CN109308248A - Event relation analyzing method and system - Google Patents
Event relation analyzing method and system Download PDFInfo
- Publication number
- CN109308248A CN109308248A CN201810979044.1A CN201810979044A CN109308248A CN 109308248 A CN109308248 A CN 109308248A CN 201810979044 A CN201810979044 A CN 201810979044A CN 109308248 A CN109308248 A CN 109308248A
- Authority
- CN
- China
- Prior art keywords
- event
- subsystem
- analysis
- suspicion object
- scenarios
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3452—Performance evaluation by statistical analysis
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Probability & Statistics with Applications (AREA)
- Evolutionary Biology (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Hardware Design (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Quality & Reliability (AREA)
- General Physics & Mathematics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Debugging And Monitoring (AREA)
Abstract
This application involves a kind of event relation analyzing method and systems, method therein include: by received event buffer into queue, and it calls event handler to choose event from queue and is pre-processed, generate love scene analysis report, wherein, the event results from the subsystem of information system, the love scene analysis report generates after being analyzed according to the dynamical system topological relation between subsystem the event, and the dynamical system topological relation includes the topological relation in information system between the subsystem of different layers and between the subsystem of same layer；Distribute the love scene analysis report；Assayer's module is called to analyze the love scene analysis report；The love scene analysis report is analyzed using assayer's module, obtains analysis result.The incidence relation between automatic cross-level analysis event may be implemented in the application, quickly, accurately and efficiently find generation event basic reason and its corresponding root subsystem.
Description
Technical field
This application involves data center's operation management technical field more particularly to a kind of event relation analyzing method and it is
System.
Background technique
Operation management is the monitoring in information technology to the operation system run in data center or cloud computing platform
And management, the availability and performance of the subsystem of every aspect in real-time monitoring operation system.Once the subsystem of every aspect
There are the abnormal phenomenon such as operation is slack-off, inaccessible, reports an error, alarm will be issued.Due to Information System Design subsystem very
Complexity, including network, server, container, using etc. many levels, and, multiple calling such as foreground, backstage, third party system
Level.Therefore, the alert event of generation can be extremely complex, and each level has.
In the related technology, operation system is monitored and when O&M, the monitoring to different level is all independent monitoring
System, such as network monitoring supervisory network equipment, database monitoring only supervise database etc..And analyze the side of warning reason
Method is manual analysis, i.e. incidence relation of the operation management personnel after receiving the report for police service between these alert events of manual comparative analysis,
Then the basic reason for generating alarm is found out.But this association analysis method is difficult, it can not be accurate, quickly and efficiently
Solve the problems, such as alarm.
Summary of the invention
To be overcome the problems, such as present in the relevant technologies at least to a certain extent, the application provides a kind of event correlation analysis
Method and system.
According to the embodiment of the present application in a first aspect, providing a kind of event relation analyzing method, comprising:
By received event buffer into queue, and calls event handler to choose event from queue and is pre-processed,
Generate love scene analysis report, wherein the event results from the subsystem of information system, the love scene analysis report
It is generated after being analyzed according to the dynamical system topological relation between subsystem the event, the dynamical system topological relation
Topological relation between subsystem including different layers in information system and between the subsystem of same layer；
Distribute the love scene analysis report；
Assayer's module is called to analyze the love scene analysis report；
The love scene analysis report is analyzed using assayer's module, obtains analysis result.
Optionally, the love scene analysis report includes updated event scenarios or newly-built event scenarios, described
Pretreatment includes:
Subsystem belonging to event is determined, as current suspicion object；
According to the dynamical system topological relation between the subsystem of information system, judges the current suspicion object and have
Event scenarios in suspicion object whether there is dependence；
Suspicion object in the current suspicion object and existing event scenarios is worked as by described in there are when dependence
Preceding suspicion object is added in existing event scenarios, obtains updated event scenarios；
When dependence is not present in suspicion object in the current suspicion object and existing event scenarios, thing is created
Part scene；
The event scenarios include the incidence relation between suspicion object, and the incidence relation is the son according to belonging to event
What the dynamical system topological relation between system and the subsystem determined.
Optionally, subsystems respectively correspond a component, and the dynamical system topological relation includes: the group of same layer
Dynamic relationship of topology between part and the dynamic relationship of topology between the component of different layers, in which:
Dynamic relationship of topology between the component of same layer includes: the dynamic relationship of topology between the component of application layer, and,
Dynamic relationship of topology between the same layer assembly of each architecture layer；
Dynamic relationship of topology between the component of the application layer passes through the tune between various components in analysis application in real time
With data, the automatic calling connection found between component and component is updated according to the dynamic that the calling connection of discovery is constructed；
The respective layer that dynamic relationship of topology between the same layer assembly of the architecture layer is collected into according to monitoring
The information of infrastructure element analyzes the connection and dependence of the physics between each infrastructure element and logic, according to
The connection of the physics and logic and dependence are established；
Relationship between the topology of different layers passes through point to physics and logic dependence between component in different layers
Analysis is dynamically determined.
Optionally, the suspicion object in the judgement current suspicion object and existing event scenarios whether there is according to
The relationship of relying, comprising:
For the suspicion object being located on the same floor in existing event scenarios with the current suspicion object, judge that the two is
No to there is calling connection relationship, if it is present determining the two, there are dependences, and dependence is otherwise not present；
For being located at the suspicion object of different layers in existing event scenarios with the current suspicion object, judge that the two is
It is no there are the connection and dependence of physics and logic, if it is present both determine that there are dependences, otherwise there is no according to
The relationship of relying.
It is optionally, described that the love scene analysis report is analyzed, comprising:
Each node in event scenarios in corresponding love scene analysis report, determine the node attribute and/or
Position determines effect of the node in event scenarios according to the attribute and/or position, wherein each node corresponding one
Subsystem belonging to a event, the effect includes: root node or impacted node；
The corresponding event of root node is determined as root-cause event, the impacted corresponding event of node is determined as by shadow
The event of sound.
Optionally, the event relation analyzing method, further includes:
Store and inquire the analysis result；
The analysis result includes: analysis conclusion and analysis description, and the analysis conclusion includes: root-cause event and impacted
Event.
Optionally, the event includes: the alert event of operational system, alternatively, media event.
Optionally, when the event is the event of multiple users, then separately the event of each user is delayed
It deposits and the processing based on event.
According to the second aspect of the embodiment of the present application, a kind of event correlation analysis system is provided, comprising:
Event manager module is used for by received event buffer into queue, and event handler is called to select from queue
It takes event to be pre-processed, generates love scene analysis report, wherein the event results from the subsystem of information system, institute
It states after love scene analysis report analyzes the event according to the dynamical system topological relation between subsystem and generates, institute
Stating dynamical system topological relation includes opening up between the subsystem of different layers and between the subsystem of same layer in information system
Flutter relationship；
Event administration module, for distributing the love scene analysis report；
Event processing module, for calling assayer's module to analyze the love scene analysis report；
Assayer's module obtains analysis result for analyzing the love scene analysis report.
Optionally, the system, further includes:
Event memory module, for storing the analysis result；
Event query module, for inquiring the analysis result；
The analysis result includes: analysis conclusion and analysis description, and the analysis conclusion includes: root-cause event and impacted
Event.
Optionally, the love scene analysis report includes updated event scenarios or newly-built event scenarios, described
Pretreatment includes:
Subsystem belonging to event is determined, as current suspicion object；
According to the dynamical system topological relation between the subsystem of information system, judges the current suspicion object and have
Event scenarios in suspicion object whether there is dependence；
Suspicion object in the current suspicion object and existing event scenarios is worked as by described in there are when dependence
Preceding suspicion object is added in existing event scenarios, obtains updated event scenarios；
When dependence is not present in suspicion object in the current suspicion object and existing event scenarios, thing is created
Part scene；
The event scenarios include the incidence relation between suspicion object, and the incidence relation is the son according to belonging to event
What the dynamical system topological relation between system and the subsystem determined.
Optionally, subsystems respectively correspond a component, and the dynamical system topological relation includes: the group of same layer
Dynamic relationship of topology between part and the dynamic relationship of topology between the component of different layers, in which:
Dynamic relationship of topology between the component of same layer includes: the dynamic relationship of topology between the component of application layer, and,
Dynamic relationship of topology between the same layer assembly of each architecture layer；
Dynamic relationship of topology between the component of the application layer passes through the tune between various components in analysis application in real time
With data, the automatic calling connection found between component and component is updated according to the dynamic that the calling connection of discovery is constructed；
The respective layer that dynamic relationship of topology between the same layer assembly of the architecture layer is collected into according to monitoring
The information of infrastructure element analyzes the connection and dependence of the physics between each infrastructure element and logic, according to
The connection of the physics and logic and dependence are established；
Relationship between the topology of different layers passes through point to physics and logic dependence between component in different layers
Analysis is dynamically determined.
Optionally, the suspicion object in the judgement current suspicion object and existing event scenarios whether there is according to
The relationship of relying, comprising:
For the suspicion object being located on the same floor in existing event scenarios with the current suspicion object, judge that the two is
No to there is calling connection relationship, if it is present determining the two, there are dependences, and dependence is otherwise not present；
For being located at the suspicion object of different layers in existing event scenarios with the current suspicion object, judge that the two is
It is no there are the connection and dependence of physics and logic, if it is present both determine that there are dependences, otherwise there is no according to
The relationship of relying.
It is optionally, described that the love scene analysis report is analyzed, comprising:
Each node in event scenarios in corresponding love scene analysis report, determine the node attribute and/or
Position determines effect of the node in event scenarios according to the attribute and/or position, wherein each node corresponding one
Subsystem belonging to a event, the effect includes: root node or impacted node；
The corresponding event of root node is determined as root-cause event, the impacted corresponding event of node is determined as by shadow
The event of sound.
Optionally, the event includes: the alert event of operational system, alternatively, media event.
Optionally, when the event is the event of multiple users, then separately the event of each user is delayed
It deposits and the processing based on event.
According to the third aspect of the embodiment of the present application, a kind of non-transitorycomputer readable storage medium is provided, when described
When instruction in storage medium is executed by the processor of controller, so that controller side is able to carry out a kind of event correlation analysis side
Method, which comprises
By received event buffer into queue, and calls event handler to choose event from queue and is pre-processed,
Generate love scene analysis report, wherein the event results from the subsystem of information system, the love scene analysis report
It is generated after being analyzed according to the dynamical system topological relation between subsystem the event, the dynamical system topological relation
Topological relation between subsystem including different layers in information system and between the subsystem of same layer；
Distribute the love scene analysis report；
Assayer's module is called to analyze the love scene analysis report；
The love scene analysis report is analyzed using assayer's module, obtains analysis result.
Optionally, the love scene analysis report includes updated event scenarios or newly-built event scenarios, described
Pretreatment includes:
Subsystem belonging to event is determined, as current suspicion object；
According to the dynamical system topological relation between the subsystem of information system, judges the current suspicion object and have
Event scenarios in suspicion object whether there is dependence；
Suspicion object in the current suspicion object and existing event scenarios is worked as by described in there are when dependence
Preceding suspicion object is added in existing event scenarios, obtains updated event scenarios；
When dependence is not present in suspicion object in the current suspicion object and existing event scenarios, thing is created
Part scene；
The event scenarios include the incidence relation between suspicion object, and the incidence relation is the son according to belonging to event
What the dynamical system topological relation between system and the subsystem determined.
Optionally, subsystems respectively correspond a component, and the dynamical system topological relation includes: the group of same layer
Dynamic relationship of topology between part and the dynamic relationship of topology between the component of different layers, in which:
Dynamic relationship of topology between the component of same layer includes: the dynamic relationship of topology between the component of application layer, and,
Dynamic relationship of topology between the same layer assembly of each architecture layer；
Dynamic relationship of topology between the component of the application layer passes through the tune between various components in analysis application in real time
With data, the automatic calling connection found between component and component is updated according to the dynamic that the calling connection of discovery is constructed；
The respective layer that dynamic relationship of topology between the same layer assembly of the architecture layer is collected into according to monitoring
The information of infrastructure element analyzes the connection and dependence of the physics between each infrastructure element and logic, according to
The connection of the physics and logic and dependence are established；
Relationship between the topology of different layers passes through point to physics and logic dependence between component in different layers
Analysis is dynamically determined.
Optionally, the suspicion object in the judgement current suspicion object and existing event scenarios whether there is according to
The relationship of relying, comprising:
For the suspicion object being located on the same floor in existing event scenarios with the current suspicion object, judge that the two is
No to there is calling connection relationship, if it is present determining the two, there are dependences, and dependence is otherwise not present；
For being located at the suspicion object of different layers in existing event scenarios with the current suspicion object, judge that the two is
It is no there are the connection and dependence of physics and logic, if it is present both determine that there are dependences, otherwise there is no according to
The relationship of relying.
It is optionally, described that the love scene analysis report is analyzed, comprising:
Each node in event scenarios in corresponding love scene analysis report, determine the node attribute and/or
Position determines effect of the node in event scenarios according to the attribute and/or position, wherein each node corresponding one
Subsystem belonging to a event, the effect includes: root node or impacted node；
The corresponding event of root node is determined as root-cause event, the impacted corresponding event of node is determined as by shadow
The event of sound.
Optionally, the event relation analyzing method, further includes:
Store and inquire the analysis result；
The analysis result includes: analysis conclusion and analysis description, and the analysis conclusion includes: root-cause event and impacted
Event.
Optionally, the event includes: the alert event of operational system, alternatively, media event.
Optionally, when the event is the event of multiple users, then separately the event of each user is delayed
It deposits and the processing based on event.
According to the fourth aspect of the embodiment of the present application, a kind of event correlation analysis system is provided, comprising: processor；For
The memory of storage processor executable instruction；Wherein, the processor is configured to:
By received event buffer into queue, and calls event handler to choose event from queue and is pre-processed,
Generate love scene analysis report, wherein the event results from the subsystem of information system, the love scene analysis report
It is generated after being analyzed according to the dynamical system topological relation between subsystem the event, the dynamical system topological relation
Topological relation between subsystem including different layers in information system and between the subsystem of same layer；
Distribute the love scene analysis report；
Assayer's module is called to analyze the love scene analysis report；
The love scene analysis report is analyzed using assayer's module, obtains analysis result.
Optionally, the love scene analysis report includes updated event scenarios or newly-built event scenarios, described
Pretreatment includes:
Subsystem belonging to event is determined, as current suspicion object；
According to the dynamical system topological relation between the subsystem of information system, judges the current suspicion object and have
Event scenarios in suspicion object whether there is dependence；
Suspicion object in the current suspicion object and existing event scenarios is worked as by described in there are when dependence
Preceding suspicion object is added in existing event scenarios, obtains updated event scenarios；
When dependence is not present in suspicion object in the current suspicion object and existing event scenarios, thing is created
Part scene；
The event scenarios include the incidence relation between suspicion object, and the incidence relation is the son according to belonging to event
What the dynamical system topological relation between system and the subsystem determined.
Optionally, subsystems respectively correspond a component, and the dynamical system topological relation includes: the group of same layer
Dynamic relationship of topology between part and the dynamic relationship of topology between the component of different layers, in which:
Dynamic relationship of topology between the component of same layer includes: the dynamic relationship of topology between the component of application layer, and,
Dynamic relationship of topology between the same layer assembly of each architecture layer；
Dynamic relationship of topology between the component of the application layer passes through the tune between various components in analysis application in real time
With data, the automatic calling connection found between component and component is updated according to the dynamic that the calling connection of discovery is constructed；
The respective layer that dynamic relationship of topology between the same layer assembly of the architecture layer is collected into according to monitoring
The information of infrastructure element analyzes the connection and dependence of the physics between each infrastructure element and logic, according to
The connection of the physics and logic and dependence are established；
Relationship between the topology of different layers passes through point to physics and logic dependence between component in different layers
Analysis is dynamically determined.
Optionally, the suspicion object in the judgement current suspicion object and existing event scenarios whether there is according to
The relationship of relying, comprising:
For the suspicion object being located on the same floor in existing event scenarios with the current suspicion object, judge that the two is
No to there is calling connection relationship, if it is present determining the two, there are dependences, and dependence is otherwise not present；
For being located at the suspicion object of different layers in existing event scenarios with the current suspicion object, judge that the two is
It is no there are the connection and dependence of physics and logic, if it is present both determine that there are dependences, otherwise there is no according to
The relationship of relying.
It is optionally, described that the love scene analysis report is analyzed, comprising:
Each node in event scenarios in corresponding love scene analysis report, determine the node attribute and/or
Position determines effect of the node in event scenarios according to the attribute and/or position, wherein each node corresponding one
Subsystem belonging to a event, the effect includes: root node or impacted node；
The corresponding event of root node is determined as root-cause event, the impacted corresponding event of node is determined as by shadow
The event of sound.
Optionally, the processor is also configured to
Store and inquire the analysis result；
The analysis result includes: analysis conclusion and analysis description, and the analysis conclusion includes: root-cause event and impacted
Event.
Optionally, the event includes: the alert event of operational system, alternatively, media event.
Optionally, when the event is the event of multiple users, then separately the event of each user is delayed
It deposits and the processing based on event.
Technical solution provided by the present application can include the following benefits:
By the event buffer received into queue, then event handler pre-processes the event in queue, and
Generate love scene analysis report；Due to dynamical system topological relation include in information system between the subsystem of different layers and
Topological relation between the subsystem of same layer, and event results from the subsystem of information system.So once finding event pair
The subsystem answered, no matter whether the event and existing event betide in the subsystem of the same layer in information system, can be with
The dependence between the event and other existing events is determined according to dynamical system topological relation.Again because love scene is analyzed
Report be generated after the dynamical system topological relation between the subsystem according to information system analyzes event, so,
Assayer's module is called to analyze love scene analysis report, then using assayer's module analysis love scene point
Analysis report, can find out the basic reason for generating the event and corresponding subsystem.This process, which avoids, manually to be analyzed
The dependence between event that every aspect generates in information system, by dynamical system topological relation can quickly, it is accurate,
Efficiently find generation event basic reason and its corresponding root subsystem.
It should be understood that above general description and following detailed description be only it is exemplary and explanatory, not
The application can be limited.
Detailed description of the invention
The drawings herein are incorporated into the specification and forms part of this specification, and shows the implementation for meeting the application
Example, and together with specification it is used to explain the principle of the application.
Fig. 1 is a kind of flow diagram of event relation analyzing method shown according to an exemplary embodiment.
Fig. 2 is the process of pretreated process in a kind of event relation analyzing method shown according to an exemplary embodiment
Schematic diagram.
Fig. 3 is a kind of flow diagram of the event relation analyzing method shown according to another exemplary embodiment.
Fig. 4 is a kind of structural schematic diagram of event correlation analysis system shown according to an exemplary embodiment.
Fig. 5 is a kind of structural schematic diagram of the event correlation analysis system shown according to another exemplary embodiment.
Specific embodiment
Example embodiments are described in detail here, and the example is illustrated in the accompanying drawings.Following description is related to
When attached drawing, unless otherwise indicated, the same numbers in different drawings indicate the same or similar elements.Following exemplary embodiment
Described in embodiment do not represent all embodiments consistent with the application.On the contrary, they be only with it is such as appended
The example of the consistent method and system of some aspects be described in detail in claims, the application.
Fig. 1 is a kind of flow diagram of event relation analyzing method shown according to an exemplary embodiment.
As shown in Figure 1, method provided in this embodiment the following steps are included:
Step S11 by received event buffer into queue, and calls event handler to choose event progress from queue
Pretreatment generates love scene analysis report, wherein the event results from the subsystem of information system, the love scene
Analysis report generates after being analyzed according to the dynamical system topological relation between subsystem the event, the dynamical system
Topological relation includes the topological relation in information system between the subsystem of different layers and between the subsystem of same layer；
Step S12 distributes the love scene analysis report；
Step S13 calls assayer's module to analyze the love scene analysis report；
Step S14 analyzes the love scene analysis report using assayer's module, obtains analysis result.
In step s 11, the executing subject of the step can be task manager, the event that task manager will receive
It is cached in queue, then event handler is called to pre-process the event of queuing, processing sequence is first in first out, i.e., first delays
The event being stored in queue is first handled, after be cached in queue event post-processing.
It is understood that event therein is the alert event generated in information system, there may be in information system for it
The subsystem of every aspect in system, for example, the different levels such as business, application, network, server system, virtual machine, container can
A large amount of alert event is generated, is related between these alert events.For example, the failure of network level will lead to server
It is inaccessible, cause throughput of system and performance to decline, so, the alarm of the alert event and network failure of service feature decline
Be between event it is relevant, i.e., network failure be cause business alarm basic reason.In the report that different level generates
These incidence relations are found out in alert event, is the key point that O&M department improves efficiency, can determine which alert event is that have
What meaning merited attention, which alert event importance height needs priority processing.
In this step, dynamical system topological relation includes in information system between the subsystem of different layers and same layer
Topological relation between subsystem, i.e., the logic dependencies between each subsystem.And the system topological relationship be not it is fixed,
But what dynamic updated, i.e., changed in real time according to the change of the logic dependencies between level subsystem each in information system
Become.
Further, in this step, the love scene analysis report includes updated event scenarios or newly-built thing
Part scene, event scenarios include subsystem described in the affiliated subsystem of newly generated event and existing event and patrolling between them
Collect dependence.
In step s 12, executing subject can be event administration module (for example, the processor for being provided with corresponding program),
Love scene analysis report is mainly distributed to each event processing module.
In step s 13, executing subject can be event processing module, receive event administration module point in previous step
After the love scene analysis report of hair, assayer's module is called to analyze love scene analysis report.
In step S14, executing subject is assayer's module.
Correspondingly, referring to fig. 2, carrying out pretreated process to event may comprise steps of:
Step S21 determines subsystem belonging to event, as current suspicion object；
Step S22 judges the current suspicion pair according to the dynamical system topological relation between the subsystem of information system
As whether there is dependence with the suspicion object in existing event scenarios；
Step S23, suspicion object in the current suspicion object and existing event scenarios there are when dependence,
The current suspicion object is added in existing event scenarios, updated event scenarios are obtained；
Dependence is not present in step S24, the suspicion object in the current suspicion object and existing event scenarios
When, create event scenarios；
Wherein, the event scenarios include the incidence relation between suspicion object, and the incidence relation is according to event institute
What the dynamical system topological relation between the subsystem of category and the subsystem determined.
In the step s 21, which height that the subsystem belonging to determining, i.e. determination are which level in information system
The alert event that system generates, using the subsystem as current suspicion object.
In step S22, due to dynamical system topological relation include in information system between the subsystem of different layers and
Topological relation between the subsystem of same layer；Therefore, as long as subsystem described in event has been determined, i.e. suspicion object can
Judge the suspicion object in the suspicion object and existing event scenarios with the presence or absence of dependence.
In step S23, suspicion object in current suspicion object and existing event scenarios there are when dependence,
This event be not it is isolated, it, there may be being associated with, just adds current suspicion object with the event in existing event scenarios
It is added in existing event scenarios, update event scene.Wherein, which is associated with existing for the event in existing event scenarios
In two kinds of situation, a kind of situation is that the corresponding suspicion object of this event (i.e. subsystem described in event) is already present on this to relationship
In a event scenarios, new event, which is that original is problematic, to be occurred repeatedly.Another situation is the corresponding suspicion object of new events
Not in event scenarios, but there is dependence with the suspicion object in event scenarios, then the corresponding suspicion object of this event
It is a new component part in the event scenarios, it will be added in this event scenarios.
In step s 24, there is no rely on for the suspicion object in the current suspicion object and existing event scenarios
When relationship, illustrate the corresponding new event scenarios of this event.
Particularly, the dynamical system topological relation in this implementation include in information system between the subsystem of different layers and
Topological relation between the subsystem of same layer, and the system topological relationship is that dynamic updates, i.e., in real time according to information system
In logic dependencies between each level subsystem change and change.Therefore, according to the son of every aspect in information system
Dynamic relationship of topology between system automatically determines the subsystem of generation event, analyze between the event and existing event whether
There are logic dependencies, the root subsystem for generating the basic reason of the time and going wrong quickly is determined, and by shadow
Loud subsystem.Again because love scene analysis report according to the dynamical system topological relation between subsystem to the event into
It is generated after row analysis, so, operation maintenance personnel does not have in the magnanimity alert event in face of isolating one by one, but obtaining one has item
The event analysis of reason is reported.The love scene analysis report includes: the description to the event of generation；The root for causing the event to occur
This reason event；The affiliated subsystem of the event and basic reason event；Time that the event and basic reason event occur and
Number；Affected children system；Which event is that these affected children systems generate.In this way, quick convenient for operation maintenance personnel, quasi-
Really, the system failure is efficiently solved.
In the present embodiment, by the event buffer received into queue, then event handler to the event in queue into
Row pretreatment, and generate love scene analysis report；Since dynamical system topological relation includes the son of different layers in information system
Topological relation between system and between the subsystem of same layer, and event results from the subsystem of information system.So one
Denier finds the corresponding subsystem of event, and no matter whether the event and existing event betide the subsystem of the same layer in information system
In system, the dependence between the event and other existing events can be determined according to dynamical system topological relation.And because
Love scene analysis report is after the dynamical system topological relation between the subsystem according to information system analyzes event
It generates, so, call assayer's module to analyze love scene analysis report, then using assayer's module point
Love scene analysis report is analysed, the basic reason for generating the event and corresponding subsystem can be found out.This process avoids
The dependence between the event that every aspect generates in information system is manually analyzed, it can by dynamical system topological relation
With quickly, accurately and efficiently find generation event basic reason and its corresponding root subsystem.
Based on a upper embodiment, some of which content is further described as follows.
Further, subsystems respectively correspond a component, and the dynamical system topological relation includes: same layer
Dynamic relationship of topology between component and the dynamic relationship of topology between the component of different layers, wherein
Dynamic relationship of topology between the component of same layer includes: the dynamic relationship of topology between the component of application layer, and,
Dynamic relationship of topology between the same layer assembly of each architecture layer；
Dynamic relationship of topology between the component of the application layer passes through the tune between various components in analysis application in real time
With data, the automatic calling connection found between component and component is updated according to the dynamic that the calling connection of discovery is constructed；
The respective layer that dynamic relationship of topology between the same layer assembly of the architecture layer is collected into according to monitoring
The information of infrastructure element analyzes the connection and dependence of the physics between each infrastructure element and logic, according to
The connection of the physics and logic and dependence are established；
Relationship between the topology of different layers passes through point to physics and logic dependence between component in different layers
Analysis is dynamically determined.
Specifically, the dynamical system topological relation of cross-layer describe IT environment various components (application, server, container,
Network etc.) and component between dependence.In topological model, component is referred to as Vertex (node), there is corresponding letter
Breath description, such as layer (domain) information belonging to it, the information (such as name, type etc.) of own.Pass between component
System is referred to as connection (Edge), the logic dependence between proxy component, its description includes the starting point component of connection relationship,
Terminal component, connects the attribute of itself, and (such as the calling of two application components belongs to the relationship between connection and connection
Two subsegments in one big distributed calling).
In addition, the dynamical system topological relation model of cross-layer is broadly divided into application layer topological model and architecture Top Modules
Type.One topological analysis module is specially provided in the system of the offer of the application, application layer topological relation model can be analyzed in real time
With architecture etale topology relationship type, while the association between each layer model is analyzed.
Application layer topological relation describes the call relation in application layer between modules and method, can by this relationship
With determining module and method availability and performance dependence.It is by analyzing in application each group in real time using etale topology
Calling data (by application monitoring module real-time collecting and uploading in monitoring data library) between part, it is automatic to find component and group
Calling connection between part, to construct the application call relation topological model that a dynamic updates.Such as client's tune
The business applied with a web, its calling first reach front end web server, and web server recalls intermediate Service Gateway
The business service of server, this service recall the data services such as database and other web service of rear end.So answer
Each section of the monitoring record called with etale topology analysis according to this, analyzes front end web server and middleware Service Gateway
The topology component such as server and the database of rear end, and topological connection relation is established between them.And with using frame
The change of structure, such as front end web server can be increased and decreased according to amount of access dynamic, and application layer topological analysis module can be automatic
It was found that these newly-increased or reduction web servers, update applied topology model, keep between model and practical application framework
Dynamic conformance.
Architecture topology is subdivided into topology server, and container topology, network topology, database topology etc., they are retouched
What is stated is the connection and dependence between infrastructure element, by these relationships, can determine component in performance and can be used
Dependence in property problem.The server that architecture etale topology analysis module is collected into according to monitoring, container, network are set
Standby, information (such as IP address, host name run relationship, connection relationship) of database etc. is analyzed between each infrastructure element
Physics and logic connection and dependence, the architecture topological model of different levels is established according to this relationship.
Relationship between the topology of different layers is by the physics and logic dependence between component in different layers
Analysis is dynamically determined.
It is relied on since dynamical system topological relation describes the logic between the topological relation and layer and layer of different levels
Relationship, when we are when doing event association analysis, so that it may according to topological model, find out between the affiliated component of event (node)
Dependence (edge) determines the dependence between event, i.e. which event is root thing according to the dependence of component
Part, which event are impacted dependent events.So that it is determined that the root of problem.
Further, the judgement current suspicion object whether there is with the suspicion object in existing event scenarios
Dependence, comprising:
For the suspicion object being located on the same floor in existing event scenarios with the current suspicion object, judge that the two is
No to there is calling connection relationship, if it is present determining the two, there are dependences, and dependence is otherwise not present；
For being located at the suspicion object of different layers in existing event scenarios with the current suspicion object, judge that the two is
It is no there are the connection and dependence of physics and logic, if it is present both determine that there are dependences, otherwise there is no according to
The relationship of relying.
For example, a suspicion object is application layer web component, a suspicion object is the server group of architecture layer
Part, if the operation host of web component is exactly this server component, there are the logic of cross-layer companies between two suspicion objects
Connect relationship.
It is further, described that the love scene analysis report is analyzed, comprising:
Each node in event scenarios in corresponding love scene analysis report, determine the node attribute and/or
Position determines effect of the node in event scenarios according to the attribute and/or position, wherein each node corresponding one
Subsystem belonging to a event, the effect includes: root node or impacted node；
The corresponding event of root node is determined as root-cause event, the impacted corresponding event of node is determined as by shadow
The event of sound.
For example, suspicion object (the affiliated subsystem of event) is in the node of topological rear end, then the thing that the subsystem occurs
Part just belongs to root-cause event, if suspicion object is in the node of topological front end, then corresponding event is exactly affected node.
Further, referring to Fig. 3, the method can also include the following steps:
Step S15 stores and inquires the analysis result；
The analysis result includes: analysis conclusion and analysis description, and the analysis conclusion includes: root-cause event and impacted
Event.
Wherein, analysis result is alternatively referred to as folder object, that is, includes the Final Report of analysis conclusion and analysis description；
Analysis description has two classes, process that one kind, which is assayer's module, analyzes love scene analysis report and detailed
Thin description；Another kind of is the description of raw alarm event and clue；For example, the affiliated subsystem of event, causes the event to occur
The time and number that basic reason event, the affiliated subsystem of basic reason event, the event and basic reason event occur；By
Influence subsystem；Which event be these affected children systems generate etc..
Further, the event includes: the alert event of operational system, alternatively, media event.
Further, when the event is the event of multiple users, then separately the event of each user is carried out
Caching and the processing based on event.
For example, distinguishing and being isolated the data of different user, the alert event of different user, event scenarios, the objects such as folder
It is to be stored separately in different data structures, and analytic process and various analysis objects can switch tenant, to different
The data of tenant do independent analysis.
Further, the realization framework and process of event correlation analysis, has used for reference the tissue and process that 110 handle a case,
In the process flow of case involving public security, platform 110 of receiving a crime report, police chief, policeman, the dominant roles such as assayer.
It receives a crime report platform 110, receives case alarm, the alarm of record case involving public security and clue of handling a case, wait in line to handle.It determines
Alarm corresponding suspect, and the very strong group alarm of relevance (such as is related to phase by the relevance between analysis alarm and clue
Same suspect) sort out together, a new case (putting on record) is established, or be incorporated to an already existing case and (and go here and there
Case).
Police chief sends policeman and settles a case, and coordinates and supervise the treatment process of each case.
Assayer is to handle a case to provide the support of technology analysis, such as forensic analysis, DNA analysis, portrait comparative analysis etc.,
Provide the chain of evidence of determining criminal responsibility.
Policeman specifically handles a case, finally solves a case in the analysis result and chain of evidence of assayer, determines that crime is disliked
Doubt people and criminal responsibility.It is final that case folder is submitted to describe case overall process, including warning message of putting on record, determining suspicion of crime
People and responsibility, and corresponding evidence chain information etc..
Technical solution provided by the present application uses for reference above-mentioned process, also has corresponding object, referring to Fig. 3, the execution of step S11
Main body is task manager, similar to above-mentioned platform 110 of receiving a crime report；The executing subject of step S12 is event administration module, is similar to
Police chief；The executing subject of step S13 is event processing module, is similar to policeman；The executing subject of step S14 is assayer's mould
Block is similar to assayer.
This design logic is clear, treatment effeciency is high, processing capacity has the advantages that scalability:
It can handle the alarm of big flow, such as increase policeman and the increased alarm amount of assayer's reply.
Facilitate and increase new analysis processing logic, such as increases new assayer's algorithm, or combination is different
Expert algorithm, so that it may handle new alarm, or realize the analytic process that new O&M requires.
Fig. 4 is a kind of structural schematic diagram of event correlation analysis system shown according to an exemplary embodiment.
As shown in figure 4, system provided in this embodiment includes:
Event manager module 41 is used for by received event buffer into queue, and calls event handler from queue
Selection event is pre-processed, and love scene analysis report is generated, wherein and the event results from the subsystem of information system,
The love scene analysis report generates after being analyzed according to the dynamical system topological relation between subsystem the event,
The dynamical system topological relation includes in information system between the subsystem of different layers and between the subsystem of same layer
Topological relation；
Event administration module 42, for distributing the love scene analysis report；
Event processing module 43, for calling assayer's module to analyze the love scene analysis report；
Assayer's module 44 obtains analysis result for analyzing the love scene analysis report.
Further, system provided in this embodiment further include:
Event memory module 45, for storing the analysis result；
Event query module 46, for inquiring the analysis result；
The analysis result includes: analysis conclusion and analysis description, and the analysis conclusion includes: root-cause event and impacted
Event.
Further, the love scene analysis report includes updated event scenarios or newly-built event scenarios, institute
Event manager module is stated to be specifically used for:
Subsystem belonging to event is determined, as current suspicion object；
According to the dynamical system topological relation between the subsystem of information system, judges the current suspicion object and have
Event scenarios in suspicion object whether there is dependence；
Suspicion object in the current suspicion object and existing event scenarios is worked as by described in there are when dependence
Preceding suspicion object is added in existing event scenarios, obtains updated event scenarios；
When dependence is not present in suspicion object in the current suspicion object and existing event scenarios, thing is created
Part scene；
The event scenarios include the incidence relation between suspicion object, and the incidence relation is the son according to belonging to event
What the dynamical system topological relation between system and the subsystem determined.
Further, subsystems respectively correspond a component, and the dynamical system topological relation includes: same layer
Dynamic relationship of topology between component and the dynamic relationship of topology between the component of different layers, wherein
Dynamic relationship of topology between the component of same layer includes: the dynamic relationship of topology between the component of application layer, and,
Dynamic relationship of topology between the same layer assembly of each architecture layer；
Dynamic relationship of topology between the component of the application layer passes through the tune between various components in analysis application in real time
With data, the automatic calling connection found between component and component is updated according to the dynamic that the calling connection of discovery is constructed；
The respective layer that dynamic relationship of topology between the same layer assembly of the architecture layer is collected into according to monitoring
The information of infrastructure element analyzes the connection and dependence of the physics between each infrastructure element and logic, according to
The connection of the physics and logic and dependence are established；
Relationship between the topology of different layers passes through point to physics and logic dependence between component in different layers
Analysis is dynamically determined.
Further, the judgement current suspicion object whether there is with the suspicion object in existing event scenarios
Dependence, comprising:
For the suspicion object being located on the same floor in existing event scenarios with the current suspicion object, judge that the two is
No to there is calling connection relationship, if it is present determining the two, there are dependences, and dependence is otherwise not present；
For being located at the suspicion object of different layers in existing event scenarios with the current suspicion object, judge that the two is
It is no there are the connection and dependence of physics and logic, if it is present both determine that there are dependences, otherwise there is no according to
The relationship of relying.
It is further, described that the love scene analysis report is analyzed, comprising:
Each node in event scenarios in corresponding love scene analysis report, determine the node attribute and/or
Position determines effect of the node in event scenarios according to the attribute and/or position, wherein each node corresponding one
Subsystem belonging to a event, the effect includes: root node or impacted node；
The corresponding event of root node is determined as root-cause event, the impacted corresponding event of node is determined as by shadow
The event of sound.
Further, the present embodiment further include:
Store and inquire the analysis result；
The analysis result includes: analysis conclusion and analysis description, and the analysis conclusion includes: root-cause event and impacted
Event.
Further, the event includes: the alert event of operational system, alternatively, media event.
Further, when the event is the event of multiple users, then separately the event of each user is carried out
Caching and the processing based on event.
The specific implementation of the present embodiment may refer to the above-mentioned related description in relation in this method embodiment, herein not
It repeats again.
Fig. 5 is a kind of structural schematic diagram of the event correlation analysis system shown according to another exemplary embodiment.
As shown in figure 5, system provided in this embodiment includes:
Processor 51；Memory 52 for storage processor executable instruction；Wherein, the processor is configured to:
By received event buffer into queue, and calls event handler to choose event from queue and is pre-processed,
Generate love scene analysis report, wherein the event results from the subsystem of information system, the love scene analysis report
It is generated after being analyzed according to the dynamical system topological relation between subsystem the event, the dynamical system topological relation
Topological relation between subsystem including different layers in information system and between the subsystem of same layer；
Distribute the love scene analysis report；
Assayer's module is called to analyze the love scene analysis report；
The love scene analysis report is analyzed using assayer's module, obtains analysis result.
Further, the love scene analysis report includes updated event scenarios or newly-built event scenarios, institute
Stating pretreatment includes:
Subsystem belonging to event is determined, as current suspicion object；
According to the dynamical system topological relation between the subsystem of information system, judges the current suspicion object and have
Event scenarios in suspicion object whether there is dependence；
Suspicion object in the current suspicion object and existing event scenarios is worked as by described in there are when dependence
Preceding suspicion object is added in existing event scenarios, obtains updated event scenarios；
When dependence is not present in suspicion object in the current suspicion object and existing event scenarios, thing is created
Part scene；
The event scenarios include the incidence relation between suspicion object, and the incidence relation is the son according to belonging to event
What the dynamical system topological relation between system and the subsystem determined.
Further, subsystems respectively correspond a component, and the dynamical system topological relation includes: same layer
Dynamic relationship of topology between component and the dynamic relationship of topology between the component of different layers, in which:
Dynamic relationship of topology between the component of same layer includes: the dynamic relationship of topology between the component of application layer, and,
Dynamic relationship of topology between the same layer assembly of each architecture layer；
Dynamic relationship of topology between the component of the application layer passes through the tune between various components in analysis application in real time
With data, the automatic calling connection found between component and component is updated according to the dynamic that the calling connection of discovery is constructed；
The respective layer that dynamic relationship of topology between the same layer assembly of the architecture layer is collected into according to monitoring
The information of infrastructure element analyzes the connection and dependence of the physics between each infrastructure element and logic, according to
The connection of the physics and logic and dependence are established；
Relationship between the topology of different layers passes through point to physics and logic dependence between component in different layers
Analysis is dynamically determined.
Further, the judgement current suspicion object whether there is with the suspicion object in existing event scenarios
Dependence, comprising:
For the suspicion object being located on the same floor in existing event scenarios with the current suspicion object, judge that the two is
No to there is calling connection relationship, if it is present determining the two, there are dependences, and dependence is otherwise not present；
For being located at the suspicion object of different layers in existing event scenarios with the current suspicion object, judge that the two is
It is no there are the connection and dependence of physics and logic, if it is present both determine that there are dependences, otherwise there is no according to
The relationship of relying.
It is further, described that the love scene analysis report is analyzed, comprising:
Each node in event scenarios in corresponding love scene analysis report, determine the node attribute and/or
Position determines effect of the node in event scenarios according to the attribute and/or position, wherein each node corresponding one
Subsystem belonging to a event, the effect includes: root node or impacted node；
The corresponding event of root node is determined as root-cause event, the impacted corresponding event of node is determined as by shadow
The event of sound.
Further, the processor is also configured to
Store and inquire the analysis result；
The analysis result includes: analysis conclusion and analysis description, and the analysis conclusion includes: root-cause event and impacted
Event.
Further, the event includes: the alert event of operational system, alternatively, media event.
Further, when the event is the event of multiple users, then separately the event of each user is carried out
Caching and the processing based on event.
It should be noted that wherein modules have executed the concrete mode of operation about the device in above-described embodiment
It is described in detail in the embodiment of the method, no detailed explanation will be given here.
It is understood that same or similar part can mutually refer in the various embodiments described above, in some embodiments
Unspecified content may refer to the same or similar content in other embodiments.
It should be noted that term " first ", " second " etc. are used for description purposes only in the description of the present application, without
It can be interpreted as indication or suggestion relative importance.In addition, in the description of the present application, unless otherwise indicated, the meaning of " multiple "
Refer at least two.
Any process described otherwise above or method description are construed as in flow chart or herein, and expression includes
It is one or more for realizing specific logical function or process the step of executable instruction code module, segment or portion
Point, and the range of the preferred embodiment of the application includes other realization, wherein can not press shown or discussed suitable
Sequence, including according to related function by it is basic simultaneously in the way of or in the opposite order, to execute function, this should be by the application
Embodiment person of ordinary skill in the field understood.
It should be appreciated that each section of the application can be realized with hardware, software, firmware or their combination.Above-mentioned
In embodiment, software that multiple steps or method can be executed in memory and by suitable instruction execution system with storage
Or firmware is realized.It, and in another embodiment, can be under well known in the art for example, if realized with hardware
Any one of column technology or their combination are realized: having a logic gates for realizing logic function to data-signal
Discrete logic, with suitable combinational logic gate circuit specific integrated circuit, programmable gate array (PGA), scene
Programmable gate array (FPGA) etc..
Those skilled in the art are understood that realize all or part of step that above-described embodiment method carries
It suddenly is that relevant hardware can be instructed to complete by program, the program can store in a kind of computer-readable storage medium
In matter, which when being executed, includes the steps that one or a combination set of embodiment of the method.
It, can also be in addition, can integrate in a processing module in each functional unit in each embodiment of the application
It is that each unit physically exists alone, can also be integrated in two or more units in a module.Above-mentioned integrated mould
Block both can take the form of hardware realization, can also be realized in the form of software function module.The integrated module is such as
Fruit is realized and when sold or used as an independent product in the form of software function module, also can store in a computer
In read/write memory medium.
Storage medium mentioned above can be read-only memory, disk or CD etc..
In the description of this specification, reference term " one embodiment ", " some embodiments ", " example ", " specifically show
The description of example " or " some examples " etc. means specific features, structure, material or spy described in conjunction with this embodiment or example
Point is contained at least one embodiment or example of the application.In the present specification, schematic expression of the above terms are not
Centainly refer to identical embodiment or example.Moreover, particular features, structures, materials, or characteristics described can be any
One or more embodiment or examples in can be combined in any suitable manner.
Although embodiments herein has been shown and described above, it is to be understood that above-described embodiment is example
Property, it should not be understood as the limitation to the application, those skilled in the art within the scope of application can be to above-mentioned
Embodiment is changed, modifies, replacement and variant.
Claims (10)
1. a kind of event relation analyzing method characterized by comprising
It by received event buffer into queue, and calls event handler to choose event from queue and is pre-processed, generate
Love scene analysis report, wherein the event results from the subsystem of information system, the love scene analysis report according to
Dynamical system topological relation between subsystem generates after analyzing the event, and the dynamical system topological relation includes
Topological relation in information system between the subsystem of different layers and between the subsystem of same layer；
Distribute the love scene analysis report；
Assayer's module is called to analyze the love scene analysis report；
The love scene analysis report is analyzed using assayer's module, obtains analysis result.
2. the method according to claim 1, wherein the love scene analysis report includes updated event
Scene or newly-built event scenarios, the pretreatment include:
Subsystem belonging to event is determined, as current suspicion object；
According to the dynamical system topological relation between the subsystem of information system, the current suspicion object and existing thing are judged
Suspicion object in part scene whether there is dependence；
Suspicion object in the current suspicion object and existing event scenarios described will work as previous ill will there are when dependence
Doubtful object is added in existing event scenarios, obtains updated event scenarios；
When dependence is not present in suspicion object in the current suspicion object and existing event scenarios, algebra of events is created
Scape；
The event scenarios include the incidence relation between suspicion object, and the incidence relation is the subsystem according to belonging to event
And the dynamical system topological relation determination between the subsystem.
3. according to the method described in claim 2, it is characterized in that, subsystems respectively correspond a component, the dynamic
System topological relationship includes: that the dynamic topology between the component of the dynamic relationship of topology and different layers between the component of same layer closes
System, wherein
Dynamic relationship of topology between the component of same layer includes: the dynamic relationship of topology between the component of application layer, and, each base
Dynamic relationship of topology between the same layer assembly of plinth framework layer；
Dynamic relationship of topology between the component of the application layer passes through the calling number between various components in analysis application in real time
According to the automatic calling connection found between component and component is updated according to the dynamic that the calling connection of discovery is constructed；
The basis for the respective layer that dynamic relationship of topology between the same layer assembly of the architecture layer is collected into according to monitoring
The information of infrastructure component analyzes the connection and dependence of the physics between each infrastructure element and logic, according to described
The connection of physics and logic and dependence are established；
Relationship between the topology of different layers is dynamic by the analysis to physics and logic dependence between component in different layers
State determines.
4. according to the method described in claim 3, it is characterized in that, the judgement current suspicion object and existing event
Suspicion object in scene whether there is dependence, comprising:
For the suspicion object being located on the same floor in existing event scenarios with the current suspicion object, judge whether the two deposits
Connection relationship is being called, there are dependences if it is present determining the two, and dependence is otherwise not present；
For being located at the suspicion object of different layers in existing event scenarios with the current suspicion object, judge whether the two deposits
In the connection and dependence of physics and logic, if it is present determining the two, there are dependences, and otherwise there is no rely on to close
System.
5. the method according to claim 1, wherein described analyze the love scene analysis report,
Include:
Each node in event scenarios in corresponding love scene analysis report, determines attribute and/or the position of the node,
Effect of the node in event scenarios is determined according to the attribute and/or position, wherein described in each node is one corresponding
Subsystem belonging to event, the effect includes: root node or impacted node；
The corresponding event of root node is determined as root-cause event, the impacted corresponding event of node is determined as impacted thing
Part.
6. the method according to claim 1, wherein further include:
Store and inquire the analysis result；
The analysis result includes: analysis conclusion and analysis description, and the analysis conclusion includes: root-cause event and impacted thing
Part.
7. the method according to claim 1, wherein the event includes: the alert event of operational system, or
Person, media event.
8. method according to claim 1-7, which is characterized in that in the event that the event is multiple users
When, then separately the event of each user is cached and the processing based on event.
9. a kind of event correlation analysis system characterized by comprising
Event manager module is used for by received event buffer into queue, and event handler is called to choose thing from queue
Part is pre-processed, and generates love scene analysis report, wherein the event results from the subsystem of information system, the thing
The report of part field assay generates after being analyzed according to the dynamical system topological relation between subsystem the event, described dynamic
State system topological relationship includes that the topology in information system between the subsystem of different layers and between the subsystem of same layer is closed
System；
Event administration module, for distributing the love scene analysis report；
Event processing module, for calling assayer's module to analyze the love scene analysis report；
Assayer's module obtains analysis result for analyzing the love scene analysis report.
10. system according to claim 9, which is characterized in that further include:
Event memory module, for storing the analysis result；
Event query module, for inquiring the analysis result；
The analysis result includes: analysis conclusion and analysis description, and the analysis conclusion includes: root-cause event and impacted thing
Part.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810979044.1A CN109308248A (en) | 2018-08-27 | 2018-08-27 | Event relation analyzing method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810979044.1A CN109308248A (en) | 2018-08-27 | 2018-08-27 | Event relation analyzing method and system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109308248A true CN109308248A (en) | 2019-02-05 |
Family
ID=65223975
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810979044.1A Pending CN109308248A (en) | 2018-08-27 | 2018-08-27 | Event relation analyzing method and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109308248A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111782884A (en) * | 2020-06-10 | 2020-10-16 | 北京金和网络股份有限公司 | Event information management method, system and computer readable storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1529455A (en) * | 2003-09-29 | 2004-09-15 | 港湾网络有限公司 | Network failure real-time relativity analysing method and system |
| CN101022366A (en) * | 2007-03-21 | 2007-08-22 | Ut斯达康通讯有限公司 | Trouble correlation analytic system and method |
| CN103001811A (en) * | 2012-12-31 | 2013-03-27 | 北京启明星辰信息技术股份有限公司 | Method and device for fault locating |
-
2018
- 2018-08-27 CN CN201810979044.1A patent/CN109308248A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1529455A (en) * | 2003-09-29 | 2004-09-15 | 港湾网络有限公司 | Network failure real-time relativity analysing method and system |
| CN101022366A (en) * | 2007-03-21 | 2007-08-22 | Ut斯达康通讯有限公司 | Trouble correlation analytic system and method |
| CN103001811A (en) * | 2012-12-31 | 2013-03-27 | 北京启明星辰信息技术股份有限公司 | Method and device for fault locating |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111782884A (en) * | 2020-06-10 | 2020-10-16 | 北京金和网络股份有限公司 | Event information management method, system and computer readable storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US20190018667A1 (en) | Systems and Methods of Constructing a Network Topology | |
| US10999407B1 (en) | Service group interaction management | |
| US10498857B2 (en) | System interaction monitoring and component scaling | |
| Yang et al. | A time efficient approach for detecting errors in big sensor data on cloud | |
| US9413597B2 (en) | Method and system for providing aggregated network alarms | |
| US20220078188A1 (en) | Change Monitoring and Detection for a Cloud Computing Environment | |
| CN111861140B (en) | Service processing method and device, storage medium and electronic device | |
| US20190004837A1 (en) | Optimizing allocation of virtual machines in cloud computing environment | |
| US20220286373A1 (en) | Scalable real time metrics management | |
| EP2137944A1 (en) | On-demand propagation of routing information in distributed computing system | |
| JP2021530067A (en) | Data Center Hardware Instance Network Training | |
| US20210021487A1 (en) | Virtual network function bus-based auto-registration | |
| WO2017080161A1 (en) | Alarm information processing method and device in cloud computing | |
| CN113448812A (en) | Monitoring alarm method and device under micro-service scene | |
| US11714396B2 (en) | Hybrid internet of things evaluation framework | |
| CN103561018A (en) | Intrusion detection real-time analysis system for big data application platform | |
| US20230229788A1 (en) | Agent-based vulnerability management | |
| US10911329B2 (en) | Path and cadence optimization for efficient data collection from devices | |
| US11171844B2 (en) | Scalable hierarchical data automation in a network | |
| US9471618B2 (en) | Data environment change notification | |
| CN109308248A (en) | Event relation analyzing method and system | |
| CN104937613A (en) | Heuristics to quantify data quality | |
| Jo et al. | Implementation of cloud monitoring system based on open source monitoring solution | |
| CN103414717A (en) | Simulation monitoring method and system in regard to C / S structure service system | |
| US20220360487A1 (en) | Negative caching for event notifications |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20190205 |