CN108572907B

CN108572907B - Alarm method, alarm device, electronic equipment and computer readable storage medium

Info

Publication number: CN108572907B
Application number: CN201810071131.7A
Authority: CN
Inventors: 蔡志强
Original assignee: Beijing Jinxun Ruibo Network Technology Co Ltd; Beijing Kingsoft Cloud Network Technology Co Ltd; Beijing Kingsoft Cloud Technology Co Ltd
Current assignee: Beijing Jinxun Ruibo Network Technology Co Ltd; Beijing Kingsoft Cloud Network Technology Co Ltd; Beijing Kingsoft Cloud Technology Co Ltd
Priority date: 2018-01-25
Filing date: 2018-01-25
Publication date: 2022-05-06
Anticipated expiration: 2038-01-25
Also published as: CN108572907A

Abstract

The embodiment of the invention provides an alarming method, an alarming device, electronic equipment and a computer readable storage medium, wherein the alarming method comprises the following steps: acquiring a target request identifier, wherein the target request identifier is a request identifier corresponding to a currently sent alarm in a first preset alarm form, and one alarm corresponds to one request identifier; recording the incidence relation aiming at the target request identification, wherein each incidence relation comprises the request identification; judging whether the number of the currently recorded incidence relations is larger than a preset alarm number threshold value or not; if the number of the incidence relations is larger than the preset number, generating a target alarm in a second preset alarm form based on the number of the currently recorded incidence relations and a preset alarm template aiming at the second preset alarm form, wherein the first preset alarm form is different from the second preset alarm form; and transmitting the target alarm to a preset first receiving object. By applying the embodiment of the invention, the alarm for the serious business abnormity can be given.

Description

Alarm method, alarm device, electronic equipment and computer readable storage medium

Technical Field

The present invention relates to the field of computer technologies, and in particular, to an alarm method, an alarm device, an electronic device, and a computer-readable storage medium.

Background

In order to provide a better service, it is necessary to ensure the normal operation of each service. Furthermore, when the abnormal service occurs, an alarm is generated by using an automatic alarm technology, so that operation and maintenance personnel can position and diagnose the abnormal service according to the alarm and complete corresponding maintenance operation.

The automatic alarm technology comprises an email alarm technology based on ELK (elastic search Logstash Kibana), wherein the elastic search is a search server based on Lucene (full text search engine) and provides a full text search engine with distributed multi-user capability; the Logstash is a lightweight log collecting and processing framework, and can conveniently collect scattered and diversified logs and perform self-defined processing; kibana is an open source analysis and visualization platform designed for use with the elastic search. Logstash collects logs sent by FileBeat (log file consignment), extracts error information and time recorded by the logs from the logs, sends the extracted error information and time to an elastic search, Kibana obtains information from the elastic search, generates an alarm in a mail form according to a preset mail alarm rule, and sends the alarm. However, the above-mentioned alarm method sends an email alarm once for one error message, and cannot alarm against a serious abnormal service.

Disclosure of Invention

The embodiment of the invention aims to provide an alarming method, an alarming device, electronic equipment and a computer readable storage medium, so as to realize alarming for serious business abnormity. The specific technical scheme is as follows:

in a first aspect, to achieve the above object, an embodiment of the present invention discloses an alarm method, where the method includes:

acquiring a target request identifier, wherein the target request identifier is a request identifier corresponding to a currently sent alarm in a first preset alarm form, and one alarm corresponds to one request identifier;

recording incidence relations aiming at the target request identification, wherein each incidence relation comprises the request identification;

judging whether the number of the currently recorded incidence relations is larger than a preset alarm number threshold value or not;

if the number of the incidence relations recorded currently is larger than a preset alarm number threshold value, generating a target alarm in a second preset alarm form based on the number of the incidence relations recorded currently and an alarm template preset for the second preset alarm form, wherein the first preset alarm form is different from the second preset alarm form;

and transmitting the target alarm to a preset first receiving object.

Optionally, each association relationship further records storage time for the request identifier record in the association relationship;

under the condition that the number of all the current incidence relations is judged to be larger than the preset alarm number threshold, the method further comprises the following steps:

judging whether an incidence relation with the storage time before the target time is recorded in the currently recorded incidence relation or not, wherein the target time is the difference between the current time and a preset time threshold;

if the incidence relation of the storage time before the target time does not exist, executing the step of generating the target alarm in the second preset alarm form based on the number of the currently recorded incidence relation and an alarm template preset aiming at the second preset alarm form;

if the incidence relation of the storage time before the target time exists, deleting the incidence relation of the storage time before the target time; and after the incidence relation of which the storage time is before the target time is deleted, under the condition that the number of the recorded incidence relations is still larger than the alarm number threshold, executing a step of generating the target alarm in a second preset alarm form based on the number of the currently recorded incidence relations and an alarm template preset aiming at the second preset alarm form.

Optionally, each association relationship further records the number of times of alarming for the request identifier record in the association relationship;

judging whether an incidence relation with the alarm times larger than a preset alarm time threshold exists in the incidence relation of the storage time in a target time period, wherein the target time period is a time period determined based on the target time and the current time;

if the incidence relation that the alarming frequency is larger than the preset alarming frequency threshold value does not exist, executing the step of generating the target alarm of the second preset alarming form based on the number of the incidence relation recorded at present and the preset alarming template aiming at the second preset alarming form;

if the association relationship that the alarm times are greater than the preset alarm time threshold exists, deleting the association relationship that the alarm times are greater than the preset alarm time threshold; and after the incidence relation of which the alarm frequency is greater than the preset alarm frequency threshold value is deleted, under the condition that the number of the recorded incidence relations is still greater than the alarm number threshold value, executing a step of generating a target alarm of a second preset alarm form based on the number of the currently recorded incidence relations and an alarm template preset aiming at the second preset alarm form.

Optionally, after transmitting the target alert to the determined receiving object, the method further includes:

and aiming at each incidence relation recorded currently, increasing the alarm times recorded in the incidence relation by a preset quantity value.

Optionally, before the step of obtaining the target request identifier corresponding to the currently sent alarm in the first preset form, the method further includes:

obtaining a target log, wherein the target log is an error log with a preset pattern, and the target log comprises a target service identifier;

determining an alarm form having a corresponding relation with a target service identifier according to a corresponding relation between a pre-established service identifier and a preset alarm form; wherein the determined alarm form comprises a first preset alarm form;

generating an alarm in a first preset form based on the target log and an alarm template preset for the first pre-alarm form;

determining a second receiving object of the generated alarm in the first preset alarm form;

and transmitting the generated alarm in the first preset alarm form to a second receiving object.

Optionally, in a case that the determined alert form further includes a third preset alert form, the method further includes:

generating an alarm in a third preset alarm form based on the target log and an alarm template preset aiming at the third preset alarm form;

determining a third receiving object of the generated alarm in the third preset alarm form;

and transmitting the generated alarm in the form of the third preset alarm to a third receiving object.

Optionally, the step of obtaining the target log includes:

obtaining a currently generated error log;

judging whether the service identifier contained in the obtained error log is a preset non-alarm service identifier or not;

and if the error log is not the preset non-alarm service identifier, taking the currently obtained error log as a target log.

Optionally, the step of obtaining the target log when it is determined that the service identifier included in the currently generated log is not the preset non-alarm service identifier further includes:

judging whether the request corresponding to the currently obtained error log is an illegal request or not, wherein one log corresponds to one request;

and if the request is not an illegal request, executing the step of taking the currently obtained error log as a target log.

Optionally, determining an alarm form having a correspondence with the target service identifier according to a correspondence between a pre-established service identifier and a preset alarm form, where the determining includes:

determining a target service level according to a pre-established association relationship between the service identifier and the service level, wherein the target service level is a service level having an association relationship with the target identifier;

and determining an alarm form having a corresponding relation with the target service according to the corresponding relation between the pre-established service grade and the alarm form.

In a second aspect, to achieve the above object, an embodiment of the present invention further provides an alarm device, where the alarm device includes:

the system comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is used for acquiring a target request identifier, and the target request identifier is a request identifier corresponding to a currently sent alarm in a first preset alarm form; one alarm corresponds to one request identification;

the recording module is used for recording the incidence relation aiming at the target request identifier, wherein each incidence relation comprises the request identifier;

the first judgment module is used for judging whether the number of the currently recorded incidence relations is larger than a preset alarm number threshold value or not;

the first generation module generates a target alarm in a second preset alarm form based on the number of the currently recorded incidence relations and an alarm template preset for the second preset alarm form under the condition that the judgment result of the first judgment module is greater than the judgment result of the first judgment module, wherein the first preset alarm form is different from the second preset alarm form;

the first transmission module is used for transmitting the target alarm to a preset first receiving object.

the device still includes:

the second judging module is used for judging whether an incidence relation with the storage time before the target time is recorded in the currently recorded incidence relation or not under the condition that the judging result of the first judging module is greater than the judging result of the first judging module, wherein the target time is the difference between the current time and a preset time threshold;

the first generation module is further used for generating a target alarm in a second preset alarm form based on the number of the currently recorded incidence relations and an alarm template preset for the second preset alarm form under the condition that the judgment result of the second judgment module does not exist; (ii) a Generating a target alarm in a second preset alarm form based on the number of the currently recorded incidence relations and an alarm template preset in the second preset alarm form under the condition that the number of the recorded incidence relations is still larger than an alarm number threshold after the incidence relations with the storage time before the target time are deleted;

and the first deleting module is further used for deleting the association relation of the storage time before the target time under the condition that the judgment result of the second judging module is existence.

the device still includes:

the third judgment module is used for judging whether the incidence relation of which the alarm times are greater than a preset alarm time threshold exists in the incidence relation of the storage time in a target time period, wherein the target time period is a time period determined based on the target time and the current time;

the first generating module is further configured to generate a target alarm in a second preset alarm form based on the number of the currently recorded association relations and an alarm template preset for the second preset alarm form when the determination result of the third determining module is non-existent; generating a target alarm in a second preset alarm form based on the number of the currently recorded association relations and an alarm template preset for the second preset alarm form under the condition that the number of the currently recorded association relations is also larger than an alarm number threshold after deleting the association relations of which the storage time is before the target time or deleting the association relations of which the alarm times are larger than a preset alarm time threshold;

and the second deleting module is further used for deleting the association relation of which the alarm frequency is greater than the preset alarm frequency threshold under the condition that the judgment result of the third judging module is existence.

Optionally, the apparatus further comprises:

and the increasing module is used for increasing the alarm times recorded in the association relation by a preset quantity value aiming at each association relation recorded currently.

Optionally, the apparatus further comprises:

the system comprises an obtaining module, a processing module and a processing module, wherein the obtaining module is used for obtaining a target log, the target log is an error log with a preset pattern, and the target log comprises a target service identifier;

the first determining module is used for determining an alarm form corresponding to the target service identifier according to the corresponding relation between the pre-established service identifier and the preset alarm form; wherein, the determined alarm form comprises a first preset alarm form;

the second generation module is used for generating the alarm in the first preset form based on the target log and an alarm template preset aiming at the first pre-alarm form;

a second determination module, configured to determine a second receiving object of the generated alarm in the first preset alarm form;

and the second transmission module is used for transmitting the generated alarm in the first preset alarm form to a second receiving object.

Optionally, the apparatus further comprises:

a third generation module, configured to generate an alarm in a third preset alarm form based on the target log and an alarm template preset for the third preset alarm form when the determined alarm form further includes the third preset alarm form;

a third determining module, configured to determine a third receiving object of the generated alarm in the third preset alarm form;

and the third transmission module is used for transmitting the generated alarm in the third preset alarm form to a third receiving object.

Optionally, the obtaining module is specifically configured to:

obtaining a currently generated error log;

and if not, taking the currently obtained error log as a target log.

Optionally, the obtaining module is further configured to:

under the condition that the service identification contained in the currently generated log is judged not to be a preset non-alarm service identification, judging whether the request corresponding to the currently obtained error log is an illegal request or not, wherein one log corresponds to one request;

if not, executing the step of taking the currently obtained error log as a target log.

Optionally, the first determining module is specifically configured to:

In a third aspect, to achieve the above object, an embodiment of the present invention further provides an electronic device, including a processor and a memory, wherein,

a memory for storing a computer program;

and the processor is used for realizing the alarm method of the first aspect when executing the program stored in the memory.

In a fourth aspect, to achieve the above object, an embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored, and the computer program, when executed by a processor, implements the alert method of the first aspect.

In a fifth aspect, embodiments of the present invention provide a computer program product containing instructions which, when run on a computer, cause the computer to perform the alert method of the first aspect.

In a sixth aspect, an embodiment of the present invention provides a computer program, which when run on a computer, causes the computer to execute the alert method of the first aspect.

According to the alarm method, the alarm device, the electronic equipment and the computer readable storage medium provided by the embodiment of the invention, when the alarm in the first preset alarm form reaches the preset alarm quantity threshold value, it is indicated that a major business abnormality is possible to occur, and at the moment, the alarm in the second preset alarm form is sent, so that the first receiving object can acquire the information that the major business abnormality is possible to exist, and therefore, the major business abnormality can be alarmed. Of course, it is not necessary for any product or method to achieve all of the above advantages at the same time for practicing the invention.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.

Fig. 1 is a first flowchart of an alarm method according to an embodiment of the present invention;

fig. 2 is a schematic flowchart of a second warning method according to an embodiment of the present invention;

fig. 3 is a third flowchart illustrating an alarm method according to an embodiment of the present invention;

fig. 4 is a fourth flowchart illustrating an alarm method according to an embodiment of the present invention;

fig. 5 is a fifth flowchart of an alarm method according to an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of an alarm device according to an embodiment of the present invention;

fig. 7 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

In order to solve the problems in the prior art, embodiments of the present invention provide an alarm method, an alarm device, an electronic device, and a computer-readable storage medium.

Fig. 1 is a first flowchart of an alarm method according to an embodiment of the present invention; the method comprises the following steps:

s101: and acquiring a target request identifier, wherein the target request identifier is a request identifier corresponding to a currently sent alarm in a first preset alarm form, and one alarm corresponds to one request identifier.

In the embodiment of the invention, the alarm type of the first preset alarm form can be an email type or a short message type; it may be a message notification type, or a telephone alarm, or of course, it may be of another type. The alarm forms are determined by the alarm types and the alarm templates together, the alarm types are different, but the two alarm forms with the same alarm template are different alarm forms; the alarm types are the same, but two alarm forms with different alarm templates are different alarm forms. The alarm template is a template set for the content to be sent, and the alarm template of each preset alarm form is preset.

An alarm in a first preset alarm form corresponds to an error log, the error log is a log recorded with information of error information, and a request identifier is also recorded in the error log. The request identifier is an identifier of a request corresponding to an alarm, and an identifier of a request corresponding to a currently sent alarm in a first preset alarm form is referred to as a target request identifier. The request identification may include at least one of a letter, a number, a letter, a character, and a symbol. The request identification may be generated at the time the request is generated. And aiming at one request, generating a request identifier, wherein different requests correspond to different request identifiers.

After an alarm in a first preset alarm form is sent, a request identifier corresponding to the alarm is obtained, and the obtained request identifier is a target request identifier. The specific method for acquiring the target request identifier may be acquired from a log corresponding to an alarm in the first preset alarm form, may also be acquired from an alarm in the first preset alarm form, and may also be acquired in other manners.

S102: and recording the association relation aiming at the target request identifier, wherein each association relation comprises the request identifier.

One association relationship corresponds to one request identifier, that is, it can be understood that request identifiers recorded in different association relationships are also different.

S103: and judging whether the number of the currently recorded incidence relations is larger than a preset alarm number threshold, if so, executing S104, and if not, ending.

The association relationship may be recorded in a queue, and the elements stored in the queue are the association relationships, and each association relationship includes a request identifier. Specifically, the queue may be a bounded queue, so that the number of recorded association relationships is not increased without limitation, and the number of recorded association relationships is guaranteed to be within a controllable range. The number of associations currently recorded may be determined by scanning the length of this queue. The number of the currently recorded association relations is the number of the currently recorded request identifications.

The alarm quantity threshold value can be set according to experience or the total alarm quantity corresponding to the previous serious abnormal business.

The number of the incidence relations recorded at present reflects the number of the alarms in the first preset alarm form sent. If the number of the recorded association relations is larger than the preset alarm number threshold, it indicates that there are more alarms in the first preset alarm form sent within a period of time, and a major business abnormality may occur, and at this time, an alarm needs to be given.

When the number of the recorded incidence relations is judged to be less than or equal to the preset alarm number threshold, the alarm generated in a period of time is less, and the alarm is less, the possibility of occurrence of major service abnormity is very low, and the alarm in the second preset alarm form does not need to be sent.

S104: and generating a target alarm in a second preset alarm form based on the number of the incidence relations recorded currently and an alarm template preset for the second preset alarm form, wherein the first preset alarm form is different from the second preset alarm form.

The first preset alarm form and the second preset alarm form are different, which means that the alarm types of the first preset alarm form and the second preset alarm form are different, or the alarm template corresponding to the first preset alarm form is different from the alarm template corresponding to the second preset alarm form, or the alarm types of the first preset alarm form and the second preset alarm form are different, but the corresponding alarm templates are the same; the first preset alarm form and the second preset alarm form can have the same alarm type but different corresponding alarm templates.

The alarm template preset for the second preset alarm form includes the content of the alarm in the second preset alarm form, specifically, the number of the currently recorded association relationships, and may further include other information. And replacing the information in the set template with the number of the incidence relations and other specific information of the current record to generate the target alarm. Illustratively, the templates provided are: in XX minutes, XXX times of warning are given, major business abnormity possibly occurs, and the business is required to be processed in time; the number of the currently recorded association relations is 120, and it is further obtained that the 120 alarms are generated within 5 minutes, and the generated target alarm is: within 5 minutes, 120 alarms have been given, and a major business anomaly may occur, please handle it in time.

In the embodiment of the present invention, a tool class for sending an alarm in a first preset alarm form is implemented, in which an alarm template corresponding to the first preset alarm form, a content such as a receiving object of the alarm in the first preset alarm form, and the like are defined. Java is an object-oriented programming language, which not only absorbs various advantages of C + + language, but also abandons concepts such as multiple inheritance and pointers which are difficult to understand in C + +, so that the Java language has two characteristics of strong function, simplicity and easy use. The applicator is responsible for defining the destination of log output, and may be a Console (Console applicator), a File (File applicator), a JMS (Java Message Service ) server (JMS log applicator), an application sent in Email (Simple Mail Transfer Protocol, SMTP) format, and the like. Appendix is a class provided in log4j, log4j is an open source code entry of Apache, and by using log4j we can control the delivery of log information to destinations such as consoles, files, GUI (Graphical User Interface) components, etc. Apache is the world's first web server software to use, can run on almost all widely used computer platforms, is one of the most popular web server side software due to its widespread use across platforms and security.

S105: and transmitting the target alarm to a preset first receiving object.

The first receiving object refers to an object that will receive a target alert. The first receiving object may be one object or a plurality of objects, and the number of receiving objects included in the specific first receiving object is set in advance. When the alarm type corresponding to the second preset alarm form is the mail type, the first receiving object is a mailbox, which may be, for example, a mailbox of a service operation and maintenance worker; when the alarm type corresponding to the second preset alarm form is a short message type or a telephone type, the first receiving object is a mobile phone number, which may be, for example, a mobile phone number of a predetermined person who needs to process an abnormal service; when the alarm type corresponding to the second preset alarm form is a message notification type, the first receiving object is a predetermined account of the receiving person, illustratively, the second preset alarm form is specifically a message notification of an application, and the first receiving object is a predetermined account of the receiving person in the application.

After a target alarm is generated and a first receiving object is determined, the target alarm is transmitted to the first receiving object, so that a receiving person corresponding to the first receiving object can timely know the alarm that major business abnormity is likely to occur, the line business can be checked according to the alarm to determine whether the abnormity occurs, and if the abnormity occurs, the abnormal business is maintained, so that the business can be recovered to normally operate as soon as possible.

In the embodiment of the invention, when the alarm in the first preset alarm form reaches the preset alarm quantity threshold, the serious business abnormity is possibly generated, and the alarm in the second preset alarm form is sent at the moment, so that the first receiving object can acquire the information of the possible serious business abnormity, and the serious business abnormity can be alarmed.

Fig. 2 is a second flowchart of the alarm method according to the embodiment of the present invention, where the method includes:

s201: acquiring a target request identifier, wherein the target request identifier is a request identifier corresponding to a currently sent alarm in a first preset alarm form; an alarm corresponds to a request identification.

S202: and recording the association relation aiming at the target request identifier, wherein each association relation comprises the request identifier.

S203: and judging whether the number of the currently recorded association relations is larger than a preset alarm number threshold, if so, executing S204, and if not, ending.

S204: judging whether the incidence relation with the storage time before the target time exists in the incidence relations recorded currently, if not, executing S207, and if so, executing S205; the target time is the difference between the current time and a preset time threshold.

In the embodiment of the present invention, each association relationship further records a storage time for the request identification record in the association relationship.

The storage time for the request identifier record may be the time when the request identifier is sent, the time when the request identifier is recorded, or the time corresponding to the timestamp recorded in the log. One request identification corresponds to one storage time.

In the embodiment of the present invention, the recorded storage time may be compared with the target time, if there is an association relationship in which the storage time is greater than the target time, S205 is executed, if there is no association relationship, if the currently recorded association relationship is recorded in the time period from the target time to the current time, it indicates that a large number of alarms occur in the online service in a short time, and a major service anomaly may occur, and at this time, an alarm in the form of a second preset alarm needs to be sent.

The current time may be a current system time or a currently obtained time, and the currently obtained time may be a time of a current clock or a system time of another server. The preset time threshold may be a time threshold set according to experience, or a time threshold set according to an operation rule before the service, or may be set in other manners. Illustratively, if the current time is 2017, 1 month, 1 day, 9:05, and the previous time threshold is 5 minutes, then the target time is 2017, 1 month, 1 day, 9: 00.

When the association relationship is stored in the queue, because of the nature of the queue, the association relationship is arranged according to the recorded sequence, the scanning can be performed from back to front, when the association relationship with the storage time longer than the target time is scanned, the scanning can be stopped, because the association relationships recorded before the association relationship are all the association relationships with the storage time longer than the target time, at this time, the association relationship from the association relationship to the head of the queue can be determined as the association relationship to be deleted.

S205: and deleting the association relation of the storage time before the target time.

In the step S204, in the process of determining whether or not there is an association relationship whose storage time is before the target time, the association relationship whose storage time is before the target time is determined, and the determined association relationship may be deleted. Deleting the association relation of the storage time before the target time can avoid the influence of the association relation stored long before on the judgment result and the accumulation of the number of the recorded association relations, and can also avoid the occurrence of false alarm.

S206: and judging whether the number of the currently recorded incidence relations is larger than a preset alarm number threshold, if so, executing S207, and if not, ending.

After deleting the association relationship of the storage time before the target time, it is necessary to judge again whether the number of the association relationships recorded at this time is greater than the preset alarm number threshold, and if the number of the association relationships is less than or equal to the preset alarm number threshold, it indicates that there are not many alarms generated in a short time and the possibility of major abnormality of the service is low, the alarm in the second preset alarm form is not performed, but S201 is waited to be executed.

S207: and generating a target alarm in a second preset alarm form based on the number of the incidence relations recorded currently and an alarm template preset for the second preset alarm form, wherein the first preset alarm form is different from the second preset alarm form.

S208: and transmitting the target alarm to a preset first receiving object.

In the embodiment of the invention, when the number of the incidence relations recorded in the time period is greater than the preset alarm number threshold value in one time period, the important business abnormity may occur, and for the condition, the alarm in the second preset form is sent, so that the important business abnormity can be timely alarmed, and the alarm of the important business abnormity is more accurate.

Fig. 3 is a schematic diagram of a third flow of an alarm method according to an embodiment of the present invention, where the method includes:

s301: acquiring a target request identifier, wherein the target request identifier is a request identifier corresponding to a currently sent alarm in a first preset alarm form; an alarm corresponds to a request identification.

S302: and recording the incidence relation aiming at the target request identifier, wherein each incidence relation comprises the request identifier.

S303: and judging whether the number of the currently recorded incidence relations is larger than a preset alarm number threshold, if so, executing S304, and if not, ending.

S304: judging whether the incidence relation with the storage time before the target time exists in the incidence relations recorded currently, if not, executing S306, and if so, executing S305; the target time is the difference between the current time and a preset time threshold.

S305: and deleting the association relation of the storage time before the target time.

It should be noted that S301 to S305 are the same as S201 to S205, respectively, and are not described herein again.

S306: judging whether an association relationship with the alarm times larger than a preset alarm time threshold exists in the association relationship of the storage time in the target time period, and if so, executing S307; if so, in the case where S305 is not executed, S309 is executed, and in the case where S305 is executed, S308 is executed; wherein the target time period is a time period determined based on the target time and the current time.

In the embodiment of the present invention, each association relationship further records the number of times of alarming for the request identifier in the association relationship. Each incidence relation is the incidence relation among the storage request identification, the storage time and the alarm times. Illustratively, the association records the request identifier a, the storage time of the request identifier a, and the number of times of alarming recorded for the request identifier a.

The number of times of alarms recorded for a request identification is determined based on the number of times of sending an alarm in the second preset alarm form counted from the recording of the request identification to the present. When an association relationship corresponding to one request identifier is to be recorded, the number of times that an alarm has been given for the request identifier is an initial value, which may be 0 or 1, for example.

The target time period is a time period from the start of the target time to the end of the current time, and the current time is the current time used for determining the target time. Illustratively, the current time is 2017, 1/9: 05, the target time is 2017, 1/9: 00, and the target time period is 2017, 1/9: 00-2017, 1/9: 05.

Judging whether an association relationship with the alarm times larger than a preset alarm time threshold exists in the association relationship of the storage time in the target time period, namely judging whether an association relationship with the alarm times larger than the preset alarm time threshold exists in the association relationship of the storage time in the predetermined target time period. For example, it may be determined whether the association relationship recorded in the period from 9:00 in 1/9: 05 in 2017 to 9:05 in 1/2017 has an association relationship with the number of times that the alarm has been given is greater than 5. If the alarm exists, performing S307, and if the alarm does not exist and S305 has not been performed before, indicating that the number of the recorded association relations is not changed and still greater than the preset alarm number threshold, the number of alarms occurring within the target time period already exceeds the preset alarm number threshold, and an alarm in the second preset alarm form needs to be sent; if there is no correlation and S305 is previously performed, the number of recorded correlations is changed, and S308 needs to be performed.

S307: and deleting the association relation of which the alarm times are greater than a preset alarm time threshold.

In the judging process, the incidence relation that the alarm frequency is greater than the preset alarm frequency threshold value is determined, and the determined incidence relation is deleted. Therefore, the number of recorded incidence relations can be reduced, the number of times of sending the second preset alarm form aiming at one major business abnormity can be reduced, resources can be saved, and the user experience can be improved by reducing the number of times of sending the second preset alarm form aiming at the same major business abnormity repeatedly.

S308: and judging whether the number of the currently recorded incidence relations is larger than a preset alarm number threshold value or not, and if so, executing S309.

In the above process, if the deletion of the association causes a change in the number of recorded associations, S308 needs to be executed, specifically, S308 is executed when the association whose storage time is before the target time is deleted and there is no association whose alarm frequency is greater than a preset alarm frequency threshold; executing S308 under the condition that the association relationship of the storage time before the target time does not exist and the association relationship of which the alarm frequency is greater than the preset alarm frequency threshold value is deleted; in the case where the association that the storage time is before the target time is deleted and the association that the number of times of alarm has been greater than the preset alarm number threshold is deleted, S308 is performed.

S309: and generating a target alarm in a second preset alarm form based on the number of the incidence relations recorded at present and an alarm template preset for the second preset alarm form.

S310: and transmitting the target alarm to a preset first receiving object.

In the embodiment of the present invention, after the target alarm is transmitted to the preset first receiving object, in order to obtain a correct result when S306 is executed next time, a preset quantity value needs to be added to the number of times of alarms recorded in the association relationship for each association relationship currently recorded. Specifically, after an alarm in a second preset alarm form is sent, for each incidence relation recorded at present, the number of times of the alarm recorded in the incidence relation is increased by a preset number value. The predetermined numerical value is a positive number, and may be 1, 2, or another numerical value, for example. For example, the number of times of the alarm recorded for the request identifier a is 2, and after sending an alarm in the first and second preset alarm forms, the number of times of the alarm recorded for the request identifier a is increased by 1 time on the basis of 2 times, that is, the number of times of the alarm recorded for the request identifier a is 3 times.

In the embodiment of the invention, when the number of the recorded association relations in the target time period is greater than the preset alarm number threshold, the important business abnormity may occur, and for the condition, the alarm in the second preset form is sent, so that the important business abnormity can be alarmed in time.

Fig. 4 is a fourth flowchart illustrating an alarm method according to an embodiment of the present invention, where the method includes:

s401: and obtaining a target log, wherein the target log is an error log with a preset pattern, and the target log comprises a target service identifier.

In the web service, when one request is processed completely or the request cannot be processed due to an exception in the request processing process, a log is generated. In the embodiment of the invention, the log can be obtained from the log itself or from other servers.

The log can be divided into an access log and an error log, wherein the error log is a log of access errors of the web service, namely the error log can be understood as a log recording business anomalies. In the embodiment of the invention, the target log is an error log, namely, an alarm is given to an error in the error log, so that the currently generated log needs to be screened, the access log is filtered, the alarm generated aiming at the access log is avoided, and the condition of false alarm caused by the alarm generated on the access log is further avoided.

The preset pattern referred to herein is a pattern of information recorded in the log for the purpose of standardization of the log. Illustratively, the log pattern may be as follows:

timestamp is a Timestamp, Request-id (identity) is the Request identifier, Account id is an Account number of the user who sends the Request corresponding to the Request identifier, and Region is a Region where the server corresponding to the Request is located. Serverpp refers to ip (Internet Protocol, Protocol for interconnection between networks) address of the server, Parameters refers to Parameters, here refers to parameter list of the request, ErrMsg refers to error stack information, and the above xxx and xxxx refer to the content of these places, which may vary according to the actual situation.

The service identifier may refer to a specific service name recorded in the log, and an exemplary service name may be RunInstances (running instances).

In the embodiment of the present invention, the log format may be a json (JavaScript Object Notation) format, and may also be an Extensible Markup Language (XML) format.

In the embodiment of the invention, the filtering rule of the error log is predefined, specifically, the filtering rule can be defined in the configuration file, and finally the filtering of the error log is realized in the code, so that the generation of the false alarm times is reduced. The filtering rule may filter out an error log corresponding to the non-alarm service identifier, and the specific filtering manner may be:

obtaining a currently generated error log;

and if not, taking the currently obtained error log as a target log.

The web services have a plurality of services, the abnormal of some services can have great influence on the normal operation of the web services, the abnormal of some services hardly has influence on the normal operation of the web services, and the service identifiers corresponding to the services with very small influence on the operation of the web services can be used as the non-alarm service identifiers. Judging whether a service identifier carried by a currently generated error log is a service identifier in a non-alarm service identifier, if not, when the service identifier corresponding to the error log is abnormal, the service identifier can have a larger influence on the normal operation of the web service, and if not, when the service identifier corresponding to the error log is abnormal, the error log is used as a target log, and if not, the service identifier corresponding to the error log has a smaller influence on the normal operation of the web service.

The web service has not only the access of normal users, but also the access of illegal users, the times of the illegal users possibly accessing the web service in a short time are very large, a large number of illegal requests are generated, thus the access pressure of the web service can be increased, when the web service has business abnormality, a large number of alarms in a first preset alarm form and alarms in a second preset alarm form can be generated, not only is the pressure caused to the web service, but also a large number of false alarms are generated, and the workload of whether major business abnormality occurs or not can be determined for operation and maintenance personnel of the web service.

Based on the above reasons, an error log corresponding to the illegal request may be further filtered out in the filtering rule setting, and the specific filtering rule may be: under the condition that the service identification contained in the currently generated log is judged not to be a preset non-alarm service identification, judging whether the request corresponding to the currently obtained error log is an illegal request or not, wherein one log corresponds to one request;

if not, executing the step of taking the currently obtained error log as the target log.

Judging whether the request is an illegal request, judging whether the request is an illegal request through the accountant recorded in the log, judging whether the accountant is an accountant in a user white list, if so, indicating that the request is a legal request, and if not, indicating that the request is an illegal request. When the request is judged to be a legal request, the error log is taken as a target log, and when the request is judged to be an illegal request, the error log is not taken as the target log in order to reduce the pressure of web service and the number of times of false alarm and further reduce the workload increased to operation and maintenance personnel due to the false alarm.

S402: determining an alarm form having a corresponding relation with a target service identifier according to a corresponding relation between a pre-established service identifier and a preset alarm form; wherein, the determined alarm form comprises a first preset alarm form.

In the embodiment of the invention, the same alarm form can be set for different services, and different alarm forms can also be set. The method includes setting an alarm form corresponding to a service, that is, establishing a corresponding relationship between a service identifier and the alarm form, specifically, establishing a corresponding relationship between each service and the alarm form, and determining a corresponding relationship including a target service identifier from the established corresponding relationship, where the alarm form in the determined corresponding relationship is the alarm form corresponding to the target service identifier.

It should be noted that, for each service identifier, the alarm form corresponding to the service identifier includes a first preset alarm form, and may also include other alarm forms.

In an embodiment of the present invention, determining an alarm form having a correspondence with a target service identifier according to a correspondence between a pre-established service identifier and a preset alarm form includes:

In the embodiment of the invention, the services are classified, so that the services are determined to be relatively important services and relatively unimportant services, for example, the services can be classified into different grades according to the importance degree of the services. The importance degree of the service can be determined according to the influence degree of the abnormal occurrence of the service on the online service, and can also be determined according to the access quantity of the service, and the more the access quantity of the service is, the more important the service can be considered.

Each service grade comprises at least one service identification, after the service identification is obtained, a target service grade corresponding to the determined service identification is determined according to the association relationship between the service identification and the service grade which are established in advance, and after the target service grade is determined, an alarm form having a corresponding relationship with the target service grade is determined according to the corresponding relationship between the service grade and the alarm form which are established in advance.

In the embodiment of the present invention, the level corresponding to the important service is higher than the level corresponding to the unimportant service, and different alarm forms are set for different service levels, for example, the alarm form set for the important service is a second preset alarm form and a third preset alarm form, and the alarm form set for the common service is the second preset alarm form.

Therefore, the alarm form is determined according to the service grade, the importance degree of the service can be reflected, different alarm forms are set specifically aiming at different service grades, and therefore operation and maintenance personnel can know that the on-line important service is abnormal, the operation and maintenance personnel can maintain the abnormal important service in time, and the situation of poor user experience caused by the abnormal service is reduced.

S403: and generating the alarm in the first preset alarm form based on the target log and an alarm template preset for the first pre-alarm form.

The alarm template set for the first preset alarm form is predefined, may be similar to the log style, and specifically may be defined within the Util class of the alarm. Util is an abbreviation of utily, and means multipurpose, and a tool-like package mainly stores random number generation classes, attribute file reading classes, timer classes, and the like.

And acquiring information required in an alarm template set for the first preset alarm form from the target log, and adding the acquired information to the corresponding position of the alarm template to generate the alarm in the first preset alarm form. Illustratively, the generated alarm in the form of the first preset alarm is as follows:

name of service line: openapi

Service: reflands

Severity grade: severe, need to follow up immediately

Time: 2017-11-0910:42:29

And (4) server IP: 10.69.42.35:8100

RequestId：req-2d0eb7d3-3a26-4405-ab4c-b476a143085e

AccountId：73400984

Region：cn-beijing-6

Abnormal information: 2017-11-0910: 42:29,517ERROR [ RunInstanceEndEventTypeCommand:82] [ http-bio-8100-exec-349] { catRootMessageId ecs-api-ac1f2013-419498-15766, span Id req-2d0eb7d3-3a26-4405-ab4c-b476a143085e001, and traceId req-2d0eb7d3-3a26-4405-ab4c-b476a143085e }: source ": "openapi", "RequestId": "req-2d0eb7d3-3a26-4405-ab4c-b476a143085e", "Action": "re funds", "Descripte": "," AccountId ": "73400984", "Region": "cn-beijing-6", "Parameters": "," ServerIp ": "10.69.42.35:8100", "Time": "2017-11-0910: 42:29", "ErrMsg": "successful boot, failure of deduction, please process as soon as possible".

The severity level in the generated alarm in the first preset alarm form is related to the service level, and the generated alarm in the first preset alarm form has high service level, high severity level, low service level and low severity level. The time is obtained by converting the time stamp in the target log into time, and the exception information includes error stack information in the target log.

S404: and determining a second receiving object of the generated alarm in the first preset alarm form.

The second receiving object may be a receiving object in a preset first preset alarm form, or a receiving object having an association relationship with the target service identifier may be used as the second receiving object according to an association relationship between the service identifier and the receiving object established in advance. The second reception object referred to herein may be the same as or different from the first reception object. For example, the first receiving object may be a mobile phone number of the operation and maintenance person a and a mobile phone number of the operation and maintenance supervisor B, and the second receiving object may be a mobile phone number of the operation and maintenance person a.

S405: and transmitting the generated alarm in the first preset alarm form to a second receiving object.

It should be noted that the principle of S405 is similar to that of S310 described above, and is not described herein again.

In the prior art, there is also a Zabbix-based mail alert technology, which is mainly based on a series of triggers to perform an alert, and the triggers involved in the alert (trigger) generally include the following aspects:

(1) basic state of the server: disk capacity, memory size, cpu (Central Processing Unit) load;

(2) basic service state: the state of web wide web servers (nginx, apache), the state of databases (MySQL, Oracle, nosql, etc.);

(3) the application server state: availability of application servers and load status.

Zabbix, as mentioned above, is an enterprise-level open source solution providing distributed system monitoring and network monitoring functions based on a web interface. The nginx is a high-performance HTTP (HyperText Transfer Protocol) and reverse proxy server, and is also an IMAP (Internet Mail Access Protocol)/POP 3(Post Office Protocol-Version 3)/SMTP server. The MySQL is a relational database management system, and Oracle is a relational database management system of Oracle corporation; nosql is a non-relational database.

The main disadvantage of the email alert technology based on Zabbix is that only performance indexes of the server and internal server indexes such as an application program web container can be monitored, and the internal interface of the web service cannot be monitored and alerted. The embodiment of the invention monitors the internal interface (namely the service) of the web service, and timely sends the alarm in the first preset alarm form when the service processing request is abnormal.

S406: acquiring a target request identifier, wherein the target request identifier is a request identifier corresponding to a currently sent alarm in a first preset alarm form; an alarm corresponds to a request identification.

S407: and recording the association relation aiming at the target request identifier, wherein each association relation comprises the request identifier.

S408: and judging whether the number of the currently recorded incidence relations is larger than a preset alarm number threshold, if so, executing S409, otherwise, ending.

S409: and generating a target alarm in a second preset alarm form based on the number of the incidence relations recorded currently and an alarm template preset for the second preset alarm form, wherein the first preset alarm form is different from the second preset alarm form.

S410: and transmitting the target alarm to a preset first receiving object.

S406 to S410 are the same as S101 to S105 described above, respectively, and are not described herein again.

In the embodiment of the invention, when a service alarm occurs, a first preset alarm form alarm can be sent for the alarm, when the number of the accumulated recorded association relations is larger than a preset alarm number threshold value, the situation represents that a major service abnormality may occur, and for the situation, a second preset form alarm is sent, so that a major service abnormality can be alarmed.

Fig. 5 is a fifth flowchart of an alarm method according to an embodiment of the present invention, where the method includes:

s501: and obtaining a target log, wherein the target log is an error log with a preset pattern, and the target log comprises a target service identifier.

S502: determining an alarm form having a corresponding relation with a target service identifier according to a corresponding relation between a pre-established service identifier and a preset alarm form; wherein, the determined alarm form comprises a first preset alarm form.

S503: and generating the alarm in the first preset alarm form based on the target log and an alarm template preset for the first pre-alarm form.

S504: and determining a second receiving object of the generated alarm in the first preset alarm form.

S505: and transmitting the generated alarm in the first preset alarm form to a second receiving object.

S506: and under the condition that the determined alarm form also comprises a third preset alarm form, generating an alarm of the third preset alarm form based on the target log and an alarm template preset aiming at the third preset alarm form.

The number of types of the alarm forms included in the alarm form determined for one service identifier may be determined according to the service class. For example, if the service level corresponding to the service identifier is an important service, the alarm form determined for the service identifier may be a first preset alarm form and the service level corresponding to the service identifier of a third preset alarm form is a normal service, and the alarm form determined for the service identifier may be the first preset alarm form, where the first preset alarm form may be a mail alarm and the third preset alarm form may be a short message alarm.

The manner of generating the alarm in the third preset alarm form is similar to the manner of generating the alarm in the second preset alarm form, and is not described herein in detail.

It should be noted that the alarm types corresponding to the first preset alarm form and the third preset alarm form are different, and generally, the third preset alarm form is easier to be found by the receiving personnel than the first preset alarm form. Illustratively, the alarm type of the first preset alarm form is a mail alarm, and the alarm type of the third preset alarm form is a short message alarm, and in general, the short message is more easily noticed by receiving personnel than the mail.

S507: a third receiving object of the generated alarm in the form of a third preset alarm is determined.

The determination method of the third received object may be the same as the determination method of the second received object, and is not described herein again. The third receiving object may be the same as the first receiving object or different from the first receiving object, and is specifically determined according to a preset setting. If the receiving object of the alarm preset with the third preset alarm form is the same as the receiving object of the first preset alarm form, the third receiving object is the first receiving object, and if the receiving object of the alarm preset with the third preset alarm form is the same as the receiving object of the first preset alarm form, the third receiving object is different from the second receiving object.

S508: and transmitting the generated alarm in the form of the third preset alarm to a third receiving object.

In the embodiment of the invention, the alarm form of the service is related to the service identifier, and further related to the service level, the alarm in the first preset alarm form is adopted when the service level is low, and the alarm in the first preset alarm form and the alarm in the third preset alarm form are adopted when the service level is high, so that the alarm in two forms is carried out on the important service, operation and maintenance personnel can attach importance to the alarm, the service is maintained in time, and the influence of the fault of the service on the web service is avoided.

S509: acquiring a target request identifier, wherein the target request identifier is a request identifier corresponding to a currently sent alarm in a first preset alarm form; an alarm corresponds to a request identification.

S510: and recording the association relation aiming at the target request identifier, wherein each association relation comprises the request identifier.

S511: and judging whether the number of the currently recorded incidence relations is larger than a preset alarm number threshold, if so, executing S512, otherwise, ending.

S512: and generating a target alarm in a second preset alarm form based on the alarm template corresponding to the second preset alarm form and the number of the currently recorded incidence relations, wherein the first preset alarm form is different from the second preset alarm form.

S513: and transmitting the target alarm to a preset first receiving object.

In the embodiment of the invention, the alarm form is determined according to the service identifier, and for some abnormal services, the alarm in the first preset alarm form and the alarm in the third preset alarm form are performed, so that a receiving person can more timely acquire the abnormal information of the services and further timely process the abnormal services, when the number of the accumulated and recorded association relations is greater than the preset alarm number threshold value, the important abnormal services are possibly generated, and for the condition, the alarm in the second preset form is sent, so that the important abnormal services can be alarmed.

Fig. 6 is a schematic structural diagram of an alarm device according to an embodiment of the present invention, where the alarm device includes:

an obtaining module 601, configured to obtain a target request identifier, where the target request identifier is a request identifier corresponding to a currently sent alarm in a first preset alarm form; an alarm corresponds to a request identification;

a recording module 602, configured to record association relationships for a target request identifier, where each association relationship includes a request identifier;

a first determining module 603, configured to determine whether the number of currently recorded association relationships is greater than a preset alarm number threshold;

a first generating module 604, configured to generate a target alarm in a second preset alarm form based on the number of the currently recorded association relations and an alarm template preset for the second preset alarm form when the determination result of the first determining module 603 is greater than the first threshold, where the first preset alarm form is different from the second preset alarm form;

the first transmitting module 605 is configured to transmit the target alarm to a preset first receiving object.

In the embodiment of the invention, the number of the currently recorded incidence relations is larger than the preset alarm number threshold value, which represents that a major business abnormity may occur, and aiming at the condition, the alarm in the second preset form is sent, so that the major business abnormity can be sensed.

In one embodiment of the present invention, each association further records a storage time for the request identification record in the association;

the apparatus may further comprise:

the first generating module 604 is further configured to generate a target alarm in a second preset alarm form based on the number of the currently recorded association relations and an alarm template preset for the second preset alarm form when the determination result of the second determining module is non-existent; (ii) a Generating a target alarm in a second preset alarm form based on the number of the currently recorded incidence relations and an alarm template preset in the second preset alarm form under the condition that the number of the recorded incidence relations is still larger than an alarm number threshold after the incidence relations with the storage time before the target time are deleted;

In an embodiment of the present invention, each association further records the number of times of alarming for the request identifier record in the association;

the apparatus may further include:

the first generating module 604 is further configured to generate a target alarm in a second preset alarm form based on the number of the currently recorded association relations and an alarm template preset for the second preset alarm form when the determination result of the third determining module is non-existent; generating a target alarm in a second preset alarm form based on the number of the currently recorded association relations and an alarm template preset for the second preset alarm form under the condition that the number of the currently recorded association relations is also larger than an alarm number threshold after deleting the association relations of which the storage time is before the target time or deleting the association relations of which the alarm times are larger than a preset alarm time threshold;

In one embodiment of the present invention, the apparatus may further include:

the first determining module is used for determining an alarm form corresponding to the target service identifier according to the corresponding relation between the pre-established service identifier and the preset alarm form; wherein the determined alarm form comprises a first preset alarm form;

In one embodiment of the present invention, the apparatus may further include:

In one embodiment of the present invention, the obtaining module is specifically configured to:

obtaining a currently generated error log;

and if not, taking the currently obtained error log as a target log.

In one embodiment of the present invention, the obtaining module is further configured to:

In an embodiment of the present invention, the first determining module is specifically configured to:

An embodiment of the present invention further provides an electronic device, as shown in fig. 7, including a processor 701 and a memory 702,

a memory 702 for storing a computer program;

the processor 701 is configured to implement the following steps when executing the program stored in the memory 702:

acquiring a target request identifier, wherein the target request identifier is a request identifier corresponding to a currently sent alarm in a first preset alarm form; an alarm corresponds to a request identification;

recording the incidence relation aiming at the target request identification, wherein each incidence relation comprises the request identification;

if the number of the incidence relations is larger than the preset number, generating a target alarm in a second preset alarm form based on the number of the currently recorded incidence relations and a preset alarm template aiming at the second preset alarm form, wherein the first preset alarm form is different from the second preset alarm form;

and transmitting the target alarm to a preset first receiving object.

The Memory may include a Random Access Memory (RAM) or a Non-Volatile Memory (NVM), such as at least one disk Memory. Optionally, the memory may also be at least one memory device located remotely from the processor.

The Processor may be a general-purpose Processor, including a Central Processing Unit (CPU), a Network Processor (NP), and the like; but also Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete Gate or transistor logic devices, discrete hardware components.

In yet another embodiment of the present invention, a computer-readable storage medium is further provided, in which a computer program is stored, and the computer program is executed by a processor to implement the alarm method in any one of the above embodiments.

In a further embodiment of the present invention, there is also provided a computer program product containing instructions which, when run on a computer, cause the computer to perform the alerting method of any of the above embodiments.

In a further embodiment of the present invention, there is also provided a computer program which, when run on a computer, causes the computer to perform the alert method of any of the above embodiments.

It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.

All the embodiments in the present specification are described in a related manner, and the same and similar parts among the embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the apparatus/electronic device/computer-readable storage medium/computer program product/computer program embodiment, since it is substantially similar to the method embodiment, the description is relatively simple, and it suffices to refer to part of the description of the method embodiment in relation thereto.

The above description is only for the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention shall fall within the protection scope of the present invention.

Claims

1. An alert method, the method comprising:

recording the incidence relation aiming at the target request identifier, wherein each incidence relation comprises a request identifier;

transmitting the target alarm to a preset first receiving object;

each incidence relation also records the storage time of the request identification record in the incidence relation;

under the condition that the number of all the current incidence relations is judged to be larger than a preset alarm number threshold, the method further comprises the following steps:

if the incidence relation of the storage time before the target time does not exist, executing the step of generating the target alarm of a second preset alarm form based on the number of the currently recorded incidence relation and an alarm template preset aiming at the second preset alarm form;

if the incidence relation of the storage time before the target time exists, deleting the incidence relation of the storage time before the target time; executing a step of generating a target alarm in a second preset alarm form based on the number of the currently recorded association relations and an alarm template preset for the second preset alarm form under the condition that the number of the recorded association relations is still greater than the alarm number threshold after the association relations with the storage time before the target time are deleted;

each incidence relation also records the number of times of alarming aiming at the request identification record in the incidence relation;

judging whether an association relationship with the alarm times larger than a preset alarm time threshold exists in association relationships of the storage time in a target time period, wherein the target time period is a time period determined based on the target time and the current time;

if the incidence relation that the alarm frequency is larger than the preset alarm frequency threshold value does not exist, executing the step of generating the target alarm of a second preset alarm form based on the number of the currently recorded incidence relation and an alarm template preset aiming at the second preset alarm form;

if the association relationship that the alarm times are greater than the preset alarm time threshold exists, deleting the association relationship that the alarm times are greater than the preset alarm time threshold; and after deleting the incidence relation of which the alarm frequency is greater than a preset alarm frequency threshold value, under the condition that the number of the recorded incidence relations is still greater than the alarm number threshold value, executing a step of generating a target alarm in a second preset alarm form based on the number of the currently recorded incidence relations and an alarm template preset for the second preset alarm form.

2. The method of claim 1, wherein after the transmitting the target alert to the determined recipient object, the method further comprises:

3. The method according to claim 1 or 2, wherein before the step of obtaining the target request identifier corresponding to the currently sent alarm in the first preset form, the method further comprises:

determining an alarm form having a corresponding relation with the target service identifier according to a corresponding relation between a pre-established service identifier and a preset alarm form; wherein the determined alarm form comprises the first preset alarm form;

generating an alarm in a first preset form based on the target log and an alarm template preset aiming at the first preset alarm form;

transmitting the generated alarm in the form of the first preset alarm to the second receiving object.

4. The method of claim 3, wherein in the case that the determined alert form further comprises a third preset alert form, the method further comprises:

transmitting the generated alarm in the form of the third preset alarm to the third receiving object.

5. The method of claim 3, wherein the step of obtaining the target log comprises:

obtaining a currently generated error log;

and if the current error log is not the preset non-alarm service identifier, taking the currently obtained error log as a target log.

6. The method according to claim 5, wherein in the case that it is determined that the service identifier included in the currently generated log is not a preset non-alarm service identifier, the step of obtaining the target log further comprises:

7. The method according to claim 3, wherein the determining an alarm form having a correspondence with the target service identifier according to a correspondence between a pre-established service identifier and a preset alarm form comprises:

determining a target service level according to a pre-established association relationship between a service identifier and the service level, wherein the target service level is a service level having an association relationship with the target identifier;

8. An alert device, the device comprising:

the system comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is used for acquiring a target request identifier, and the target request identifier is a request identifier corresponding to a currently sent alarm in a first preset alarm form; an alarm corresponds to a request identification;

the recording module is used for recording the association relation aiming at the target request identifier, wherein each association relation comprises the request identifier;

a first generation module, configured to generate a target alarm in a second preset alarm form based on the number of currently recorded association relationships and an alarm template preset for the second preset alarm form when the determination result of the first determination module is greater than or equal to the first determination module, where the first preset alarm form is different from the second preset alarm form;

the first transmission module is used for transmitting the target alarm to a preset first receiving object;

the device further comprises:

the first generating module is further configured to generate a target alarm in a second preset alarm form based on the number of the currently recorded association relations and an alarm template preset for the second preset alarm form when the determination result of the second determining module is non-existent; generating a target alarm in a second preset alarm form based on the number of the currently recorded association relations and an alarm template preset in the second preset alarm form under the condition that the number of the recorded association relations is still greater than the alarm number threshold after the association relations with the storage time before the target time are deleted;

the first deleting module is further used for deleting the association relation of the storage time before the target time under the condition that the judgment result of the second judging module is existence;

the device further comprises:

a third judging module, configured to judge whether an association relationship in which the number of times of alarm is greater than a preset alarm number threshold exists in association relationships of storage time in a target time period, where the target time period is a time period determined based on the target time and the current time;

the first generating module is further configured to generate a target alarm in a second preset alarm form based on the number of the currently recorded association relations and an alarm template preset for the second preset alarm form when the determination result of the third determining module is non-existent; generating a target alarm in a second preset alarm form based on the number of the currently recorded association relations and an alarm template preset for the second preset alarm form under the condition that the number of the currently recorded association relations is larger than the alarm number threshold after deleting the association relations of the storage time before the target time or deleting the association relations of which the alarm times are larger than the preset alarm time threshold;

9. The apparatus of claim 8, further comprising:

10. The apparatus according to any one of claims 8 or 9, further comprising:

the first determining module is used for determining an alarm form corresponding to the target service identifier according to the corresponding relation between the pre-established service identifier and a preset alarm form; wherein the determined alarm form comprises the first preset alarm form;

the second generation module is used for generating the alarm in the first preset form based on the target log and an alarm template preset aiming at the first preset alarm form;

and the second transmission module is used for transmitting the generated alarm in the first preset alarm form to the second receiving object.

11. The apparatus of claim 10, further comprising:

and the third transmitting module is used for transmitting the generated alarm in the third preset alarm form to the third receiving object.

12. The apparatus according to claim 10, wherein the obtaining module is specifically configured to:

obtaining a currently generated error log;

and if not, taking the currently obtained error log as a target log.

13. The apparatus of claim 12, wherein the obtaining module is further configured to:

14. The apparatus of claim 10, wherein the first determining module is specifically configured to:

15. An electronic device comprising a processor and a memory, wherein,

a memory for storing a computer program;

a processor for implementing the method steps of any of claims 1 to 7 when executing a program stored in the memory.

16. A computer-readable storage medium, characterized in that a computer program is stored in the computer-readable storage medium, which computer program, when being executed by a processor, carries out the method steps of any one of claims 1 to 7.