CN107885634B - Method and device for processing abnormal information in monitoring - Google Patents
Method and device for processing abnormal information in monitoring Download PDFInfo
- Publication number
- CN107885634B CN107885634B CN201610872019.4A CN201610872019A CN107885634B CN 107885634 B CN107885634 B CN 107885634B CN 201610872019 A CN201610872019 A CN 201610872019A CN 107885634 B CN107885634 B CN 107885634B
- Authority
- CN
- China
- Prior art keywords
- information
- dimension
- service information
- abnormal
- user
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
- G06F11/3072—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
- G06F11/3082—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting the data filtering being achieved by aggregating or compressing the monitored data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3055—Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3089—Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
- G06F2201/875—Monitoring of systems including the internet
Abstract
The disclosure discloses a method and a device for processing abnormal information in monitoring. The method comprises the following steps: receiving an abnormal information checking instruction sent by a client, and acquiring abnormal information output in monitoring according to the abnormal information checking instruction; aggregating the abnormal information to obtain batch processing information corresponding to the abnormal information; and sending the batch processing information to the client according to the abnormal information checking instruction. Therefore, the abnormal information check in the client is realized in a batch information processing mode, namely, the aggregated display of the abnormal information in the client is realized, the abnormal information received and displayed by the client does not exist scattered any more, and the processing efficiency of the abnormal information and the solving efficiency of the abnormal condition can be improved.
Description
Technical Field
The present disclosure relates to the field of internet application technologies, and in particular, to a method and an apparatus for processing abnormal information during monitoring.
Background
With the rapid development of internet information technology, there are various kinds of information output and push. For example, monitoring is performed in an operating system, if a fault node exists, various abnormal information, for example, alarm information of an abnormal condition in the fault node, is generated and then pushed to a client of a corresponding operation and maintenance person, and the client waits for the corresponding operation and maintenance person to process.
For the occurrence of a fault node, the process from the beginning of abnormality to the occurrence of more abnormalities is often, different abnormal information is sent in the process, and so on, the same type of fault generates a plurality of abnormal information, when a plurality of fault nodes occur, the number of the abnormal information is increased by times, and therefore, for a client where an operation and maintenance person is located, a large amount of abnormal information is received and displayed.
Since a large amount of received and displayed abnormal information is scattered, the processing of the abnormal information, even the solution of the abnormal condition of monitoring, has the problem of low solution efficiency.
Disclosure of Invention
In order to solve the technical problems of processing of abnormal information and low efficiency of solving abnormal conditions caused by scattered existence of the abnormal information received and displayed by a client in the related art, the disclosure provides a method and a device for processing the abnormal information in monitoring.
A processing method of abnormal information in monitoring, the method comprises the following steps:
receiving an abnormal information checking instruction sent by a client, and acquiring abnormal information output in monitoring according to the abnormal information checking instruction;
aggregating the abnormal information to obtain batch processing information corresponding to the abnormal information;
and sending the batch processing information to the client according to the abnormal information checking instruction.
A processing method of abnormal information in monitoring, the method comprises the following steps:
sending an abnormal information checking instruction to a server;
receiving batch processing information sent by the server according to the abnormal information checking instruction, wherein the batch processing information is the aggregation of the abnormal information requested to be checked;
and performing aggregation display of the abnormal information by displaying the batch processing information.
A device for handling exception information during monitoring, the device comprising:
the information acquisition module is used for receiving an abnormal information check instruction sent by a client and acquiring abnormal information output in monitoring according to the abnormal information check instruction;
the aggregation module is used for aggregating the abnormal information to obtain batch processing information corresponding to the abnormal information;
and the sending module is used for sending the batch processing information to the client according to the abnormal information checking instruction.
A device for handling exception information during monitoring, the device comprising:
the instruction sending module is used for sending an abnormal information checking instruction to the server;
the batch information receiving module is used for receiving batch processing information sent by the server according to the abnormal information checking instruction, wherein the batch processing information is the aggregation of the abnormal information requested to be checked;
and the display module is used for performing the aggregation display of the abnormal information through the display of the batch processing information.
The technical scheme provided by the embodiment of the disclosure can have the following beneficial effects:
in the monitoring, corresponding abnormal information is generated and output when an abnormal condition or a fault occurs, so that corresponding operation and maintenance personnel can check the abnormal condition or the fault through the client, and the abnormal condition or the fault is solved.
After an abnormal information checking instruction sent by a client is received, abnormal information output in monitoring is obtained according to the abnormal information checking instruction, batch processing information corresponding to the abnormal information is obtained by aggregating the abnormal information according to the configured service information dimension, and the batch processing information is sent to the client according to the abnormal information checking instruction, so that the abnormal information checking in the client is realized in the form of batch processing information, namely, the aggregated display of the abnormal information in the client is realized, the abnormal information received and displayed by the client does not exist sporadically, and the processing efficiency of the abnormal information and the solution efficiency of the abnormal condition can be improved.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and together with the description, serve to explain the principles of the invention.
FIG. 1 is a schematic illustration of an implementation environment according to the present disclosure;
FIG. 2 is a block diagram illustrating an apparatus according to an example embodiment
FIG. 3 is a flow diagram illustrating a method for handling exception information during monitoring in accordance with an exemplary embodiment;
fig. 4 is a flowchart illustrating details of a step of receiving an abnormal information check instruction sent by a client and acquiring abnormal information output in monitoring according to the abnormal information check instruction in the embodiment corresponding to fig. 3;
FIG. 5 is a flow chart illustrating a method of handling exception information in monitoring according to another exemplary embodiment;
FIG. 6 is a flow diagram illustrating a method for handling exception information during monitoring in accordance with an exemplary embodiment;
FIG. 7 is a flow chart illustrating a method of handling exception information in monitoring according to another exemplary embodiment;
FIG. 8 is a system architecture diagram illustrating exception information handling during monitoring in accordance with an exemplary embodiment;
FIG. 9 is a timing diagram in a system architecture illustrating exception information handling in monitoring according to an exemplary embodiment;
FIG. 10 is a flowchart illustrating a work order process in accordance with an exemplary embodiment;
FIG. 11 is a schematic diagram of a custom configuration implementation of aggregation rules in accordance with the illustrative embodiments;
FIG. 12 is a block diagram illustrating a device for handling exception information during monitoring in accordance with an exemplary embodiment;
FIG. 13 is a block diagram illustrating details of an information acquisition module according to the corresponding embodiment of FIG. 12;
FIG. 14 is a block diagram illustrating a device for handling exception information during monitoring in accordance with an exemplary embodiment;
FIG. 15 is a block diagram illustrating a device for handling exception information during monitoring in accordance with an exemplary embodiment;
fig. 16 is a block diagram illustrating an apparatus for processing exception information in monitoring according to an example embodiment.
Detailed Description
Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, like numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the invention, as detailed in the appended claims.
FIG. 1 is a schematic illustration of an implementation environment according to the present disclosure. The implementation environment includes a server 110 and a client 130.
The server 110 is used for obtaining and processing the abnormal information in the monitoring process, and further, the abnormal information display of the client 130 is realized under the cooperation of the server 110, so that the abnormal information viewing of the user in the client 130 is realized through the data interaction between the server 110 and the client 130.
And the visitor receives the treatment and assists the visitor in receiving the treatment process through the user track and the client information.
FIG. 2 is a block diagram illustrating an apparatus according to an example embodiment. For example, the apparatus 200 may be the server 110 and the data requestor 130 in the implementation environment shown in FIG. 1. The server 110 may be, for example, a data server, and the data request terminal 130 may be, for example, a Web server.
Referring to fig. 2, the apparatus 200 may have a relatively large difference due to different configurations or performances, and may include one or more Central Processing Units (CPUs) 222 (e.g., one or more processors) and a memory 232, one or more storage media 230 (e.g., one or more mass storage devices) storing an application 242 or data 244. Memory 232 and storage medium 230 may be, among other things, transient or persistent storage. The program stored in the storage medium 230 may include one or more modules (not shown), each of which may include a series of instruction operations for the server. Still further, the central processor 222 may be configured to communicate with the storage medium 230 to execute a series of instruction operations in the storage medium 230 on the device 200. The device 200 may also include one or more power supplies 226, one or more wired or wireless network interfaces 250, one or more input-output interfaces 258, and/or one or more operating systems 241, such as Windows Server, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, and so forth. The steps performed by the server described in the embodiments of fig. 3, 5, 6 and 7 described below may be based on the device structure shown in fig. 2.
Fig. 3 is a flowchart illustrating a method for handling exception information in monitoring according to an example embodiment. The method for processing exception information in monitoring is applicable to the server 110 in the implementation environment shown in fig. 1, and the server 110 may be the apparatus 200 shown in fig. 2 in an exemplary embodiment. As shown in fig. 3, the method for processing the abnormal information during monitoring, which may be executed by the server 110, may include the following steps.
In step 310, an abnormal information checking instruction sent by the client is received, and abnormal information output in monitoring is acquired according to the abnormal information checking instruction.
It should be noted that, first, the server 110 and the client 130 will constitute a processing system for monitoring. Specifically, the server 110 will provide the client 130 with the exception information available for viewing and processing, and the client 130 will be an operation end used by the user in the processing system, and the corresponding exception handling process is implemented through the processing of the exception information in the client 130 by the user.
Therefore, for the server 110, an exception information checking instruction initiated by the client 130 is received, and the exception information requested by the client 130 is obtained for the client 130 according to the exception information checking instruction.
As described above, in the monitoring, the server 110 is output with the abnormality information, which is in most cases plural in number. The user requests the corresponding abnormal information from the server by triggering the abnormal information viewing instruction in the client 130.
In an exemplary embodiment, the abnormal information may be in the form of a work order, an email, a short message, and the like, which is not limited herein.
Specifically, the abnormal information may be abnormal warning information, customer complaint information, and the like in the form of a work order, a mail, or a short message, that is, information pushed to the server 110 during monitoring.
In step 330, the exception information is aggregated to obtain batch processing information corresponding to the exception information.
The abnormal information aggregation may be aggregation in the configured service information dimension, or aggregation in the content of the abnormal information.
The service information dimension is configured in advance in the server 110, and the service information dimension is used for indicating a dimension according to which the abnormal information is aggregated.
The abnormal information contains richer fields, and the fields correspond to different service information in different scenes. It can be understood that, for a scene, there are multiple kinds of service information in the exception information, and the configured service information dimension indicates the service information according to in the exception information aggregation that is realized subsequently.
For example, in the monitoring implemented by the server cluster, for the case of the CPU load being too high at different time points, a series of similar exception types are sent out, and the exception information includes a field with the CPU load being too high, which corresponds to the service information of the exception type, so that the exception information is aggregated according to the service information of the exception type corresponding to the field, and the aggregated exception information forms batch processing information.
The batch processing information is a collection of multiple exception information that match in the configured business information dimension, e.g., similar or identical.
In addition, the abnormal information can be aggregated on the content, and further, the similar abnormal information on the content is aggregated to form batch processing information.
Specifically, the content of the abnormal information is identified, and then content matching is performed on each abnormal information to obtain similarity of content similarity between the abnormal information, and when the similarity is greater than a set threshold, the corresponding abnormal information is considered to be matched in content, and then the abnormal information is aggregated to form batch processing information.
For example, the above-described process may be implemented by big data machine learning, and the set threshold may be 95%, that is, the abnormal information indicating that there is a portion that is 95% similar in content is the abnormal information that is matched in content.
In the process, the identification of texts and images in the content, for example, the identification of the content of some key fields in the abnormal information, and the flexible adjustment of the threshold value can also be performed to adapt to the abnormal information aggregation in various scenes.
After the user's review of the exception information in the client 130 is initiated through the aforementioned step 310, the exception information requested to be reviewed is aggregated, so as to obtain the batch processing information.
Through the process, the automatic aggregation of the abnormal information is realized, so that the abnormal information in the form of the work order or the mail forms a new work order or a new mail through the automatic aggregation, and the batch processing of the abnormal information is realized through one work order or mail without receiving a large number of work orders or mails for users.
In step 350, batch processing information is sent to the client according to the abnormal information viewing instruction.
The abnormal information checking instruction carries the user identifier, so that the batch processing information can be sent according to the user identifier carried in the abnormal information checking instruction, and the batch processing information can be sent to the client.
Correspondingly, the aggregated display of the abnormal information is realized in the client through the sending of the batch processing information, so that a large amount of abnormal information which needs to be processed currently does not exist scattered any more and is provided for a user to check one by one and process one by one, the user can check and process the abnormal information in batches through the batch processing information, and the check and processing efficiency can be greatly improved by processing one type of abnormal information at one time.
In addition, batch management of a large amount of abnormal information is realized, so that the large amount of abnormal information is not scattered, and therefore, for positioning of abnormal conditions, for example, fault nodes are determined, and the accuracy of abnormal processing can be greatly improved.
FIG. 4 is a flowchart illustrating a description of details of step 310 according to an example embodiment. This step 310, as shown in FIG. 4, may include the following steps.
In step 311, an abnormal information viewing instruction of the user in the client is received.
In step 313, the abnormal information to which the user belongs in the monitored and outputted abnormal information is obtained according to the abnormal information viewing instruction of the user.
It can be understood that, for a large amount of abnormal information output in monitoring, the abnormal information needs to be sent to a client where a corresponding user is located to be processed by the corresponding user. The server is connected with the client side where the plurality of users are located, and after the abnormal information is output in monitoring, the abnormal information is distributed to the corresponding users.
Therefore, after receiving an abnormal information viewing instruction of a user in the client, the server needs to first obtain abnormal information to which the user belongs from a large amount of abnormal information output by monitoring, that is, abnormal information to be processed by the user.
Through the process, when the user views and processes the abnormal information through the client, specific implementation is provided for the cooperation of the server, the abnormal information to which the user belongs can be further acquired under the cooperation of the server, and a large amount of abnormal information acquired by the server can be accurately distributed to the client where the corresponding user belongs, so that the processing of the abnormal information is guaranteed.
In an exemplary embodiment, the exception information checking instruction carries a user identifier, and before step 330, the method for processing exception information in monitoring may include the following steps.
And checking the user identification carried in the instruction according to the abnormal information, and searching the service information dimension corresponding to the user identification in the stored service information dimension, wherein the service information dimension is used for aggregating the abnormal information.
The abnormal information viewing instruction is used for initiating an abnormal information viewing process requested by a user in a client, so that the abnormal information viewing instruction carries a user identifier in order to indicate the abnormal information viewing initiated by the user.
As described above, the service information dimension is used to indicate the service information according to which the abnormal information is aggregated, specifically, to indicate the field matched for performing the abnormal information aggregation. And obtaining the service information dimension through the user identification carried in the abnormal information checking instruction, and further realizing the aggregation of the abnormal information on the service information dimension.
The service information dimension is configured in advance and stored in the server. On one hand, the service information dimension can be unified, so that the abnormal information of any user is aggregated according to the service information dimension; on the other hand, different service information dimensions can be configured for different users, and the service information dimensions and the user identifications are correspondingly stored in the server.
In other words, for each user, the service information dimension required by the personalized configuration can be configured according to the requirement of processing the abnormal information by the user, and the service information dimension is stored in the server in correspondence with the user identifier.
The storage of the service information dimension is realized through the process, so that the configured service information dimension can be searched in the server through the user identification in the following process, and the abnormal information aggregation in the following process is consistent with the abnormal information processing requirement required by the user.
Fig. 5 is a flowchart illustrating a method for handling exception information in monitoring according to an example embodiment. The method for processing abnormal information in monitoring, as shown in fig. 5, may include the following steps.
In step 410, a service information dimension configuration request of a user is received, and a configuration page of a service information dimension is pushed according to the service information dimension configuration request.
As described above, the user can perform personalized configuration of service information dimensions. In the specific implementation of the service information dimension configuration, the server receives a service information dimension configuration request of a user, where the service information dimension configuration request is initiated from a client where the user is located to the server.
The server pushes the service information dimension configuration page to the client according to the service information dimension configuration request, and specifically, the server obtains page data conforming to the service information dimension configuration request, namely, the page data of the configuration page of the service information dimension, so as to push the page data to the client.
In step 430, the service information dimension configured by the user is obtained through the configuration page of the service information dimension.
The server obtains the service information dimension configured by the user through a configuration page of the service information dimension in the client. Specifically, the configuration of the service information dimension in the configuration page of the service information dimension includes the processes of setting, modifying and deleting related to the service information dimension performed by the user.
That is to say, in the configuration page of the service information dimensionality, the service information dimensionality can be added through the setting operation of the user, so that the service information dimensionality configured by the user is added to one or more service information dimensionalities from 0, or the service information dimensionality is added on the basis of the original service information dimensionality.
The original service information dimensionality can be modified through the modification operation of the user, the original service information dimensionality can be deleted through the deletion operation of the user, one-to-one listing is not performed, and the service information dimensionality can be randomly configured according to the requirement of the user.
At this time, after the service information dimension configuration performed by the user is completed in the configuration page of the service information dimension, the service information dimension is submitted to the server, so that the server obtains the service information dimension configured by the user through the configuration page of the service information dimension.
In step 450, the user identifier is used as an index to perform corresponding storage of the user identifier and the service information dimension configured by the user.
After obtaining the service information dimension configured by the user in the foregoing step 430, the server performs corresponding storage of the user identifier and the service information dimension configured by the user, so that the service information dimension configured by the user can be obtained by searching through the user identifier when the service information dimension configured by the user needs to be obtained subsequently.
Through the process, specific implementation is provided for configuration of service information dimensionality, and convenience is further provided for subsequent abnormal information aggregation.
In an exemplary embodiment, the service information dimension indicates service information of a single dimension or service information of a multi-dimension combination, and step 330 may include the following steps.
And aggregating the abnormal information according to the configured service information dimension or content, and aggregating the abnormal information matched with the service information dimension or content to form batch processing information.
The service information dimension may only indicate service information of a single dimension, or may indicate service information of a combination of multiple dimensions. The service information of the single dimension is a service information dimension, for example, the service information dimension may be only a device name dimension, an abnormal type dimension, or a time dimension. The multi-dimensional combined service information refers to that a plurality of service information dimensions are combined together to aggregate abnormal information. For example, the service information of "device name" and the service information of "abnormal type" are combined together to form a service information dimension, or the three types of service information of "device name", "abnormal type" and "time" are combined together to form a service information dimension.
As mentioned above, the service information indicated in the service information dimension corresponds to a certain field in the exception information, in other words, a certain field in the exception information is the specific content of the corresponding service information. The exception information includes the service information, but for different exception information, the contents, i.e., the corresponding fields, may be matched, e.g., the same, or similar, but may also be unmatched.
According to the service information indicated by the service information dimension, a field used for matching in the abnormal information can be determined firstly, then the field is matched among a plurality of obtained abnormal information to obtain the abnormal information matched with the field, the abnormal information is matched on the service information dimension, and the abnormal information is aggregated to form batch processing information.
In addition, all the contents in the abnormal information can be aggregated to obtain the abnormal information which is the most similar as a whole, and the abnormal information is aggregated to form batch processing information.
The batch processing information is substantially a set of aggregated abnormal information, and batch processing is realized by realizing the same type of abnormal information through batch processing information, so that the batch performance and the timeliness are improved.
Fig. 6 is a flowchart illustrating a method for handling exception information in monitoring according to an example embodiment. The method for processing abnormal information in monitoring is suitable for the client 130 in the implementation environment shown in fig. 1. As shown in fig. 6, the method for processing the abnormal information during monitoring, which may be executed by the client 130, may include the following steps.
In step 610, an exception information viewing instruction is sent to the server.
The client is used for viewing and processing the abnormal information by the user. Each user, for example, operation and maintenance personnel in monitoring, may initiate an abnormal information viewing instruction to the server through the client.
In step 630, the batch processing information sent by the server according to the exception information checking instruction is received, and the batch processing information is an aggregation of the exception information requested to be checked.
After the client sends the abnormal information checking instruction to the server, batch processing information returned by the server is received, and the batch processing information is the aggregation of the abnormal information requested to be checked.
In step 650, the display of the batch processing information is performed to display the abnormality information in an aggregated manner.
The client displays the batch processing information, so that the aggregation display of the abnormal information is realized through the display of the batch processing information.
Through the process, the abnormal information in the client side can be checked, the checking of the abnormal information is enabled to be in batch, the processing of the abnormal information performed by the user can be in batch, a large amount of abnormal information can be processed at one time, and the timeliness of the processing of the abnormal information is improved.
Fig. 7 is a flowchart illustrating a method for handling exception information in monitoring according to an example embodiment. The method for processing abnormal information in monitoring, as shown in fig. 7, may include the following steps.
In step 710, a service information dimension configuration request of a user is initiated to a server.
As described above, the service information dimension configuration request of the user is used to initiate a service information dimension configuration process of the user through the client. Any user may initiate with the server through the client.
In step 730, a configuration page of the service information dimension is obtained from the server through the service information dimension configuration request of the user and displayed.
The client requests the server for the configuration page of the service information dimension through the service information dimension configuration request so as to jump to the configuration page of the requested service information dimension and display the configuration page.
In the configuration page of the service information dimension displayed by the client, the user can flexibly configure the service information dimension, namely, set, modify and delete the service information dimension.
In step 750, in the configuration page of the displayed service information dimension, the configuration of the service information dimension is performed, and the configured service information dimension is sent to the server.
The client side obtains the service information dimension configured by the user from the configuration page of the service information dimension, and then sends the service information dimension to the server.
Through the process, the configuration of the service information dimension in the client is realized, the service information dimension for realizing the abnormal information aggregation is personalized, and the user can configure the service information dimension in a personalized manner, so that the subsequent abnormal information aggregation is matched with the requirement of the user, the flexibility is improved, and meanwhile, the configuration of the service information dimension can be carried out according to the requirement of the user for processing the abnormal information, and the efficiency of processing the abnormal information can be improved to the maximum extent.
Taking monitoring of the state of the operation server inside an enterprise as an example, a processing method of abnormal information in the monitoring is described in combination with a specific application scenario.
The monitoring is the monitoring of the abnormal state in the operation server, and when the operation server is abnormal, the corresponding abnormal information is output to send out an alarm.
FIG. 8 is a system architecture diagram illustrating exception information handling during monitoring in accordance with an exemplary embodiment. The system architecture for processing the abnormal information in the monitoring receives the abnormal information output in the monitoring, aggregates the abnormal information and then distributes the aggregated information to the corresponding client.
If the abnormal information exists in the form of a work order, as shown in fig. 8, the work order generated due to the abnormality of the operation server during the monitoring process is pushed to the work order system 810.
FIG. 9 is a timing diagram in a system architecture illustrating exception information handling during monitoring according to an example embodiment. As shown in FIG. 9, the work order system 810 performs step 910 to receive a work order.
With the initiation of the abnormal information viewing operation in the client 830 where the user is located, the client 830 generates an abnormal information viewing instruction, and for the work order system 810, the abnormal information viewing instruction is a work order viewing instruction. The client 830 will perform step 920 and send a work order viewing instruction to the Web server 850 implementing backend access.
At this point, Web server 850 will execute step 930 to forward the user's work order viewing instructions to work order system 810.
The work order system 810 firstly queries whether a certain aggregation rule is configured in the work order processing performed by the user from the work order aggregation configuration library 870 according to the work order checking instruction of the user, for example, the aggregation rule of the user is obtained by querying according to a certain service information dimension or a rule of aggregating the work order content through the execution of step 940, or the user is known not to configure the aggregation rule.
On one hand, after obtaining the aggregation rule through query, the work order system 810 aggregates the work orders 960 that the user belongs to obtain the batch processing information, that is, a new work order formed by aggregating a plurality of work orders, and then returns the new work order to the client.
On the other hand, after the user is informed that the aggregation rule is not configured by the user, all the work orders to which the user belongs are directly returned, so that all the work orders are displayed in the client one by one.
FIG. 10 is a flow diagram illustrating a work order process in accordance with an exemplary embodiment. As shown in fig. 10, the user initiates a viewing process of the work order through the work order system 810, and for the work order system 810, the user performs step 1010 to determine whether to configure the aggregation rule of the work order through the work order aggregation configuration library 870, if so, performs step 130 to aggregate the work order, and if not, performs work order display in a normal manner.
It should be noted that the aggregation rule of the work order, as shown in fig. 11, may be configured by a user and stored in the work order aggregation configuration library, and fig. 11 is a schematic diagram of implementation of the custom configuration of the aggregation rule shown in an exemplary embodiment.
Through the process, when a user logs in the work order system to process a work order in an enterprise, if a plurality of work orders with similar problems exist, configuration of aggregation rules of the similar problems can be carried out, and then the work orders with the similar problems are aggregated together, for the user, how many similar problems appear can be quickly checked to quickly determine the reasons of the abnormal appearance and confirm and process the abnormal matters in batches.
In addition, on the basis, a time dimension can be added in the aggregation rule to aggregate the work orders with similar problems in a time period, and the work orders are subjected to batch confirmation and processing, so that the processing and the statement of all the work orders are completed in the same flow. Therefore, a plurality of work orders which need to be processed for many times originally become one work order which can be processed in batch, and therefore, the efficiency can be greatly improved.
For another example, when tracing back whether an intrusion event discovered after a certain event has a corresponding alarm in each monitoring link, the corresponding work order needs to be checked. The process can be realized by configuring corresponding aggregation rules, so that the time period and all the work orders related to the related machines are aggregated into a new work order, batch confirmation and tracing are carried out, the work orders of all the links are placed on the same interface in the client, namely, the same work order is displayed, scattered work orders are strung, which links are normally represented and which links are in problems are easy to know, therefore, different information visual angles can be flexibly constructed through the work order processing process, and further, events can be conveniently summarized, filed and traced.
For another example, for a vendor providing the high DDos service, the abnormal traffic situation may be monitored by using the work order processing procedure as described above, and the operator may configure the aggregation rule, thereby implementing automatic identification and aggregation of the work orders. For example, fields, source IP, target IP, attack methods, traffic peak values, and attack duration corresponding to some service information in the work order are extracted, and the aggregation similarity is set to 95%, so that a new work order can be automatically aggregated to see whether new attack situations and trends appear through the new work order, and besides improving efficiency, multiple views are provided for operation.
In the process, the processing method of the abnormal information in the monitoring realized by the disclosure can be accessed into the work order system, flexible interaction is added for the work order system, the work order aggregation is realized in a light weight way, and a scheme capable of long-term aggregation optimization is provided for the work order processing.
And the processing steps of the work order are also combined, the work order system is converted into a favorable operation tool, and the function of the work order system is enhanced.
The method for processing abnormal information in monitoring can be used for interfacing various alarms, customer complaints and the like, and is applied to machine monitoring and service monitoring, such as the scenes of a bank system, a game system and a cloud platform.
The following is an embodiment of the apparatus of the present disclosure, which may be used to execute an embodiment of a method for processing abnormal information in monitoring performed by the server 110 of the present disclosure. For details not disclosed in the embodiments of the apparatus of the present disclosure, please refer to the embodiments of the method for processing abnormal information in monitoring of the present disclosure.
Fig. 12 is a block diagram illustrating an apparatus for processing exception information in monitoring according to an example embodiment. As shown in fig. 12, the processing apparatus for exception information in monitoring includes, but is not limited to: an information acquisition module 1110, an aggregation module 1130, and a sending module 1150.
The information obtaining module 1110 is configured to receive an abnormal information checking instruction sent by the client, and obtain abnormal information output in monitoring according to the abnormal information checking instruction.
The aggregating module 1130 is configured to aggregate the exception information to obtain corresponding batch processing information.
A sending module 1150, configured to send batch processing information to the client according to the abnormal information checking instruction.
Fig. 13 is a block diagram illustrating details of the information acquisition module 1110 according to an example embodiment. The information obtaining module 1110, as shown in fig. 13, may include but is not limited to: an instruction receiving unit 1111 and an exception information acquiring unit 1113.
The instruction receiving unit 1111 is configured to receive an abnormal information checking instruction of a user in the client.
An abnormal information obtaining unit 1113, configured to obtain, according to the abnormal information viewing instruction of the user, the abnormal information to which the user belongs in the abnormal information that is monitored and output.
In an exemplary embodiment, the exception information checking instruction carries a user identifier, and the processing apparatus for exception information during monitoring may include, but is not limited to: and a dimension acquisition module.
The dimension acquisition module is used for checking the user identification carried in the instruction according to the abnormal information, searching the service information dimension corresponding to the user identification in the stored service information dimension, and the service information dimension is used for aggregating the abnormal information.
Fig. 14 is a block diagram illustrating a device for processing exception information during monitoring according to an example embodiment. The processing device for exception information during monitoring, as shown in fig. 14, may include but is not limited to: a request receiving module 1210, a dimension configuration module 1230, and a storage module 1250.
The request receiving module 1210 is configured to receive a service information dimension configuration request of a user, and push a configuration page of a service information dimension according to the service information dimension configuration request.
The dimension configuration module 1230 is configured to obtain the service information dimension configured by the user through the configuration page of the service information dimension.
The storage module 1250 is configured to use the user identifier as an index to perform corresponding storage of the user identifier and a service information dimension configured by the user.
In an exemplary embodiment, the service information dimension indicates service information of a single dimension or service information of a multi-dimension combination, the aggregation module 1130 is further configured to aggregate the abnormal information according to the configured service information dimension or content, and the abnormal information matched on the service information dimension or content is aggregated to form batch processing information.
Fig. 15 is a block diagram illustrating an apparatus for processing exception information in monitoring according to an example embodiment. As shown in fig. 15, the apparatus for processing exception information during monitoring may include, but is not limited to: an instruction transmitting module 1310, a batch information receiving module 1330 and a display module 1350.
The instruction sending module 1310 is configured to send an exception information checking instruction to the server.
The batch information receiving module 1330 is configured to receive batch processing information sent by the server according to the abnormal information checking instruction, where the batch processing information is an aggregation of the abnormal information requested to be checked.
The display module 1350 is configured to perform aggregation of the abnormal information by displaying the batch processing information.
Fig. 16 is a block diagram illustrating an apparatus for processing exception information in monitoring according to an example embodiment. The processing device for exception information during monitoring, as shown in fig. 16, may include but is not limited to: a configuration request initiation module 1410, a page display module 1430, and a dimension sending module 1450.
A configuration request initiating module 1410, configured to initiate a service information dimension configuration request of a user to a server.
And the page display module 1430, configured to obtain a configuration page of the service information dimension from the server through the service information dimension configuration request of the user, and display the configuration page.
The dimension sending module 1450 is configured to configure the service information dimension in the displayed configuration page of the service information dimension, and send the configured service information dimension to the server.
It will be understood that the invention is not limited to the precise arrangements described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the invention is limited only by the appended claims.
Claims (12)
1. A processing method for abnormal information in monitoring is characterized by comprising the following steps:
receiving an abnormal information checking instruction sent by a user in a client, and acquiring abnormal information output in monitoring according to the abnormal information checking instruction, wherein the abnormal information comprises at least one service information;
searching a service information dimension corresponding to the user identifier in the stored service information dimension according to the user identifier carried in the abnormal information checking instruction, wherein the service information dimension indicates service information according to which abnormal information aggregation is carried out, and the service information dimension is configured for the user;
determining fields corresponding to the service information according to which the service information dimension indicates abnormal information aggregation according to the service information dimension corresponding to the user identifier, and matching the fields among the abnormal information to obtain batch processing information corresponding to the abnormal information, wherein the batch processing information is an abnormal information set matched with the fields in the service information dimension configured by the user;
and sending the batch processing information to the client according to the abnormal information checking instruction.
2. The method according to claim 1, wherein the step of acquiring the exception information output in the monitoring according to the exception information checking instruction comprises:
and acquiring the abnormal information to which the user belongs in the abnormal information output by monitoring according to the abnormal information viewing instruction of the user.
3. The method of claim 1, further comprising:
receiving a service information dimension configuration request of a user, and pushing a configuration page of a service information dimension according to the service information dimension configuration request;
acquiring the service information dimension configured by the user through the configuration page of the service information dimension;
and correspondingly storing the user identification and the service information dimension configured by the user by taking the user identification as an index.
4. The method according to claim 1, wherein the service information dimension indicates one-dimensional service information or multi-dimensional combined service information, and the step of aggregating the abnormal information according to the service information dimension corresponding to the user identifier to obtain batch processing information corresponding to the abnormal information comprises:
and aggregating the abnormal information according to the configured service information dimension, and aggregating the abnormal information matched in the service information dimension to form batch processing information.
5. A processing method for abnormal information in monitoring is characterized by comprising the following steps:
sending an abnormal information checking instruction to a server, wherein the abnormal information checking instruction carries a user identifier;
receiving batch processing information sent by the server according to the abnormal information checking instruction, wherein the batch processing information is aggregation of abnormal information requested to be checked according to service information dimensionality corresponding to the user identification, the abnormal information requested to be checked comprises at least one type of service information, the service information dimensionality indicates service information according to which the abnormal information aggregation is carried out, the service information dimensionality is configured for the user, and the batch processing information is an abnormal information set which is matched with a field corresponding to the service information according to which the service information dimensionality indicates abnormal information aggregation in the service information dimensionality configured by the user;
and performing aggregation display of the abnormal information by displaying the batch processing information.
6. The method of claim 5, wherein the aggregation of anomaly information conforms to a configured business information dimension, the method further comprising:
initiating a service information dimension configuration request of a user to the server;
acquiring a configuration page of service information dimensionality from the server through the service information dimensionality configuration request of the user and displaying the configuration page;
and configuring the service information dimension in the displayed configuration page of the service information dimension, and sending the configured service information dimension to the server.
7. An apparatus for processing exception information during monitoring, the apparatus comprising:
the information acquisition module is used for receiving an abnormal information viewing instruction sent by a user at a client and acquiring abnormal information output in monitoring according to the abnormal information viewing instruction, wherein the abnormal information comprises at least one service information;
the dimension acquisition module is used for searching a service information dimension corresponding to the user identifier in the stored service information dimension according to the user identifier carried in the abnormal information check instruction, wherein the service information dimension indicates service information according to which abnormal information aggregation is carried out, and the service information dimension is configured for the user;
the aggregation module is used for determining a field corresponding to the service information according to which the service information dimension indicates abnormal information aggregation according to the service information dimension corresponding to the user identifier, and matching the field among the abnormal information to obtain batch processing information corresponding to the abnormal information, wherein the batch processing information is an abnormal information set matched with the field in the service information dimension configured by the user;
and the sending module is used for sending the batch processing information to the client according to the abnormal information checking instruction.
8. The apparatus of claim 7, wherein the information obtaining module comprises:
the instruction receiving unit is used for receiving an abnormal information checking instruction of a user in the client;
and the abnormal information acquisition unit is used for acquiring the abnormal information of the user in the abnormal information output by monitoring according to the abnormal information viewing instruction of the user.
9. The apparatus of claim 7, further comprising:
the request receiving module is used for receiving a service information dimension configuration request of a user and pushing a configuration page of a service information dimension according to the service information dimension configuration request;
the dimension configuration module is used for acquiring the service information dimension configured by the user through the configuration page of the service information dimension;
and the storage module is used for correspondingly storing the user identification and the service information dimensionality configured by the user by taking the user identification as an index.
10. The apparatus of claim 7, wherein the service information dimension indicates service information of a single dimension or service information of a combination of multiple dimensions, and the aggregation module is further configured to aggregate the exception information according to the configured service information dimension, and the exception information matched in the service information dimension is aggregated together to form batch processing information.
11. An apparatus for processing exception information during monitoring, the apparatus comprising:
the instruction sending module is used for sending an abnormal information checking instruction to the server, wherein the abnormal information checking instruction carries a user identifier;
a batch information receiving module, configured to receive batch processing information sent by the server according to the abnormal information check instruction, where the batch processing information is an aggregation of abnormal information requested to be checked according to a service information dimension corresponding to the user identifier, where the abnormal information requested to be checked includes multiple service information, the service information dimension indicates service information on which the abnormal information aggregation is performed, and the service information dimension is configured for the user, and the batch processing information is an abnormal information set, in the service information dimension configured by the user, that is matched with a field corresponding to the service information according to which the service information dimension indicates abnormal information aggregation;
and the display module is used for performing the aggregation display of the abnormal information through the display of the batch processing information.
12. The apparatus of claim 11, wherein the aggregation of anomaly information conforms to a configured traffic information dimension, the apparatus further comprising:
a configuration request initiating module, configured to initiate a service information dimension configuration request of a user to the server;
the page display module is used for obtaining a configuration page of the service information dimension from the server through the service information dimension configuration request of the user and displaying the configuration page;
and the dimension sending module is used for configuring the service information dimension in the displayed configuration page of the service information dimension and sending the configured service information dimension to the server.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610872019.4A CN107885634B (en) | 2016-09-29 | 2016-09-29 | Method and device for processing abnormal information in monitoring |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610872019.4A CN107885634B (en) | 2016-09-29 | 2016-09-29 | Method and device for processing abnormal information in monitoring |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN107885634A CN107885634A (en) | 2018-04-06 |
| CN107885634B true CN107885634B (en) | 2020-06-16 |
Family
ID=61768888
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610872019.4A Active CN107885634B (en) | 2016-09-29 | 2016-09-29 | Method and device for processing abnormal information in monitoring |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107885634B (en) |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110677310B (en) * | 2018-07-03 | 2023-04-07 | 百度在线网络技术（北京）有限公司 | Traffic attribution method, device and terminal |
| CN109189633A (en) * | 2018-07-27 | 2019-01-11 | 西安交通大学 | Holographic model running monitoring method in real time |
| CN110047163A (en) * | 2019-04-11 | 2019-07-23 | 吉旗（成都）科技有限公司 | A method of abnormal monitoring of checking card |
| CN111814999B (en) * | 2020-07-08 | 2024-01-16 | 上海燕汐软件信息科技有限公司 | Fault work order generation method, device and equipment |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101626363A (en) * | 2008-07-07 | 2010-01-13 | 华为技术有限公司 | Convergence service device and system, and convergence service establishing and using methods |
| CN104639359A (en) * | 2013-11-14 | 2015-05-20 | 华为技术有限公司 | Information processing method and device |
| CN104683370A (en) * | 2013-11-27 | 2015-06-03 | 腾讯科技（上海）有限公司 | Content aggregation method, server, client and system |
| CN105207806A (en) * | 2015-08-20 | 2015-12-30 | 百度在线网络技术（北京）有限公司 | Monitoring method and apparatus of distributed service |
| CN105490835A (en) * | 2015-11-20 | 2016-04-13 | 北京百度网讯科技有限公司 | Information monitoring method and device |
| CN105871581A (en) * | 2015-11-13 | 2016-08-17 | 乐视云计算有限公司 | Method and device for processing of alarm information in cloud calculation |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8230269B2 (en) * | 2008-06-17 | 2012-07-24 | Microsoft Corporation | Monitoring data categorization and module-based health correlations |
-
2016
- 2016-09-29 CN CN201610872019.4A patent/CN107885634B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101626363A (en) * | 2008-07-07 | 2010-01-13 | 华为技术有限公司 | Convergence service device and system, and convergence service establishing and using methods |
| CN104639359A (en) * | 2013-11-14 | 2015-05-20 | 华为技术有限公司 | Information processing method and device |
| CN104683370A (en) * | 2013-11-27 | 2015-06-03 | 腾讯科技（上海）有限公司 | Content aggregation method, server, client and system |
| CN105207806A (en) * | 2015-08-20 | 2015-12-30 | 百度在线网络技术（北京）有限公司 | Monitoring method and apparatus of distributed service |
| CN105871581A (en) * | 2015-11-13 | 2016-08-17 | 乐视云计算有限公司 | Method and device for processing of alarm information in cloud calculation |
| CN105490835A (en) * | 2015-11-20 | 2016-04-13 | 北京百度网讯科技有限公司 | Information monitoring method and device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107885634A (en) | 2018-04-06 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11789943B1 (en) | Configuring alerts for tags associated with high-latency and error spans for instrumented software | |
| US11646953B2 (en) | Identification of network issues by correlation of cross-platform performance data | |
| US11775501B2 (en) | Trace and span sampling and analysis for instrumented software | |
| US11803548B1 (en) | Automated generation of metrics from log data | |
| CN110730246A (en) | Distributed link tracking method under micro-service architecture | |
| CN107864063B (en) | Abnormity monitoring method and device and electronic equipment | |
| CN107885634B (en) | Method and device for processing abnormal information in monitoring | |
| EP4099170B1 (en) | Method and apparatus of auditing log, electronic device, and medium | |
| CN105447046A (en) | Distributed system data consistency processing method, device and system | |
| CN111740868B (en) | Alarm data processing method and device and storage medium | |
| CN112631913B (en) | Method, device, equipment and storage medium for monitoring operation faults of application program | |
| US11755531B1 (en) | System and method for storage of data utilizing a persistent queue | |
| CN107888452B (en) | 24-hour distributed website performance monitoring and real-time alarming method | |
| CN113672475B (en) | Alarm processing method and device, computer equipment and storage medium | |
| CN113656252B (en) | Fault positioning method, device, electronic equipment and storage medium | |
| CN114595075A (en) | Network scheduling asynchronous task execution method based on distributed scheduling | |
| CN107679198B (en) | Information query method and device | |
| CN111368039B (en) | Data management system | |
| CN110493326B (en) | Zookeeper-based cluster configuration file management system and method | |
| CN110011845B (en) | Log collection method and system | |
| CN114428704A (en) | Method and device for full-link distributed monitoring, computer equipment and storage medium | |
| US10949232B2 (en) | Managing virtualized computing resources in a cloud computing environment | |
| CN114969096A (en) | Message parsing method and device, electronic equipment and storage medium | |
| CN116260853A (en) | Connection management method and device for node equipment and storage medium | |
| CN115408357A (en) | File record processing method, device, equipment and medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |