Detailed description of the invention
For making the purpose of the present invention, technical scheme and advantage clearer, below in conjunction with accompanying drawing and enforcement
Example, is described in further detail the present invention.Should be appreciated that detailed description of the invention described herein
Only in order to explain the present invention, do not limit protection scope of the present invention.
Fig. 1 shows the working environment schematic diagram in one embodiment of the invention.Terminal 101, terminal 102, clothes
It is mutual that business device 100 carries out information by network, such as between terminal 101 and terminal 102, terminal 101 with service
Between device 100, to carry out information between terminal 102 and server 100 mutual.Wherein, terminal 101 and terminal 102
Between can be carried out by server 100 alternately, it is also possible to carried out by other server.Server 100
Information between terminal 101 and terminal 102 can be monitored alternately, simultaneously also to server 100 and terminal
Information between 101, between server 100 and terminal 102 is monitored alternately, additionally, server 100 is also
Can be the monitoring of terminal 101,102 offer user side, such as terminal 101 can send ping to server 100
Instructing with the connectedness between detecting terminal 101 and server 100 and time delay situation, server 100 returns to terminal
The ping command response returned can be saved on this server 100, is analyzed network condition for follow-up.
It addition, server 100 may be provided for other various possible monitor modes, the most above-mentioned background section
The service end monitoring mentioned and access relation monitor.Embodiment of the present invention scheme refers to for server 100
The each treatment technology monitoring data obtained, the program can be embodied on this server 100, it is also possible to
It is implemented on other equipment, as long as being obtained in that relevant monitoring data.
Applying as a example by above-mentioned server 100 by embodiment of the present invention scheme, Fig. 2 shows in an embodiment
The structural representation of this server.As in figure 2 it is shown, this server include being connected by system bus processor,
Supply module, storage medium, internal memory and communication interface.Wherein, the storage medium storage of server has operation
System, data base and a kind of network monitoring data processing means, this device is used for realizing a kind of network monitoring number
According to processing method.The communication interface of server for terminal 101,102 and other network equipments or server
It is attached and communicates.
In conjunction with the schematic diagram shown in Fig. 1, Fig. 2, below to network monitoring data processing method and network monitoring number
Illustrate according to each embodiment of processing means.
Fig. 3 shows the schematic flow sheet of the network monitoring data processing method in an embodiment.Such as Fig. 3
Shown in, the method in the present embodiment includes step:
Step S301: obtaining monitoring data and access relation link, described supervision packet includes monitoring information
And warning information;
Step S302: when getting warning information, obtains the time point place time that this warning information occurs
All monitoring data in window;
Step S303: according to the framework layer information that each monitoring data in described time window are corresponding, by time described
Between each monitoring data association in window to described access relation link;
Step S304: according to each monitoring class monitoring data in described access relation link, described time window
Each monitoring data in described time window are associated analyzing by type, it is thus achieved that original alarm information;
Step S305: according to described original alarm information, described access relation link in described time window
Warning information carries out information convergence, it is thus achieved that the warning information after convergence.
According to the scheme of the embodiment of the present invention as above, it is to obtain monitoring data from each monitoring system
After, when receiving warning information, utilize choosing of access relation and time window, prison that will be originally isolated
Control data associate, and combined with access relation is associated analyzing, it is thus achieved that original alarm information is also entered accordingly
Row information restrains, and can effectively reduce the alarm data of original isolated control point, and can improve alarm
Degree of accuracy, the discovery time of acceleration problem.
Wherein, above-mentioned time window can be set based on being actually needed.In a concrete example, permissible
Choosing time of described time point is time window in front and time at the time range of rear each timeslice.One
The concrete duration scope of individual timeslice, can be set in conjunction with being actually needed.
Owing to when network monitoring, the type of each monitoring data can be different, and some warning information is base
Cause in original alarm information, therefore, above-mentioned be associated analyze time, can be to use following each mode
Any one of carry out:
According to monitoring data type, by described time window corresponding to current type monitoring data in, time
Between preceding warning information be defined as original alarm information;
According to monitoring data type, by described time window corresponding to current type monitoring data in, position
Warning information in the relational link bottom of each access relation link is defined as original alarm information;
According to the type of described monitoring data, by monitoring data corresponding to current type in described time window,
It is positioned at relational link bottom and time preceding warning information is defined as original alarm information.
Network monitoring data processing method based on the embodiment of the present invention as above.Below in conjunction with therein
Concrete example carries out illustrated in greater detail.In following exemplary illustration, first monitoring data and access are closed
Tethers explains.
As it has been described above, current various network monitoring systems can be carried out for the Internet or mobile Internet
Difference stresses direction, the monitoring of different monitoring type, thus obtains various monitoring data, and these monitor data
Include monitoring information and warning information.For some of them monitoring type, may only monitor information
And no alarm information, and for some monitoring type, existing monitoring information may have again warning information.
The such as monitoring information of change daily record just only change, but these monitoring information are likely to be and certain of its place
Certain warning information in individual time window is associated.Therefore, in the scheme of the embodiment of the present invention, prison
Control information and warning information are required for paying close attention to.
In embodiment of the present invention scheme when realizing, first need to obtain monitoring from the monitoring system that each are different
Data, supervision packet here has included monitoring information and warning information.Obtaining from variant monitoring system
When taking monitoring data, different calling can be used from accordingly to monitor system based on the difference of each monitoring system
System obtains.Meanwhile, need to obtain access relation link from corresponding monitoring system, access relation link reflects
Whole the Internet or the topological connection relation of mobile Internet network request.
Based on this, Fig. 4 shows the topological structure schematic diagram of network access relation in a concrete example,
It is an original access relation topological diagram.Based on this topological structure, the conversion to its relation that conducts interviews,
The access relation link schematic diagram obtained is as it is shown in figure 5, it includes 3 access relation link: Yi Tiaobao
Included WEB layer, logical layer 1, Cache1, data Layer 1, one include WEB layer, logical layer 2,
Cache layer 1, data Layer 1, other one includes WEB layer, logical layer 1, Cache layer 2, data
Layer 2.
In each access relation link, each node can be respectively only some control points and alarm point,
To monitor accordingly, the control point of each node in each access relation link shown in Fig. 5 and alarm point
Schematic diagram as shown in Figure 6.In shown in Fig. 6, solid black round dot represents original alarm point, soft dot
Represent association other alarm, other such as square, rectangle, triangle, parallelogram, ellipse
Shape represents different types of control point respectively, such as, can represent hard-disk capacity monitoring, process monitoring, return
Code monitoring, intermodule call monitoring, other monitoring etc., certainly, based on actual monitored demand, it is also possible to
Having the monitoring of other greater number types, this is not limited by the embodiment of the present invention.
After obtaining monitoring data from each monitoring system, when getting warning information, obtain this warning information
All monitoring data in the time point place time window occurred, this time window is to exist the time of described time point
Before and the time at the time range of rear each timeslice.As a example by a length of 5 minutes of timeslice, if should
The time point that warning information occurs is 11:00, then selected time window is 10:55-11:05, if this alarm letter
The time point that breath occurs is 11:02, then selected time window is 10:57-11:07.
After all monitoring data in time window in obtaining this time window, i.e. can be based on these monitoring data
Corresponding framework layer information, by each monitoring data association in this time window to each access relation link.By
It is all to report module (joint from single ip address in each monitoring data (including monitoring information and warning information)
Point), and send after collecting in units of module, and on the Naming conventions of module, can with framework layer information,
And framework layer information can therefore, it can realize the most easily with one_to_one corresponding to accessing on relational link
Each monitoring data associate with access relation link.One of Article 1 access relation link shown in Fig. 6
The schematic diagram of the warning information in time window is not as it is shown in fig. 7, for the purpose of concise description, have in Fig. 7
Other kinds of monitoring information is shown.
Can see from Fig. 7, based on existing alarm logic, in this time window, 10 alarms can be sent altogether
Information, but substantially, the root producing warning information is the original alarm that data Layer 1 produces, due to
Interdependence effect between business, other 9 alarms are actually made in the relatedness of this original alarm
With lower generation.Due to day by day strengthening and type of service increasing of business association, this due to
The number of associated alarm produced by business association also can be huger, and current alarm logic does not only have
These warning information are associated, and along with quantity huge, to the row of alarm problem of warning information
Look into and also bring difficulty.
And based on the application scheme, all monitoring data associations in selected time window are closed to accessing
Behind tethers road, can be based on this access relation link and the incidence relation of variant type service, to each visit
Ask that the monitoring data on relational link are associated analyzing, find out original alarm information, shown in Fig. 7
Solid black round dot in data Layer 1 i.e. represents original alarm information.When being associated analyzing, simple one
For Dian, for same type of business, following manner can be used to determine original alarm information:
One way in which, can be the type according to monitoring data, current by corresponding in described time window
In the monitoring data of type, time preceding warning information be defined as original alarm information;
Another way, can be the type according to monitoring data, will correspond to current class in described time window
In the monitoring data of type, the warning information of the relational link bottom that is positioned at each access relation link be defined as original
Warning information;
Yet another approach, can be the type according to monitoring data, will correspond to current class in described time window
In the monitoring data of type, it is positioned at relational link bottom and time preceding warning information is defined as original alarm letter
Breath.
But, those skilled in the art know, based on known access relation link and each type of service
Difference, the incidence relation between warning information and the monitoring information of variant type service may district
Not, different kinds of business monitors data can be analyzed to use different association analysis modes, this
This is not specifically limited by bright embodiment.
After association analysis goes out original alarm information, can based on this original alarm information in this time window its
The warning information that this type of service in the access relation link at place is relevant carries out information convergence, it is thus achieved that convergence
After warning information.Concrete then can be only to retain the original alarm information determined, and by association other
Warning information proposes.The schematic diagram of the warning information after convergence as shown in Figure 8, as seen from Figure 8, to alarm
After information convergence, only remain original alarm information, thus greatly reduce alarm amount, in conjunction with above-mentioned alarm
Information associates with access relation link, such that it is able to promote the degree of accuracy of alarm energetically, accelerates alarm problem
Discovery time.
By foregoing it is known that embodiment of the present invention scheme is actually based on what access relation was carried out
Three-dimensional monitors, and accordingly, Fig. 9 shows the principle schematic of a concrete example neutral body monitoring scheme.
Schematic diagram in conjunction with Fig. 9 is visible, and the application scheme is will to be originally dispersed in each framework layer by access relation
Monitoring data according to regular hour window sequence integration, it is achieved that the association between individual monitoring data, thus
Can be derived that monitoring alarm source the most accurately, it is achieved accurate associated alarm, reduce alarm amount, improve
Alarm degree of accuracy.
Based on the thought identical with network monitoring data processing method as above, the embodiment of the present invention also carries
For a kind of network monitoring data processing means.Figure 10 shows at the network monitoring data in an embodiment
The structural representation of reason device.
As shown in Figure 10, the network monitoring data processing means in the present embodiment includes:
Data acquisition module 1001, is used for obtaining monitoring data and access relation link, described monitoring data
Including monitoring information and warning information;
Time window monitoring data acquisition module 1002, for getting warning information at data acquisition module 1001
Time, obtain all monitoring data in the time point place time window that this warning information occurs;
Relating module 1003, for the framework layer information corresponding according to each monitoring data in described time window,
By each monitoring data association in described time window to described access relation link;
Analyze module 1004, for according to respectively monitoring data in described access relation link, described time window
Monitoring type be associated analyzing to each control data in described time window, it is thus achieved that original alarm information;
Convergence module 1005, is used for according to described original alarm information, described access relation link time described
Between warning information in window carry out information convergence, it is thus achieved that the warning information after convergence.
According to the scheme of the embodiment of the present invention as above, it is to obtain monitoring data from each monitoring system
After, when receiving warning information, utilize choosing of access relation and time window, prison that will be originally isolated
Control data associate, and combined with access relation is associated analyzing, it is thus achieved that original alarm information is also entered accordingly
Row information restrains, and can effectively reduce the alarm data of original isolated control point, and can improve alarm
Degree of accuracy, the discovery time of acceleration problem.
Wherein, above-mentioned time window can be set based on being actually needed.In a concrete example, permissible
Choosing time of described time point is time window in front and time at the time range of rear each timeslice.One
The concrete time span of individual timeslice, can be set in conjunction with being actually needed, for example, it can be set to be 5 points
Clock or other times.
Owing to when network monitoring, the type of each monitoring data can be different, and some warning information is base
Cause in original alarm information, therefore, all monitoring data associations in selected time window are arrived
After access relation link, can based on this access relation link and the incidence relation of variant type service,
It is associated the monitoring data on each access relation link analyzing, finds out original alarm information.Therefore,
Analysis module 1004 is when being associated analyzing, simply for a bit, for same type of business, permissible
Use following each mode to determine original alarm information:
One way in which, analyzing module 1004 can be the type according to monitoring data, by described time window
In corresponding to current type monitoring data in, time preceding warning information be defined as original alarm information;
Another way, analyzing module 1004 can be the type according to monitoring data, by described time window
Corresponding in the monitoring data of current type, be positioned at each access relation link relational link bottom alarm letter
Breath is defined as original alarm information;
Yet another approach, analyzing module 1004 can be the type according to monitoring data, by described time window
Corresponding in the monitoring data of current type, be positioned at relational link bottom and time preceding warning information determines
For original alarm information.
But, those skilled in the art know, based on known access relation link and each type of service
Difference, the incidence relation between warning information and the monitoring information of variant type service may district
Not, different kinds of business monitors data can be analyzed to use different association analysis modes, this
This is not specifically limited by bright embodiment.
One of ordinary skill in the art will appreciate that all or part of flow process realizing in above-described embodiment method,
Can be by computer program and complete to instruct relevant hardware, described program can be stored in a calculating
In machine read/write memory medium, this program is upon execution, it may include such as the flow process of the embodiment of above-mentioned each method.
Wherein, described storage medium can be magnetic disc, CD, read-only store-memory body (Read-Only Memory,
Or random store-memory body (Random Access Memory, RAM) etc. ROM).
Each technical characteristic of embodiment described above can combine arbitrarily, for making description succinct, the most right
The all possible combination of each technical characteristic in above-described embodiment is all described, but, if these skills
There is not contradiction in the combination of art feature, is all considered to be the scope that this specification is recorded.
Embodiment described above only have expressed the several embodiments of the present invention, and it describes more concrete and detailed,
But can not therefore be construed as limiting the scope of the patent.It should be pointed out that, for this area
For those of ordinary skill, without departing from the inventive concept of the premise, it is also possible to make some deformation and change
Entering, these broadly fall into protection scope of the present invention.Therefore, the protection domain of patent of the present invention should be with appended power
Profit requires to be as the criterion.