CN107885634A - The treating method and apparatus of abnormal information in monitoring - Google Patents
The treating method and apparatus of abnormal information in monitoring Download PDFInfo
- Publication number
- CN107885634A CN107885634A CN201610872019.4A CN201610872019A CN107885634A CN 107885634 A CN107885634 A CN 107885634A CN 201610872019 A CN201610872019 A CN 201610872019A CN 107885634 A CN107885634 A CN 107885634A
- Authority
- CN
- China
- Prior art keywords
- information
- dimension
- abnormal information
- abnormal
- business
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
- G06F11/3072—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
- G06F11/3082—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting the data filtering being achieved by aggregating or compressing the monitored data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3055—Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3089—Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
- G06F2201/875—Monitoring of systems including the internet
Abstract
The disclosure discloses a kind for the treatment of method and apparatus of abnormal information in monitoring.Methods described includes：Receive the abnormal information that client is sent and check instruction, check that instruction obtains the abnormal information exported in monitoring according to the abnormal information；It polymerize the abnormal information and obtains batch processing information corresponding to the abnormal information；Check that instruction sends the batch processing information to the client according to the abnormal information.Thus, so that the abnormal information carried out in client, which is checked, to be realized by the form of batch processing information, the polymerization for realizing abnormal information in client is shown, the abnormal information that client is received and shown no longer is scattered presence between each other, and then can improve the processing of abnormal information and the solution efficiency of abnormal conditions.
Description
Technical field
This disclosure relates to technical field of internet application, the processing method and dress of abnormal information in more particularly to a kind of monitoring
Put.
Background technology
With the fast development of Internet information technique, there is the output of various information and push.For example, in an operation
System in be monitored, if there is malfunctioning node, then can produce various abnormal informations, such as, one is abnormal in malfunctioning node
The warning information of situation, and then be pushed to the client of corresponding operation maintenance personnel, corresponding operation maintenance personnel is waited in this client
Processing.
Appearance for a malfunctioning node, it is often abnormal to there are more abnormal processes from starting, in the process,
Different abnormal informations can be sent, by that analogy, same class failure will produce multiple abnormal informations, and multiple malfunctioning nodes occur
When, the quantity of abnormal information will be caused to be incremented by double, thus for the client where operation maintenance personnel, it will receive simultaneously
Show substantial amounts of abnormal information.
Because a large amount of abnormal informations for receiving and showing are scattered between each other, so the place for these abnormal informations
Reason, the solution of the abnormal conditions even monitored, all there is solve the problems, such as that efficiency is low.
The content of the invention
In order to solve to be made in correlation technique due to the mutual scattered presence of abnormal information that client receives and shows
Into the processing of abnormal information and the solution of abnormal conditions exist and solve the low technical problem of efficiency, present disclose provides one kind
The treating method and apparatus of abnormal information in monitoring.
The processing method of abnormal information, methods described include in a kind of monitoring：
Receive the abnormal information that client is sent and check instruction, it is defeated in monitoring to check that instruction obtains according to the abnormal information
The abnormal information gone out；
It polymerize the abnormal information and obtains batch processing information corresponding to the abnormal information；
Check that instruction sends the batch processing information to the client according to the abnormal information.
The processing method of abnormal information, methods described include in a kind of monitoring：
Abnormal information, which is sent, to server checks instruction；
Receive the batch processing information that the server checks instruction transmission according to the abnormal information, the batch processing
Information is the polymerization for the abnormal information that request is checked；
By the display of the batch processing information, the polymerization for carrying out the abnormal information is shown.
The processing unit of abnormal information, described device include in a kind of monitoring：
Data obtaining module, the abnormal information for receiving client transmission are checked instruction, looked into according to the abnormal information
See that instruction obtains the abnormal information exported in monitoring；
Aggregation module, batch processing information corresponding to abnormal information is obtained for polymerizeing the abnormal information；
Sending module, for checking that instruction sends the batch processing to the client and believed according to the abnormal information
Breath.
The processing unit of abnormal information, described device include in a kind of monitoring：
Instruction sending module, instruction is checked for sending abnormal information to server；
Bulk information receiving module, for receive the server according to the abnormal information check instruction send batch
Processing information, the batch processing information are the polymerizations for the abnormal information that request is checked；
Display module, for the display by the batch processing information, the polymerization for carrying out the abnormal information is shown.
The technical scheme provided by this disclosed embodiment can include the following benefits：
In the monitoring carried out, the appearance of abnormal conditions or failure, it will all produce and export corresponding abnormal information, with
Checked for corresponding operation maintenance personnel by client, and then realize the solution of abnormal conditions or failure.
After the abnormal information for receiving client end transmission checks instruction, it will check that instruction obtains according to abnormal information
The abnormal information exported in monitoring, the batch according to corresponding to the business information dimension of configuration polymerization abnormal information obtains abnormal information
Processing information, check that instruction sends batch processing information to client according to abnormal information, as a result, carried out in client
Abnormal information, which is checked, to be realized by the form of batch processing information, that is, the polymerization for realizing abnormal information in client shows
Show, the abnormal information that client is received and shown no longer is scattered presence between each other, and then can improve abnormal information
Processing and the solution efficiency of abnormal conditions.
It should be appreciated that the general description and following detailed description of the above are only exemplary, this can not be limited
It is open.
Brief description of the drawings
Accompanying drawing herein is merged in specification and forms the part of this specification, shows the implementation for meeting the present invention
Example, and in specification together for explaining principle of the invention.
Fig. 1 is the schematic diagram of the implementation environment according to involved by the disclosure；
Fig. 2 is a kind of block diagram of device according to an exemplary embodiment
Fig. 3 is the flow chart of the processing method of abnormal information in a kind of monitoring according to an exemplary embodiment；
Fig. 4 be Fig. 3 correspond in embodiment to receive client send abnormal information check instruction, looked into according to abnormal information
See that instruction obtains the flow chart that the details of the abnormal information step exported in monitoring is described；
Fig. 5 is the flow chart of the processing method of abnormal information in a kind of monitoring according to another exemplary embodiment；
Fig. 6 is the flow chart of the processing method of abnormal information in a kind of monitoring according to an exemplary embodiment；
Fig. 7 is the flow chart of the processing method of abnormal information in a kind of monitoring according to another exemplary embodiment；
Fig. 8 is the system architecture diagram handled according to abnormal information in the monitoring shown in an exemplary embodiment；
Fig. 9 is the timing diagram in the system architecture that abnormal information is handled in monitoring according to an exemplary embodiment；
Figure 10 is a kind of flow chart of worksheet according to an exemplary embodiment；
Figure 11 is the schematic diagram for custom-configuring realization according to the polymeric rule shown in an exemplary embodiment；
Figure 12 is the block diagram of the processing unit of abnormal information in a kind of monitoring according to an exemplary embodiment；
Figure 13 is the block diagram that the details of data obtaining module is described for correspondingly being implemented to exemplify according to Figure 12；
Figure 14 is the block diagram of the processing unit of abnormal information in a kind of monitoring according to an exemplary embodiment；
Figure 15 is the block diagram of the processing unit of abnormal information in a kind of monitoring according to an exemplary embodiment；
Figure 16 is the block diagram of the processing unit of abnormal information in a kind of monitoring according to an exemplary embodiment.
Embodiment
Here explanation will be performed to exemplary embodiment in detail, its example is illustrated in the accompanying drawings.Following description is related to
During accompanying drawing, unless otherwise indicated, the same numbers in different accompanying drawings represent same or analogous key element.Following exemplary embodiment
Described in embodiment do not represent and the consistent all embodiments of the present invention.On the contrary, they be only with it is such as appended
The example of the consistent apparatus and method of some aspects being described in detail in claims, of the invention.
Fig. 1 is the schematic diagram of the implementation environment according to involved by the disclosure.The implementation environment includes server 110 and client
End 130.
Wherein, server 110 is used for the acquisition and processing of abnormal information in monitoring, and then in the cooperation of server 110
The lower abnormal information for realizing client 130 is shown, thus, by the data interaction between server 110 and client 130 come real
The abnormal information of user is checked in existing client 130.
Visitor receives, and aids in visitor to receive process by the acquisition of user trajectory and customer information.
Fig. 2 is a kind of block diagram of device according to an exemplary embodiment.For example, device 200 can be shown in Fig. 1
Server 110 and data request end 130 in implementation environment.Server 110 such as can be data server, request of data end
130 such as can be Web server.
Reference picture 2, the device 200 can produce bigger difference because configuration or performance are different, can include one or
More than one central processing unit (central processing units, CPU) 222 is (for example, one or more are handled
Device) and memory 232, one or more storage application programs 242 or data 244 storage medium 230 (such as one or
More than one mass memory unit).Wherein, memory 232 and storage medium 230 can be of short duration storage or persistently storage.Deposit
The program stored up in storage medium 230 can include one or more modules (diagram is not shown), and each module can include
Series of instructions in server is operated.Further, central processing unit 222 could be arranged to logical with storage medium 230
Letter, the series of instructions operation in storage medium 230 is performed on the device 200.Device 200 can also include one or one with
Upper power supply 226, one or more wired or wireless network interfaces 250, one or more input/output interfaces 258,
And/or one or more operating systems 241, such as Windows ServerTM, Mac OS XTM, UnixTM,
LinuxTM, FreeBSDTM etc..Described in following Fig. 3, Fig. 5, Fig. 6 and embodiment illustrated in fig. 7 as performed by server
Step can be based on the apparatus structure shown in the Fig. 2.
Fig. 3 is the flow chart of the processing method of abnormal information in a kind of monitoring according to an exemplary embodiment.Should
The processing method of abnormal information is applied to the server 110 of implementation environment shown in Fig. 1 in monitoring, and the server 110 shows at one
It can be the device 200 shown in Fig. 2 in example property embodiment.As shown in figure 3, in the monitoring abnormal information processing method, can be with
Performed, may comprise steps of by server 110.
In the step 310, receive the abnormal information that client is sent and check instruction, check that instruction obtains according to abnormal information
The abnormal information exported in monitoring.
Wherein, it is necessary first to which explanation, server 110 and client 130 will constitute the processing system of monitoring.Specifically
For, server 110 will provide the abnormal information for being available for checking and handling for client 130, and client 130 will be used as herein
The operating side that user uses in reason system, realized by processing of the user in client 130 to abnormal information corresponding different
Normal processing procedure.
Therefore, for server 110, it will the abnormal information for receiving the initiation of client 130 checks instruction, and then according to
This abnormal information checks instruction to obtain its abnormal information asked by client 130.
As previously described, in monitoring, it will to the output abnormality information of server 110, this abnormal information is in majority of case
Under, its quantity is multiple.User checks the triggering of instruction by abnormal information in client 130, is asked to server corresponding
Abnormal information.
In one exemplary embodiment, abnormal information, it can be the form of work order or the form of mail, go back
Can be form of short message etc., herein without limiting.
Specifically, this abnormal information, can be abnormality alarming information existing in the form of work order, mail or short message,
Customer complaint information etc., that is, the information pushed in monitoring to server 110.
In a step 330, polymerization abnormal information obtains batch processing information corresponding to abnormal information.
Wherein, the abnormal information polymerization carried out, can be polymerization in the business information dimension of configuration or
Polymerization in abnormal information content.
Business information dimension is configured in advance in server 110, and business information dimension is used to indicate abnormal information
The dimension of institute's foundation in polymerization.
Abnormal information includes the field compared with horn of plenty, and these fields have corresponded to different business letters in different scenes
Breath.It should be understood that for a scene, in abnormal information, there is multiple business information, the business information dimension of configuration just refers to
The business information of foundation in the abnormal information polymerization subsequently realized is shown.
For example, in the monitoring that server cluster is realized, it is too high for the cpu load in different time point generations
Situation, a series of similar Exception Types will be have issued, the too high field of cpu load are contained in these abnormal informations, its is right
This business information of Exception Type is answered, thus, just this business information of the Exception Type according to corresponding to this field is to these
Abnormal information is polymerize, and the abnormal information to condense together just forms batch processing information.
Batch processing information be it is multiple match in the business information dimension of configuration, such as similar or identical is different
The set of normal information.
In addition, the polymerization in content can be also carried out to abnormal information, and then abnormal information similar in content is gathered
It is combined to form batch processing information.
Specifically, the content of identification abnormal information, and then content matching is carried out to each abnormal information, to obtain abnormal letter
Similar similarity in content between breath, when this similarity is more than the threshold value of setting, you can think corresponding abnormal information
Match in terms of content, and then be polymerized formation batch processing information together.
For example, process as described above can be realized by big data machine learning, and set threshold value, Ke Yishi
95%, that is, indicate that the abnormal information in terms of content in the presence of 95% similar part is the abnormal information to match in content.
In the process, the identification of content Chinese version, image will be carried out, for example, some critical fielies in abnormal information
Content recognition, and being adjusted flexibly for threshold value can be also carried out, it is polymerize with the abnormal information being adapted under various scenes.
After the abnormal information of user is checked in by the starting client 130 of abovementioned steps 310, request will be checked
Abnormal information polymerize, batch processing information is obtained with this.
By this process, the auto-polymerization of abnormal information is realized, so as to be able to different existing for work order or mail he
Normal information, by this auto-polymerization, new work order or new mail are formed, for a user, will not received a large amount of
Work order or mail, the batch processing of abnormal information is realized by a work order or mail.
In step 350, check that instruction sends batch processing information to client according to abnormal information.
Wherein it is possible to understand, abnormal information checks that instruction carries user's mark, therefore, can be according to abnormal information
Check in instruction that the user carried identifies the transmission for carrying out batch processing information, batch processing information is sent to client
In.
It is corresponding, by the transmission of batch processing information, the polymerization of abnormal information is just realized in the client
It has been shown that, for current desired a large amount of abnormal informations to be processed, no longer it is scattered presence and is looked into one by one for user
See, handle one by one, user can be checked and batch processing by batch processing information to carry out batch to abnormal information, for one kind
Abnormal information, disposably handle, drastically increase and check and treatment effeciency.
Further, since realize the bulk management of a large amount of abnormal informations so that the presence no longer at random of a large amount of abnormal informations, because
This, the positioning for abnormal conditions, for example, determining malfunctioning node, and then can greatly improve the accuracy of abnormality processing.
Fig. 4 is the flow chart that the details of step 310 is described according to an exemplary embodiment.The step
310, as shown in figure 4, may comprise steps of.
In step 311, the abnormal information for receiving user in client checks instruction.
In step 313, check that instruction obtains user institute in the abnormal information for monitoring output according to the abnormal information of user
The abnormal information of category.
Wherein it is possible to understand, for a large amount of abnormal informations exported in monitoring, it needs to send it to relative users
In the client at place, to treat that relative users are handled.Server will dock with the client where multiple users, defeated in monitoring
Go out after abnormal information, this abnormal information is distributed to corresponding user.
Therefore, server the abnormal information of user in receiving client check instruction after, it is necessary to first from monitoring
The abnormal information belonging to this user is obtained in a large amount of abnormal informations of output, that is, the abnormal information for waiting this user to handle.
By this process, when checking and handling of abnormal information will be carried out by client in user, be server
Cooperation provides specific implementation, and then is able to obtain the abnormal information belonging to this user under the cooperation of server, server institute
The a large amount of abnormal informations obtained can be distributed the place that abnormal information to client where relative users, is ensured with this exactly
Reason.
In one exemplary embodiment, abnormal information, which is checked in instruction, carries user's mark, before step 330, the prison
The processing method of abnormal information, may comprise steps of in control.
Check in instruction that the user carried identifies, and searches user's mark in the business information dimension of storage according to abnormal information
Business information dimension corresponding to knowledge, business information dimension are used for the polymerization for carrying out abnormal information.
Wherein, abnormal information checks that instruction is used for the abnormal information that user asks to carry out in starting client and checks process,
With this, the abnormal information initiated to indicate user is checked, abnormal information, which is checked in instruction, carries user's mark.
As previously described, business information dimension, for indicating the business information of abnormal information polymerization institute foundation, it is specific and
Speech, it is to indicate to carry out the field that abnormal information polymerization is matched.Check in instruction that the user carried identifies by abnormal information
To obtain business information dimension, and then the polymerization of abnormal information is realized in this business information dimension.
Business information dimension is configured and is stored in server in advance.On the one hand, it can be unified business information dimension
Degree, to the abnormal information belonging to any user, all to be polymerize according to this business information dimension；On the other hand, can also pin
To different users, different business information dimensions is configured, this business information dimension identifies corresponding in the server deposit with user
Storage.
In other words, can be according to the needs of itself processing abnormal information for each user, and personalized configuration
Required business information dimension, so by this business information dimension in the server it is corresponding with user's mark storage.
The storage of business information dimension is realized by process as described above, thus, can subsequently be identified by user
Search in the server and obtain configured business information dimension, so the abnormal information polymerization for subsequently to be carried out be with
What the abnormal information process demand required for family was consistent.
Fig. 5 is the flow chart of the processing method of abnormal information in a kind of monitoring according to an exemplary embodiment.Should
The processing method of abnormal information in monitoring, as shown in figure 5, may comprise steps of.
In step 410, the business information dimension configuring request of user is received, is pushed away according to business information dimension configuring request
Send the configuration page of business information dimension.
Wherein, as previously described, the configuration for the carry out business information dimension that user can be personalized.And in this business information
Dimension configuration in the specific implementation, server will receive the business information dimension configuring request of user, business information dimension
Spending configuring request is initiated as the user end to server where user.
Server will carry out pushing away for the business information dimension configuration page according to business information dimension configuring request to client
Send, specifically, server will obtain the page data that is consistent with business information dimension configuring request, i.e. business information dimension
The page data of the page is configured, to push to client.
In step 430, the business information dimension of user configuration is obtained by the configuration page of business information dimension.
Wherein, server is by the configuration page of business information dimension in client, to obtain the business that user is configured
Information dimension.Specifically, in the configuration page of business information dimension, the configuration of the business information dimension of progress, use is included
The process of business information dimension that family is carried out related setting, modification and deletion.
That is, in the configuration page of business information dimension, can be operated by the setting of user, Added Business letter
Dimension is ceased, to cause the business information dimension of this user configuration to be increased newly by 0 to one or more business information dimension, Huo Zhe
Added Business information dimension on the basis of original business information dimension.
It can also be operated by the modification of user, original business information dimension is modified, user can also be passed through
Deletion action, delete original business information dimension, herein without enumerating, for business information dimension, will
Arbitrarily configured according to the demand of user.
Now, the business information dimension configuration that user is carried out is completed in the configuration page for realize business information dimension
Afterwards, just this business information dimension is committed in server, to cause the configuration page of the server by business information dimension
Obtain the business information dimension of user configuration.
In step 450, index is identified as with user, carries out pair of the business information dimension of user's mark and user configuration
It should store.
Wherein, server will pass through progress after the business information dimension of user configuration is obtained by abovementioned steps 430
User identifies and the corresponding storage of the business information dimension of user configuration, in order to subsequently need the business of acquisition user configuration
During information dimension, it can be obtained by user's identifier lookup.
It is the configuration provides specific implementation of business information dimension by process as described above, and then subsequently to be entered
Capable abnormal information polymerize condition of providing convenience.
In one exemplary embodiment, the business information of business information dimension instruction single dimension or the industry of various dimensions combination
Business information, step 330, may comprise steps of.
It is polymerize in abnormal information according to the business information dimension or content of configuration, business information dimension or interior
The abnormal information to match in appearance is grouped together in formation batch processing information together.
Wherein, business information dimension, the business information of single dimension can be only indicated, can also indicate that multiple dimension combinations
Business information.The business information of signified single dimension is a business information dimension, for example, can be only device name
It is dimension or Exception Type dimension, it can also be time dimension.The business information of signified various dimensions combination,
Refer to combine multiple business information dimensions, carry out the polymerization of abnormal information.For example, by " device name " this business
Information and " Exception Type " this business information are combined, and form business information dimension, or by " device name ", " different
Normal type " and " time " this three classes business information are combined, and form business information dimension.
As previously described, a certain field that the business information indicated in business information dimension is corresponded in abnormal information
, in other words, a certain field in abnormal information is the particular content of corresponding business information.In abnormal information,
Contain this business information, but for different abnormal informations, its in terms of content, i.e. corresponding field, it may be possible to phase
Match somebody with somebody, for example, it is identical or similar, it is also possible to not matching that.
The business information indicated according to business information dimension, can determine the word in abnormal information to be matched first
Section, then between resulting multiple abnormal informations, is matched to this field, is matched with obtaining this mutual field
Abnormal information, these abnormal informations match in business information dimension, and then this abnormal information is aggregated in into one
Rise and form batch processing information.
In addition, the full content in abnormal information can also be polymerize, it is the most similar on the whole to obtain
Abnormal information, it is polymerized formation batch processing information together.
Batch processing information is substantially the set for the abnormal information polymerizeing, and same class abnormal information will pass through batch processing letter
Batch processing is realized in the realization of breath, and then is improved bulk and ageing.
Fig. 6 is the flow chart of the processing method of abnormal information in a kind of monitoring according to an exemplary embodiment.Should
The processing method of abnormal information in monitoring, suitable for the client 130 of implementation environment shown in Fig. 1.As shown in fig. 6, in the monitoring
The processing method of abnormal information, it can be performed, may comprise steps of by client 130.
In step 610, send abnormal information to server and check instruction.
Wherein, client is used to realize user's checking and handling to abnormal information.Each user, for example, in monitoring
Operation maintenance personnel, abnormal information can be initiated by user end to server by, which having, checks instruction.
In act 630, the reception server checks the batch processing information of instruction transmission, batch processing according to abnormal information
Information is the polymerization for the abnormal information that request is checked.
Wherein, after user end to server transmission abnormal information checks instruction, server return will be received
Batch processing information, this batch processing information as ask the polymerization for the abnormal information checked.
In step 650, by the display of batch processing information, the polymerization for carrying out abnormal information is shown.
Wherein, the display of batch processing information is carried out in the client, with the display by this batch processing information come real
The polymerization of existing abnormal information is shown.
By process as described above, checking for abnormal information in client is just realized, and cause abnormal information
Check possess it is bulk, and then enable to the abnormal information that user carried out processing also possess it is bulk, can be disposable
Substantial amounts of abnormal information is handled, improves the ageing of abnormal information processing.
Fig. 7 is the flow chart of the processing method of abnormal information in a kind of monitoring according to an exemplary embodiment.Should
The processing method of abnormal information in monitoring, as shown in fig. 7, may comprise steps of.
In step 720, the business information dimension configuring request of user is initiated to server.
Wherein, as previously described, the business information dimension configuring request of user, for initiating this user's by client
Business information dimension configuration process.Any user can be initiated by user end to server.
In step 730, business information dimension is obtained from server by the business information dimension configuring request of user
The page is configured, and is shown.
Wherein, configuration page of the client by business information dimension configuring request to server requested service information dimension
Face, to jump to the configuration page of the business information dimension of request, and show.
In the configuration page of the business information dimension shown by client, user can flexibly carry out business information dimension
Configuration, i.e. business information dimension setting, modification and deletion.
In step 750, in the configuration page of the business information dimension of display, the configuration of business information dimension is carried out,
And the business information dimension of configuration is sent to server.
Wherein, client will obtain the business information dimension of user configuration from the configuration page of business information dimension, enter
And send into server.
By process as described above, the configuration of business information dimension in client is realized, and then cause to realize
The business information dimension of abnormal information polymerization possesses personalization, and user is capable of the configuration service information dimension of personalization, so that
It is what is be adapted with the demand of user to obtain the abnormal information polymerization subsequently carried out, and then while raising flexibility, due to energy
The configuration of enough demand progress business information dimensions that abnormal information is handled according to user, therefore, can farthest be improved
The efficiency of abnormal information processing.
So that enterprises are monitored to Operation Server state as an example, with reference to concrete application scene, describe in the monitoring
The processing method of abnormal information.
Here, the monitoring carried out is the monitoring of abnormality in Operation Server, when Operation Server occurs abnormal,
Just corresponding abnormal information is exported, to send alarm.
Fig. 8 is the system architecture diagram handled according to abnormal information in the monitoring shown in an exemplary embodiment.The monitoring
The system architecture of middle abnormal information processing will receive the abnormal information exported in monitoring, and is distributed to after polymerizeing to it corresponding
Client.
The existence form of abnormal information is work order, then as shown in Figure 8, in monitoring, is produced because Operation Server is abnormal
Raw work order will be pushed to WorkForm System 810.
Fig. 9 is the timing diagram in the system architecture that abnormal information is handled in monitoring according to an exemplary embodiment.
As shown in Figure 9, WorkForm System 810 can perform the reception that step 910 carries out work order.
As abnormal information checks the initiation of operation in client 830 where user, client 830 generates abnormal information and looked into
Instruction is seen, for work order is 810, this abnormal information checks that instruction is that work order checks instruction.Client 830 will perform step
Rapid 920, send work order to the Web server 850 for realizing rear end access and check instruction.
Now, Web server 850 forwards the work order of user to check instruction by step 930 is performed to WorkForm System 810.
WorkForm System 810 checks that instruction inquires about this user from work order aggregation configuration storehouse 870 according to the work order of user first
Whether certain polymeric rule is configured with the worksheet carried out, for example, according to certain business information dimension or work
The rule of single content-aggregated work order, by the execution of step 940, to inquire about to obtain the polymeric rule of this user, or knows this
User does not configure polymeric rule.
On the one hand, after inquiry obtains polymeric rule, WorkForm System 810 will gather to the work order 960 belonging to user
Close, to obtain foregoing batch processing information, that is, polymerize the new work order that multiple work orders are formed, and then return to client.
On the other hand, after knowing that this user does not configure polymeric rule, all work orders belonging to user will be directly returned to,
To carry out the display one by one of all work orders in the client.
Figure 10 is a kind of flow chart of worksheet according to an exemplary embodiment.As shown in Figure 10, user
Process is checked initiate work order by WorkForm System 810, for WorkForm System 810, it passes through work order aggregation configuration storehouse
870, perform step 1010 and judge whether to configure the polymeric rule of work order, if it has, then performing step 130 carries out the poly- of work order
Close, shown if it has not, then carrying out work order by common mode.
Need to be illustrated herein, the polymeric rule of this work order, can be that User Defined configures simultaneously as shown in figure 11
It is stored in work order aggregation configuration storehouse, Figure 11 is custom-configuring according to the polymeric rule shown in an exemplary embodiment
The schematic diagram of realization.
By process as described above, when a user logs in WorkForm System processing work order in enterprise, if there is multiple
The work order of Similar Problems, then the configuration of the polymeric rule of this Similar Problems can be carried out, and then to the work order of this Similar Problems be present
Condense together, for a user, can quickly view bottom how many similar to the problem of occur, with it is quick determine it is abnormal go out
The reason for existing and batch confirm and processing.
In addition, on this basis, time dimension can be also added in polymeric rule, is there is this in a period and similar asked
The work order polymerization of topic, batch de confirms and processing, and processing and the statement of account of all work orders are completed in same flow.Make to need originally
The multiple work orders repeatedly to handle reformed into an individual character can batch processing a work order, it is seen then that can have in efficiency very big
Lifting.
In another example tracing whether certain intrusion event once found afterwards has corresponding alarm in each monitoring link
When, it is necessary to carry out checking for corresponding work order.Then this process can be realized by configuring corresponding polymeric rule, thus by generation
Period all work orders related to the machine being related to all are aggregated in a new work order, and batch de confirms and retrospect,
The work order of all links is placed on same interface in the client, i.e., is shown in same work order, by scattered work
Singly string together, be apparent to which link is acted normally, which link goes wrong, it follows that passing through work as described above
Single processing procedure, different point of information can be flexibly built, and then conveniently event is collected, filed and traced.
For another example the manufacturer of DDos services is done for offer, it is abnormal using worksheet process monitoring as described above
Traffic conditions, operation personnel can configure polymeric rule, and then realize automatic identification and the polymerization of work order.Such as extraction work order
In field corresponding to some business information, source IP, Target IP, attacking wayses, peak flow, attack the duration, and will polymerization
Similarity is arranged to 95%, then new work order can be formed with auto-polymerization, with seen clearly by this new work order whether have it is new
Attack condition and trend occur, and except raising efficiency, also provide multiple visual angles for operation.
During as described above, the processing method of abnormal information, Neng Goujie in the monitoring realized by the disclosure
Enter in WorkForm System, add flexible interaction for WorkForm System, light weight realizes that work order polymerize, and the processing to work order, which provides, to be grown
The scheme of phase aggregation optimization.
And the processing step of work order is also incorporated, WorkForm System is changed into favourable operation instrument, enhances work order
The function of system.
The processing method of abnormal information in monitoring as described above, it can be used for docking various alarms and customer complaint etc.,
Applied in machine monitors and service monitoring, for example, the scene of banking system, games system and cloud platform class.
Following is embodiment of the present disclosure, be can be used for different in the monitoring that the above-mentioned server 110 of the execution disclosure performs
The processing method embodiment of normal information.For the details not disclosed in embodiment of the present disclosure, refer in disclosure monitoring
The processing method embodiment of abnormal information.
Figure 12 is the block diagram of the processing unit of abnormal information in a kind of monitoring according to an exemplary embodiment.The prison
The processing unit of abnormal information in control, as shown in figure 12, include but is not limited to：Data obtaining module 1110, aggregation module 1130
With sending module 1150.
Data obtaining module 1110, the abnormal information for receiving client transmission are checked instruction, looked into according to abnormal information
See that instruction obtains the abnormal information exported in monitoring.
Aggregation module 1130, corresponding batch processing information is obtained for polymerizeing abnormal information.
Sending module 1150, for checking that instruction sends batch processing information to client according to abnormal information.
Figure 13 is the block diagram that the details of data obtaining module 1110 is described according to an exemplary embodiment.
The data obtaining module 1110, as shown in figure 13, it can include but is not limited to：Instruction reception unit 1111 and abnormal information obtain
Unit 1113.
Instruction reception unit 1111, the abnormal information for receiving user in client check instruction.
Abnormal information acquiring unit 1113, for checking that instruction obtains the exception of monitoring output according to the abnormal information of user
Abnormal information in information belonging to user.
In one exemplary embodiment, abnormal information, which is checked in instruction, carries user's mark, abnormal information in the monitoring
Processing unit, can include but is not limited to：Dimension acquisition module.
The dimension acquisition module is used to check in instruction that the user carried identifies according to abnormal information, believes in the business of storage
Cease and business information dimension corresponding to user's mark is searched in dimension, business information dimension is used for the polymerization for carrying out abnormal information.
Figure 14 is the block diagram of the processing unit of abnormal information in a kind of monitoring according to an exemplary embodiment.The prison
The processing unit of abnormal information in control, as shown in figure 14, it can include but is not limited to：Request receiving module 1210, dimension configuration
Module 1230 and memory module 1250.
Request receiving module 1210, for receiving the business information dimension configuring request of user, according to business information dimension
The configuration page of configuring request sending business information dimension.
Dimension configuration module 1230, for obtaining the business information of user configuration by the configuration page of business information dimension
Dimension.
Memory module 1250, for being identified as index with user, the business information for carrying out user's mark and user configuration is tieed up
The corresponding storage of degree.
In one exemplary embodiment, the business information of business information dimension instruction single dimension or the industry of various dimensions combination
Business information, aggregation module 1130 are further used for according to the business information dimension or content of configuration being gathered in abnormal information
Close, the abnormal information to match in business information dimension or content is grouped together in formation batch processing information together.
Figure 15 is the block diagram of the processing unit of abnormal information in a kind of monitoring according to an exemplary embodiment.The prison
The processing unit of abnormal information in control, as shown in figure 15, it can include but is not limited to：Instruction sending module 1310, bulk information
Receiving module 1330 and display module 1350.
Instruction sending module 1310, instruction is checked for sending abnormal information to server.
Bulk information receiving module 1330, the batch processing of instruction transmission is checked according to abnormal information for the reception server
Information, batch processing information are the polymerizations for the abnormal information that request is checked.
Display module 1350, for the display by batch processing information, carry out the polymerization of abnormal information.
Figure 16 is the block diagram of the processing unit of abnormal information in a kind of monitoring according to an exemplary embodiment.The prison
The processing unit of abnormal information in control, as shown in figure 16, it can include but is not limited to：Configuring request initiation module 1410, the page
Display module 1430 and dimension sending module 1450.
Configuring request initiation module 1410, for initiating the business information dimension configuring request of user to server.
Page display module 1430, business letter is obtained from server for the business information dimension configuring request by user
The configuration page of dimension is ceased, and is shown.
Dimension sending module 1450, in the configuration page of the business information dimension of display, carrying out business information dimension
The configuration of degree, and the business information dimension of configuration is sent to server.
It should be appreciated that the invention is not limited in the precision architecture for being described above and being shown in the drawings, and
And various modifications and changes can be being performed without departing from the scope.The scope of the present invention is only limited by appended claim.
Claims (14)
1. the processing method of abnormal information in a kind of monitoring, it is characterised in that methods described includes：
Receive the abnormal information that client is sent and check instruction, check that instruction obtains what is exported in monitoring according to the abnormal information
Abnormal information；
It polymerize the abnormal information and obtains batch processing information corresponding to the abnormal information；
Check that instruction sends the batch processing information to the client according to the abnormal information.
2. according to the method for claim 1, it is characterised in that the abnormal information for receiving client transmission checks finger
Order, check that the step of instruction obtains the abnormal information exported in monitoring includes according to the abnormal information：
The abnormal information for receiving user in client checks instruction；
According to belonging to the abnormal information of the user checks user described in the abnormal information of the instruction acquisition monitoring output
Abnormal information.
3. according to the method for claim 1, it is characterised in that the abnormal information, which is checked in instruction, carries user's mark,
Before the step of polymerization abnormal information obtains batch processing information corresponding to the abnormal information, methods described is also wrapped
Include：
Check in instruction that the user carried is identified, and the use is searched in the business information dimension of storage according to the abnormal information
Business information dimension corresponding to the mark of family, the business information dimension are used for the polymerization for carrying out the abnormal information.
4. according to the method for claim 3, it is characterised in that methods described also includes：
The business information dimension configuring request of user is received, is tieed up according to the business information dimension configuring request sending business information
The configuration page of degree；
The business information dimension of the user configuration is obtained by the configuration page of the business information dimension；
Index is identified as with the user, the correspondence for carrying out the business information dimension of user's mark and the user configuration is deposited
Storage.
5. according to the method for claim 1, it is characterised in that the business information of the business information dimension instruction single dimension
Or the business information of various dimensions combination, the business information dimension of the basis polymerize the abnormal information and obtain the abnormal letter
Include corresponding to breath the step of batch processing information：
It is polymerize in the abnormal information according to the business information dimension or content of configuration, business information dimension or interior
The abnormal information to match in appearance is grouped together in formation batch processing information together.
6. the processing method of abnormal information in a kind of monitoring, it is characterised in that methods described includes：
Abnormal information, which is sent, to server checks instruction；
Receive the batch processing information that the server checks instruction transmission according to the abnormal information, the batch processing information
It is the polymerization for the abnormal information that request is checked；
By the display of the batch processing information, the polymerization for carrying out the abnormal information is shown.
7. according to the method for claim 6, it is characterised in that the business information of polymerization with the configuration of the abnormal information is tieed up
Degree is consistent, and methods described also includes：
The business information dimension configuring request of user is initiated to the server；
The configuration page of business information dimension is obtained from the server by the business information dimension configuring request of the user,
And show；
In the configuration page of the business information dimension of display, the configuration of the business information dimension is carried out, and will configuration
The business information dimension send to the server.
8. the processing unit of abnormal information in a kind of monitoring, it is characterised in that described device includes：
Data obtaining module, the abnormal information for receiving client transmission check instruction, finger are checked according to the abnormal information
Order obtains the abnormal information exported in monitoring；
Aggregation module, batch processing information corresponding to abnormal information is obtained for polymerizeing the abnormal information；
Sending module, for checking that instruction sends the batch processing information to the client according to the abnormal information.
9. device according to claim 8, it is characterised in that described information acquisition module includes：
Instruction reception unit, the abnormal information for receiving user in client check instruction；
Abnormal information acquiring unit, for checking that instruction obtains the exception of the monitoring output according to the abnormal information of the user
Abnormal information described in information belonging to user.
10. device according to claim 8, it is characterised in that the abnormal information, which is checked in instruction, carries user's mark,
Described device also includes：
Dimension acquisition module, for checking in instruction that the user carried identifies according to the abnormal information, believe in the business of storage
Cease and business information dimension corresponding to user's mark is searched in dimension, the business information dimension is used to carry out the abnormal information
Polymerization.
11. device according to claim 10, it is characterised in that described device also includes：
Request receiving module, for receiving the business information dimension configuring request of user, configured according to the business information dimension
Ask the configuration page of sending business information dimension；
Dimension configuration module, for obtaining the business information of the user configuration by the configuration page of the business information dimension
Dimension；
Memory module, for being identified as index with the user, the business for carrying out user's mark and the user configuration is believed
Cease the corresponding storage of dimension.
12. device according to claim 8, it is characterised in that the business letter of the business information dimension instruction single dimension
Breath or the business information of various dimensions combination, the aggregation module are further used in the abnormal information according to the business of configuration
Information dimension or content are polymerize, and the abnormal information to match in business information dimension or content is grouped together in shape together
Processing information in batch.
13. the processing unit of abnormal information in a kind of monitoring, it is characterised in that described device includes：
Instruction sending module, instruction is checked for sending abnormal information to server；
Bulk information receiving module, for receive the server according to the abnormal information check instruction send batch processing
Information, the batch processing information are the polymerizations for the abnormal information that request is checked；
Display module, for the display by the batch processing information, the polymerization for carrying out the abnormal information is shown.
14. device according to claim 13, it is characterised in that the business information of the polymerization and configuration of the abnormal information
Dimension is consistent, and described device also includes：
Configuring request initiation module, for initiating the business information dimension configuring request of user to the server；
Page display module, business letter is obtained from the server for the business information dimension configuring request by the user
The configuration page of dimension is ceased, and is shown；
Dimension sending module, in the configuration page of the business information dimension of display, carrying out the business information dimension
The configuration of degree, and the business information dimension of configuration is sent to the server.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610872019.4A CN107885634B (en) | 2016-09-29 | 2016-09-29 | Method and device for processing abnormal information in monitoring |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610872019.4A CN107885634B (en) | 2016-09-29 | 2016-09-29 | Method and device for processing abnormal information in monitoring |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN107885634A true CN107885634A (en) | 2018-04-06 |
| CN107885634B CN107885634B (en) | 2020-06-16 |
Family
ID=61768888
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610872019.4A Active CN107885634B (en) | 2016-09-29 | 2016-09-29 | Method and device for processing abnormal information in monitoring |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107885634B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109189633A (en) * | 2018-07-27 | 2019-01-11 | 西安交通大学 | Holographic model running monitoring method in real time |
| CN110047163A (en) * | 2019-04-11 | 2019-07-23 | 吉旗（成都）科技有限公司 | A method of abnormal monitoring of checking card |
| CN110677310A (en) * | 2018-07-03 | 2020-01-10 | 百度在线网络技术（北京）有限公司 | Traffic attribution method, device and terminal |
| CN111814999A (en) * | 2020-07-08 | 2020-10-23 | 上海燕汐软件信息科技有限公司 | Fault work order generation method, device and equipment |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20090313508A1 (en) * | 2008-06-17 | 2009-12-17 | Microsoft Corporation | Monitoring data categorization and module-based health correlations |
| CN101626363A (en) * | 2008-07-07 | 2010-01-13 | 华为技术有限公司 | Convergence service device and system, and convergence service establishing and using methods |
| CN104639359A (en) * | 2013-11-14 | 2015-05-20 | 华为技术有限公司 | Information processing method and device |
| CN104683370A (en) * | 2013-11-27 | 2015-06-03 | 腾讯科技（上海）有限公司 | Content aggregation method, server, client and system |
| CN105207806A (en) * | 2015-08-20 | 2015-12-30 | 百度在线网络技术（北京）有限公司 | Monitoring method and apparatus of distributed service |
| CN105490835A (en) * | 2015-11-20 | 2016-04-13 | 北京百度网讯科技有限公司 | Information monitoring method and device |
| CN105871581A (en) * | 2015-11-13 | 2016-08-17 | 乐视云计算有限公司 | Method and device for processing of alarm information in cloud calculation |
-
2016
- 2016-09-29 CN CN201610872019.4A patent/CN107885634B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20090313508A1 (en) * | 2008-06-17 | 2009-12-17 | Microsoft Corporation | Monitoring data categorization and module-based health correlations |
| CN101626363A (en) * | 2008-07-07 | 2010-01-13 | 华为技术有限公司 | Convergence service device and system, and convergence service establishing and using methods |
| CN104639359A (en) * | 2013-11-14 | 2015-05-20 | 华为技术有限公司 | Information processing method and device |
| CN104683370A (en) * | 2013-11-27 | 2015-06-03 | 腾讯科技（上海）有限公司 | Content aggregation method, server, client and system |
| CN105207806A (en) * | 2015-08-20 | 2015-12-30 | 百度在线网络技术（北京）有限公司 | Monitoring method and apparatus of distributed service |
| CN105871581A (en) * | 2015-11-13 | 2016-08-17 | 乐视云计算有限公司 | Method and device for processing of alarm information in cloud calculation |
| CN105490835A (en) * | 2015-11-20 | 2016-04-13 | 北京百度网讯科技有限公司 | Information monitoring method and device |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110677310A (en) * | 2018-07-03 | 2020-01-10 | 百度在线网络技术（北京）有限公司 | Traffic attribution method, device and terminal |
| CN109189633A (en) * | 2018-07-27 | 2019-01-11 | 西安交通大学 | Holographic model running monitoring method in real time |
| CN110047163A (en) * | 2019-04-11 | 2019-07-23 | 吉旗（成都）科技有限公司 | A method of abnormal monitoring of checking card |
| CN111814999A (en) * | 2020-07-08 | 2020-10-23 | 上海燕汐软件信息科技有限公司 | Fault work order generation method, device and equipment |
| CN111814999B (en) * | 2020-07-08 | 2024-01-16 | 上海燕汐软件信息科技有限公司 | Fault work order generation method, device and equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107885634B (en) | 2020-06-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11275641B2 (en) | Automatic correlation of dynamic system events within computing devices | |
| US10237295B2 (en) | Automated event ID field analysis on heterogeneous logs | |
| Lou et al. | Mining dependency in distributed systems through unstructured logs analysis | |
| CN104219316B (en) | A kind of call request processing method and processing device in distributed system | |
| US9247022B2 (en) | Method and apparatus for optimizing performance and network traffic in distributed workflow processing | |
| CN105447046A (en) | Distributed system data consistency processing method, device and system | |
| CN107885634A (en) | The treating method and apparatus of abnormal information in monitoring | |
| US20200410099A1 (en) | Parametric behavioral pattern definition | |
| US20200145455A1 (en) | Detecting zero-day attacks with unknown signatures via mining correlation in behavioral change of entities over time | |
| CN112422484A (en) | Method, apparatus, and storage medium for determining a scenario for processing a security event | |
| US20120259960A1 (en) | Dynamic Self-Configuration of Heterogenous Monitoring Agent Networks | |
| CN115039379A (en) | System and method for determining device attributes using classifier hierarchy | |
| US20150106922A1 (en) | Parameter adjustment for pattern discovery | |
| JP2016192185A (en) | Spoofing detection system and spoofing detection method | |
| CN108833442A (en) | A kind of distributed network security monitoring device and its method | |
| CN109992252A (en) | A kind of data analysing method based on Internet of Things, terminal, device and storage medium | |
| US7480651B1 (en) | System and method for notification of group membership changes in a directory service | |
| CN113836237A (en) | Method and device for auditing data operation of database | |
| Venkatesan et al. | A comprehensive study in data mining frameworks for intrusion detection | |
| CN108023740A (en) | The indicating risk method and apparatus of exception information in monitoring | |
| CN109992960A (en) | A kind of forgery parameter detection method, device, electronic equipment and storage medium | |
| CN112581129A (en) | Block chain transaction data management method and device, computer equipment and storage medium | |
| US10949232B2 (en) | Managing virtualized computing resources in a cloud computing environment | |
| EP2698966B1 (en) | Tracking end-users in web databases | |
| TWI667587B (en) | Information security protection method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |