering to fluctuation ratio, curve fitting module 150 will also be by carrying out 10 ranks to the fluctuation data in Fig. 7
Curve matching finds the fluctuation data of curve 2c and the intersection point of Cluster Decomposition line, to obtain final cluster centre value.Such as figure
Shown in 8, section a, section b and section c are by three cluster sections after clustering；A0, b0, c0 are section a, area respectively
Between b and section c cluster centre value, also referred to as cluster line of demarcation；Curve 2c is conjunction of the index to be monitored on 0-300 time point
Manage the curve of waving interval；S1, S2, S3, S4 are the fluctuation data of curve 2c and the intersection point of Cluster Decomposition line after curve matching.So
Afterwards according to the intersection point found, final time interval and its cluster centre value are obtained:
(1), time point [0,163], cluster centre 7.96%；
(2), time point (163,195], cluster centre 28.93%；
(3), time point (195,253], cluster centre 55.58%；
(4), time point (253,288], cluster centre 28.93%.
According to the time interval of above-mentioned acquisition and its cluster centre value, corresponding reasonable waving interval is generated:
(1), (0 point, 13 points 35 minutes], waving interval be up and down fluctuation 7.96%；
(2), (13: 35,16 points 15 minutes], waving interval is fluctuation 28.93% up and down；
(3), (16: 15,21 points 05 minute], waving interval is fluctuation 55.58% up and down；
(4), (21: 05,23 points 55 minutes], waving interval is fluctuation 28.93% up and down.
The warning strategies that the present embodiment generates are by the undulating value clustering up and down of the reasonable waving interval on each time point
Afterwards, less undulating value cluster section is formed, to no longer need a large amount of monitoring alarm strategy configurations in different time periods, not only
Conducive to the management of alarm configuration, but also very big pressure will also be mitigated to subsequent monitoring.Moreover, the embodiment of the present invention is also logical
Cross and carry out curve fitting to the undulating value up and down of the reasonable waving interval after clustering, obtain correct time section and rationally
Waving interval improves the accuracy of monitoring alarm strategy configuration, further improves the efficiency of service alarm monitoring.
Accordingly, the strategy configured based on above-mentioned configuration method, the present invention also provides a kind of monitoring alarm devices.Such as
Shown in Figure 13, which includes:
Detecting module 210, for obtaining the operation data of index to be monitored in real time；
Strategy obtains module 220, for the operation data corresponding time point according to the index to be monitored, when obtaining this
Between put corresponding warning strategies；
Alarm module 230, for treating the operation number of monitor control index according to the warning strategies according to the warning strategies
According to being monitored, and when meeting alarm conditions, alarm is generated.
Detecting module 210 will be according to set index to be monitored, its corresponding operation data of detecting real-time.For example, working as
Index to be monitored is that the request amount of certain business then grabs the operation data then when detecting the business and requesting.Strategy obtains
Modulus block 220 obtains the time point where operation data according to above-mentioned grabbed operation data, and obtains phase according to the time
The warning strategies answered.The warning strategies are the strategies of the configured generation of method through the above configuration.The warning strategies include monitoring
It alerts algorithm and alerts the setting of the threshold value of algorithm.Then alarm module 230 is then according to acquired warning strategies to business
Data are monitored, by taking threshold alarm algorithm as an example, if the fluctuation ratio of the index to be monitored detected is greater than the threshold value of setting
When, then generate alarm；If the fluctuation ratio of the index to be monitored detected is less than or equal to the threshold value of setting, announcement is not generated
It is alert.
The warning strategies that the present invention is generated using above-mentioned configuration method are monitored and alert to business to be monitored, not only
The automation and intelligence of the configuration of monitoring alarm strategy are realized, and also improves the efficiency of business monitoring.
It should be noted that, in this document, the terms "include", "comprise" or its any other variant are intended to non-row
His property includes, so that the process, method, article or the device that include a series of elements not only include those elements, and
And further include other elements that are not explicitly listed, or further include for this process, method, article or device institute it is intrinsic
Element.In the absence of more restrictions, the element limited by sentence " including one ... ", it is not excluded that including
There is also other identical elements in the process, method of the element, article or device.
The serial number of the above embodiments of the invention is only for description, does not represent the advantages or disadvantages of the embodiments.
Through the above description of the embodiments, those skilled in the art can be understood that above-described embodiment side
Method can be realized by means of software and necessary general hardware platform, naturally it is also possible to by hardware, but in many cases
The former is more preferably embodiment.Based on this understanding, technical solution of the present invention substantially in other words does the prior art
The part contributed out can be embodied in the form of software products, and the monitoring alarm strategy configuration device and monitoring device will
It is realized by some instructions, which is stored in a storage medium (such as ROM/RAM, magnetic disk, CD), sets for terminal
Standby (can be mobile phone, computer, server or the network equipment etc.) executes method described in each embodiment of the present invention.
The above description is only a preferred embodiment of the present invention, is not intended to limit the scope of the invention, all utilizations
Equivalent structure or equivalent flow shift made by description of the invention and accompanying drawing content is applied directly or indirectly in other correlations
Technical field, be included within the scope of the present invention.
Claims (12)
1. a kind of monitoring alarm tactics configuring method, which comprises the following steps:
The corresponding historical data of index to be monitored in acquisition system and its institute's bearer service；
Historical data of the same index to be monitored at each time point is analyzed, determines corresponding monitoring type, and is calculated same wait supervise
Index is controlled in the reasonable waving interval at each time point；
According to monitoring type and reasonable waving interval calculated, corresponding alarm monitoring strategy is generated；
Wherein, historical data of the same index to be monitored of analysis at each time point, determines corresponding monitoring type, and calculate
Reasonable waving interval of the same index to be monitored at each time point, comprising:
By assuming that property is examined, judge index to be monitored each time point historical data whether Normal Distribution, and count
The time point of all Normal Distributions；
Judge whether the time point of all Normal Distributions is greater than or equal to a preset threshold, obtains judging result；
Corresponding monitoring type is determined according to the judging result, and the reasonable waving interval at each time point is set.
2. monitoring alarm tactics configuring method according to claim 1, which is characterized in that described according to the judging result
It determines corresponding monitoring type, and the reasonable waving interval at each time point is set, comprising:
It is greater than or equal to the preset threshold when the time point of all Normal Distributions, monitoring type is set for average value announcement
It is alert, and the reasonable waving interval at each time point is set；The average value alarm is the hair when fluctuating threshold value of the ratio more than setting
Raw alarm；
When being less than the preset threshold at the time point of all Normal Distributions, setting monitoring type is threshold alarm, and is set
Set the reasonable waving interval at each time point.
3. monitoring alarm tactics configuring method according to claim 2, which is characterized in that the monitoring type is average value
When alarm, the reasonable waving interval at corresponding time point is [- 3 σ/μ ,+3 σ/μ], and wherein μ and σ is index to be monitored when each
Between the mean value and standard deviation of historical data put.
4. monitoring alarm tactics configuring method according to claim 2, which is characterized in that the monitoring type is threshold value announcement
When alert, the reasonable waving interval at corresponding time point is [+3 σ of μ -3 σ, μ], and wherein μ and σ is index to be monitored at each time point
Historical data mean value and standard deviation.
5. monitoring alarm tactics configuring method according to claim 1 to 4, which is characterized in that it is described calculate it is same to
Monitor control index is after the reasonable waving interval at each time point further include:
The undulating value up and down of the reasonable waving interval at each time point is subjected to clustering respectively, obtain undulating value demarcation interval and
The central value and division boundary point value of each demarcation interval；
According to division boundary point value, the undulating value up and down of the reasonable waving interval on each time point is subjected to curve respectively and is intended
Close, obtain the intersection point of matched curve and each cluster line of demarcation, then obtain the intersection point corresponding time point, and according to it is described when
Between put and each demarcation interval central value, repartition reasonable waving interval.
6. a kind of alarm monitoring method, which is characterized in that the announcement configured based on any configuration method of claim 1-5
It is pithy to omit；The alarm monitoring method the following steps are included:
The operation data of index to be monitored is obtained in real time；
According to the operation data corresponding time point of the index to be monitored, the time point corresponding warning strategies are obtained；
It is monitored according to the operation data that the warning strategies treat monitor control index, and when meeting alarm conditions, generates announcement
It is alert.
7. a kind of monitoring alarm strategy configuration device characterized by comprising
Data acquisition module, for obtaining the corresponding historical data of index to be monitored in system and its institute's bearer service；
Computing module determines corresponding monitoring type for analyzing historical data of the same index to be monitored at each time point, and
Same index to be monitored is calculated in the reasonable waving interval at each time point；
Policy generation module, for generating corresponding alarm monitoring plan according to monitoring type and reasonable waving interval calculated
Slightly；
The computing module includes computing unit and setting unit；
The computing unit is used for by assuming that property inspection, judges whether index to be monitored takes in the historical data at each time point
From normal distribution, and count the time point of all Normal Distributions；
The setting unit is sentenced for judging that the time point of all Normal Distributions is greater than or equal to a preset threshold
Disconnected result；Corresponding monitoring type is set according to the judging result, and the reasonable waving interval at each time point is set.
8. monitoring alarm strategy configuration device according to claim 7, which is characterized in that the setting unit, for working as
The time point of all Normal Distributions is greater than or equal to the preset threshold, and setting monitoring type is average value alarm monitoring,
And the reasonable waving interval that each time point is arranged is [- 3 σ/μ ,+3 σ/μ]；It is less than institute when the time point of all Normal Distributions
When stating preset threshold, monitoring type is set for threshold alarm monitoring, and the reasonable waving interval that each time point is arranged is [μ -3 σ, μ
+3σ]；Wherein μ and σ is mean value and standard deviation of the index to be monitored in the historical data at each time point；The average value alarm
To alert when fluctuating threshold value of the ratio more than setting.
9. monitoring alarm strategy configuration device according to claim 8, which is characterized in that the monitoring type is average value
When alarm, the reasonable waving interval at corresponding time point is [- 3 σ/μ ,+3 σ/μ], and wherein μ and σ is index to be monitored when each
Between the mean value and standard deviation of historical data put.
10. monitoring alarm strategy configuration device according to claim 8, which is characterized in that the monitoring type is threshold value
When alarm, the reasonable waving interval at corresponding time point is [+3 σ of μ -3 σ, μ], and wherein μ and σ is index to be monitored in each time
The mean value and standard deviation of the historical data of point.
11. according to the described in any item monitoring alarm strategy configuration devices of claim 7-10, which is characterized in that the configuration dress
It sets further include:
Cluster Analysis module is obtained for the undulating value up and down of the reasonable waving interval at each time point to be carried out clustering respectively
It obtains the central value of undulating value demarcation interval and each demarcation interval and divides boundary point value；
Curve fitting module is used for according to point value of demarcating is divided, by the undulating value up and down of the reasonable waving interval on each time point
It carries out curve fitting respectively, obtains the intersection point of matched curve and each cluster line of demarcation, then obtain the intersection point corresponding time
Point, and according to the time point and the central value of each demarcation interval, repartition reasonable waving interval.
12. a kind of warning monitor device characterized by comprising
Data acquisition module, for obtaining the operation data of index to be monitored in real time；
Strategy obtains module and obtains the time point pair for the operation data corresponding time point according to the index to be monitored
The warning strategies answered；The warning strategies are the warning strategies that are configured based on any configuration method of claim 1-5；
Alarm module, the operation data for treating monitor control index according to the warning strategies are monitored, and are alerted meeting
When condition, alarm is generated.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310486294.9A CN104572391B (en) | 2013-10-16 | 2013-10-16 | Monitoring alarm tactics configuring method and device, monitoring alarm method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310486294.9A CN104572391B (en) | 2013-10-16 | 2013-10-16 | Monitoring alarm tactics configuring method and device, monitoring alarm method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104572391A CN104572391A (en) | 2015-04-29 |
| CN104572391B true CN104572391B (en) | 2019-03-15 |
Family
ID=53088525
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310486294.9A Active CN104572391B (en) | 2013-10-16 | 2013-10-16 | Monitoring alarm tactics configuring method and device, monitoring alarm method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104572391B (en) |
Families Citing this family (29)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105187788B (en) * | 2015-09-02 | 2018-12-07 | 台山核电合营有限公司 | A kind of method and system of analog machine real-time data record and displaying |
| CN105096217B (en) * | 2015-09-08 | 2019-05-21 | 深圳供电局有限公司 | A kind of automatic power-measuring terminal communications status prediction technique and system |
| CN106571934B (en) * | 2015-10-08 | 2019-08-27 | 中国移动通信集团四川有限公司 | A kind of worksheet processing method and apparatus based on regression analysis |
| CN105930245B (en) * | 2015-12-16 | 2018-12-28 | 中国银联股份有限公司 | A kind of transaction terminal service condition monitoring method and system |
| CN106293976A (en) * | 2016-08-15 | 2017-01-04 | 东软集团股份有限公司 | Application performance Risk Forecast Method, device and system |
| CN106407082B (en) * | 2016-09-30 | 2019-06-14 | 国家电网公司 | A kind of information system alarm method and device |
| CN106878064B (en) * | 2017-01-16 | 2021-08-13 | 腾讯科技（深圳）有限公司 | Data monitoring method and device |
| CN107659466B (en) * | 2017-09-25 | 2020-10-23 | 四川长虹电器股份有限公司 | System and method for quantifying and calculating throughput capacity service level of cloud system |
| CN108255667B (en) * | 2017-12-27 | 2021-07-06 | 创新先进技术有限公司 | Service monitoring method and device and electronic equipment |
| CN110262947B (en) * | 2018-03-12 | 2022-05-17 | 腾讯科技（深圳）有限公司 | Threshold warning method and device, computer equipment and storage medium |
| CN108874642A (en) * | 2018-05-25 | 2018-11-23 | 平安科技（深圳）有限公司 | SQL method for monitoring performance, device, computer equipment and storage medium |
| CN108846669B (en) * | 2018-05-29 | 2022-05-10 | 中国建设银行股份有限公司 | Security monitoring method, system, device and storage medium for transaction |
| CN108829535A (en) * | 2018-06-08 | 2018-11-16 | 上海擎创信息技术有限公司 | Data processing method, terminal and computer readable storage medium |
| CN109327334A (en) * | 2018-09-30 | 2019-02-12 | 山东中创软件商用中间件股份有限公司 | A kind of alarm method being directed to equipment performance, device and equipment |
| CN111275466B (en) * | 2018-12-04 | 2023-12-05 | 北京京东振世信息技术有限公司 | Method and device for early warning of out-of-date single quantity |
| CN109612760A (en) * | 2018-12-19 | 2019-04-12 | 中国科学院长春光学精密机械与物理研究所 | A kind of Working condition detecting method of mechanical equipment, device and storage medium |
| CN110020769A (en) * | 2018-12-19 | 2019-07-16 | 阿里巴巴集团控股有限公司 | A kind of business risk monitoring method, device and equipment |
| CN110005659B (en) * | 2019-04-08 | 2020-08-11 | 深圳市华星光电技术有限公司 | Real-time monitoring method for air cylinder |
| CN112532404B (en) * | 2019-09-17 | 2023-09-22 | 中国移动通信集团广东有限公司 | Data monitoring method and device and electronic equipment |
| CN111061615A (en) * | 2019-12-25 | 2020-04-24 | 北京每日优鲜电子商务有限公司 | Data monitoring method and device for data warehouse, server and storage medium |
| CN111459746B (en) * | 2020-02-27 | 2023-06-27 | 北京三快在线科技有限公司 | Alarm generation method, device, electronic equipment and readable storage medium |
| CN113495909A (en) * | 2020-04-06 | 2021-10-12 | 中信百信银行股份有限公司 | Customer complaint single quantity early warning method and device, electronic equipment and storage medium |
| CN111597088A (en) * | 2020-05-15 | 2020-08-28 | 广州探途网络技术有限公司 | Data warehouse data monitoring method, warehouse system and electronic equipment |
| CN111882289B (en) * | 2020-07-01 | 2023-11-14 | 国网河北省电力有限公司经济技术研究院 | Device and method for measuring and calculating project data auditing index interval |
| CN111882112B (en) * | 2020-07-01 | 2024-05-10 | 北京嘀嘀无限科技发展有限公司 | Method and system for predicting arrival time |
| CN113760637A (en) * | 2020-09-25 | 2021-12-07 | 天翼智慧家庭科技有限公司 | Method and apparatus for determining a threshold value for threshold class monitoring data |
| CN112948210A (en) * | 2021-02-26 | 2021-06-11 | 深圳依时货拉拉科技有限公司 | Method and device for detecting QPS index abnormity and computer equipment |
| CN115174354A (en) * | 2022-07-22 | 2022-10-11 | 科来网络技术股份有限公司 | Platform side data alarm method and device, monitoring equipment and readable storage medium |
| CN116185783B (en) * | 2023-04-24 | 2023-07-14 | 山东溯源安全科技有限公司 | Monitoring method and device of electronic equipment, electronic equipment and storage medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1472674A (en) * | 2003-08-04 | 2004-02-04 | 西安交通大学 | Self-adapt dynamic apparatus status alarming method based on probability model |
| JP2009211658A (en) * | 2008-03-06 | 2009-09-17 | Nec Corp | Failure detection device, failure detection method and program therefor |
| CN101964997A (en) * | 2009-07-21 | 2011-02-02 | 中国移动通信集团黑龙江有限公司 | Method and device for carrying out early warning on network performance |
| CN102080569A (en) * | 2010-12-10 | 2011-06-01 | 煤炭科学研究总院重庆研究院 | Distributed optical fiber temperature measurement-based fire early warning method for belt conveyor |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN100442726C (en) * | 2006-06-13 | 2008-12-10 | 华为技术有限公司 | Method for monitoring network service fault |
| CN102740247B (en) * | 2011-04-15 | 2015-07-01 | 中国移动通信集团山东有限公司 | Method and device for generating warning message |
| CN103200039B (en) * | 2012-01-09 | 2017-01-18 | 阿里巴巴集团控股有限公司 | Data monitoring method and device |
-
2013
- 2013-10-16 CN CN201310486294.9A patent/CN104572391B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1472674A (en) * | 2003-08-04 | 2004-02-04 | 西安交通大学 | Self-adapt dynamic apparatus status alarming method based on probability model |
| JP2009211658A (en) * | 2008-03-06 | 2009-09-17 | Nec Corp | Failure detection device, failure detection method and program therefor |
| CN101964997A (en) * | 2009-07-21 | 2011-02-02 | 中国移动通信集团黑龙江有限公司 | Method and device for carrying out early warning on network performance |
| CN102080569A (en) * | 2010-12-10 | 2011-06-01 | 煤炭科学研究总院重庆研究院 | Distributed optical fiber temperature measurement-based fire early warning method for belt conveyor |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104572391A (en) | 2015-04-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104572391B (en) | Monitoring alarm tactics configuring method and device, monitoring alarm method and device | |
| Charrad et al. | NbClust: an R package for determining the relevant number of clusters in a data set | |
| CN106209432B (en) | Network equipment inferior health method for early warning and device based on dynamic threshold | |
| CN112188531B (en) | Abnormality detection method, abnormality detection device, electronic apparatus, and computer storage medium | |
| CN108206747B (en) | Alarm generation method and system | |
| CN106844138A (en) | O＆M warning system and method | |
| CN116304766B (en) | Multi-sensor-based quick assessment method for state of switch cabinet | |
| CN110086649A (en) | Detection method, device, computer equipment and the storage medium of abnormal flow | |
| CN109491850A (en) | A kind of disk failure prediction technique and device | |
| CN105871634B (en) | Detect the method for cluster exception and the system of application, management cluster | |
| CN110210508A (en) | Model generating method, anomalous traffic detection method, device, electronic equipment, computer readable storage medium | |
| CN108572905B (en) | Monitoring method and system based on distributed computation | |
| CN108880845A (en) | A kind of method and relevant apparatus of information alert | |
| CN112596990B (en) | Alarm storm processing method and device and terminal equipment | |
| CN107436277A (en) | The single index data quality control method differentiated based on similarity distance | |
| CN112989332B (en) | Abnormal user behavior detection method and device | |
| US20150205856A1 (en) | Dynamic brownian motion with density superposition for abnormality detection | |
| CN115759729A (en) | Disaster risk early warning management system based on algorithm and prediction method | |
| CN108809760A (en) | The control method and device in sampling period in sampled-data system | |
| CN113271224A (en) | Node positioning method and device, storage medium and electronic device | |
| CN107276779A (en) | A kind of monitoring method, system and equipment | |
| CN114707834A (en) | Alarm reminding method and device and storage medium | |
| CN110182871A (en) | A kind of method for treating water and terminal based on full-automatic medicine system | |
| CN113032239A (en) | Risk prompting method and device, electronic equipment and storage medium | |
| CN110677271B (en) | Big data alarm method, device, equipment and storage medium based on ELK |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |