CN109687999A - A kind of association analysis method of alarm failure, device and equipment - Google Patents
A kind of association analysis method of alarm failure, device and equipment Download PDFInfo
- Publication number
- CN109687999A CN109687999A CN201811511502.5A CN201811511502A CN109687999A CN 109687999 A CN109687999 A CN 109687999A CN 201811511502 A CN201811511502 A CN 201811511502A CN 109687999 A CN109687999 A CN 109687999A
- Authority
- CN
- China
- Prior art keywords
- warning information
- condition
- result
- information
- time window
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
- H04L41/065—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis involving logical or physical relationship, e.g. grouping and hierarchies
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Alarm Systems (AREA)
Abstract
The invention discloses a kind of association analysis method of alarm failure, device, equipment and computer readable storage mediums, wherein this method comprises: obtaining the warning information for needing to be associated multiple alarm failures of analysis；Calculate described in every two each warning information in warning information as condition, another warning information as a result when the obtained conditional probability value of every group of condition and result, and determine that the conditional probability value is greater than the condition of probability threshold value and result corresponds to warning information as the warning information with causalnexus；The warning information with causalnexus determined is stored for inquiring.So that staff is by searching for the data saved, you can learn that the causalnexus between different warning information, and then based on this can rapid inference go out the reason of generating alarm failure, can be time saving and energy saving when having achieved the purpose that the analysis of progress alarm failure.
Description
Technical field
The present invention relates to IT operation management technical fields, more specifically to a kind of association analysis side of alarm failure
Method, device, equipment and computer readable storage medium.
Background technique
With the high speed development of IT informationization, the quantity of IT infrastructure constantly expands, and operational indicator is accumulative to be increased, and monitors
Mode also gradually tends to various dimensions, so that operation maintenance personnel is also being constantly increasing the management of basic IT environment, maintenance difficulties.Tool
For body, existing unification monitor supervision platform can all list alarm corresponding information after equipment index alerts, O&M people
The equipment and its index of warning information occurs by the list lookup of existing alarm information for member, and by long-term artificial experience come
Fault condition is searched, it is cumbersome and time consuming；And monitoring is various dimensions, different business has different indexs, all to add
There are a indexs up to ten thousand, this undoubtedly may require that a large amount of workload.
In conclusion realizing that the technical solution of alarm failure analysis there are problems that largely taking time and effort in the prior art.
Summary of the invention
In view of this, the object of the present invention is to provide a kind of association analysis method of alarm failure, device, equipment and calculating
Machine readable storage medium storing program for executing is able to solve existing for the technical solution for realizing alarm failure analysis in the prior art and largely takes time and effort
The problem of.
In order to achieve the above object, the invention provides the following technical scheme:
A kind of association analysis method of alarm failure, comprising:
Obtain the warning information for needing to be associated multiple alarm failures of analysis；
Each warning information is calculated described in every two in warning information as condition, another warning information as a result
When the obtained conditional probability value of every group of condition and result, and determine that the conditional probability value is greater than the condition and result of probability threshold value
Corresponding warning information is the warning information with causalnexus；
The warning information with causalnexus determined is stored for inquiring.
Preferably, before the conditional probability value for calculating every group of condition and result, further includes:
At the beginning of including based on each warning information and the end time, determine each warning information pre-
If the identical continuous multiple time windows of length in occupied time window, determine and simultaneously store what each warning information occupied
Time window number is the support of corresponding warning information with the ratio of time window sum, which is less than support threshold
Warning information is deleted.
Occupied by preferably, determining each warning information in the identical continuous multiple time windows of preset length
Time window, comprising:
For any warning information in each warning information, it is at the beginning of determining any warning information
Time window be the first time window that occupies of any warning information, by the end time and time started of any warning information
The value that is obtained divided by the length of the time window of difference be time window number that any warning information occupies, it is any based on this
First time window that warning information occupies and the time window number occupied determine the last one that any warning information occupies
Time window, determine time window between first time window and the last one time window that any warning information occupies, it is first when
Between window, the last one time window be time window that any warning information occupies.
Preferably, the conditional probability value of every group of condition and result is calculated, comprising:
The conditional probability value of any group of condition and result in every group of condition and result is calculated according to the following formula:
Wherein, P (A | B) indicates that the conditional probability value of condition B and result A, P (AB) indicate what condition B and result A was occupied
The number of time window, P (B) indicate the number for the time window that condition B is occupied.
Preferably, after determining to have the warning information of causalnexus, further includes:
Determine and store the corresponding strength of association grade of conditional probability value of every group of warning information with causalnexus.
Preferably, storing every group has the warning information of causalnexus, corresponds to strength of association grade and wherein each announcement
After the support of alert information, further includes:
The querying condition for receiving extraneous input, determining that the querying condition corresponds to warning information is target alarms information, will
To should be used as when the target alarms information, the support of the target alarms information, the target alarms information are as condition
As a result warning information, the target alarms information as a result when warning information to the condition that should be used as and corresponding each association
Strength grade is exported.
Preferably, corresponding warning information as a result, the target when exporting the target alarms information as condition
Warning information as a result when the warning information for the condition that should be used as and corresponding each strength of association grade are exported, comprising:
It is corresponding when exporting the target alarms information as condition to make according to the sequence of respective conditions probability value from large to small
Warning information and corresponding each pass when for the warning information of result, the target alarms information as a result to the condition that should be used as
Join strength grade.
A kind of association analysis device of alarm failure, comprising:
Module is obtained, is used for: obtaining the warning information for needing to be associated multiple alarm failures of analysis；
Computing module is used for: each warning information is as condition, another announcement in warning information described in calculating every two
The conditional probability value of the every group of condition and result that are obtained when warning information as a result, and determine that the conditional probability value is greater than probability threshold
It is the warning information with causalnexus that the condition and result of value, which correspond to warning information,；
Preserving module is used for: the warning information with causalnexus determined is stored for inquiring.
A kind of association analysis equipment of alarm failure may include:
Memory, for storing computer program；
Processor realizes the association analysis side of the as above any one alarm failure when for executing the computer program
The step of method.
A kind of computer readable storage medium is stored with computer program on the computer readable storage medium, described
The step of as above association analysis method of any one alarm failure is realized when computer program is executed by processor.
The present invention provides a kind of association analysis method of alarm failure, device, equipment and computer readable storage medium,
Wherein this method comprises: obtaining the warning information for needing to be associated multiple alarm failures of analysis；It calculates and is accused described in every two
In alert information each warning information as condition, another warning information as a result when obtained every group of condition and result
Conditional probability value, and determine that the conditional probability value is greater than the condition of probability threshold value and result corresponds to warning information to close with cause and effect
The warning information of connection；The warning information with causalnexus determined is stored for inquiring.Technical side disclosed in the present application
Case calculates any warning information in each warning information after getting the multiple warning information for needing to be associated analysis
The condition of any warning information as a result is general in remaining each warning information as condition, in addition to any warning information
Rate value, so that it is determined that conditional probability value is greater than the condition of probability threshold value and result is the warning information with causalnexus, namely
Determine a warning information cause another warning information occur probability it is larger when determine the two warning information be with because
The associated warning information of fruit so that staff is by searching for the data saved, you can learn that different warning information it
Between causalnexus, and then based on this can rapid inference go out the reason of generating alarm failure, reached and carried out alarm failure
Purpose that can be time saving and energy saving when analysis.
Detailed description of the invention
In order to more clearly explain the embodiment of the invention or the technical proposal in the existing technology, to embodiment or will show below
There is attached drawing needed in technical description to be briefly described, it should be apparent that, the accompanying drawings in the following description is only this
The embodiment of invention for those of ordinary skill in the art without creative efforts, can also basis
The attached drawing of offer obtains other attached drawings.
Fig. 1 is a kind of flow chart of the association analysis method of alarm failure provided in an embodiment of the present invention；
Fig. 2 is a kind of structural schematic diagram of the association analysis device of alarm failure provided in an embodiment of the present invention.
Specific embodiment
Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete
Site preparation description, it is clear that described embodiments are only a part of the embodiments of the present invention, instead of all the embodiments.It is based on
Embodiment in the present invention, it is obtained by those of ordinary skill in the art without making creative efforts every other
Embodiment shall fall within the protection scope of the present invention.
Referring to Fig. 1, it illustrates a kind of processes of the association analysis method of alarm failure provided in an embodiment of the present invention
Scheme, may include:
S11: the warning information for needing to be associated multiple alarm failures of analysis is obtained.
It should be noted that a kind of execution subject of the association analysis method of alarm failure provided in an embodiment of the present invention is
Association analysis device.Wherein, since data volume is huge, the calculating of association analysis can not be spaced it is very short, therefore can with setting
The mode of timed task carrys out the calculating correlation step of start by set date association analysis；Specifically, it can configure according to actual needs
The time interval (such as 10 minutes) of timed task, determine every how long execute once connection analysis calculating correlation step
(acquisition warning information and analysis is associated to the warning information of acquisition that the application includes) this timed task.
Wherein, warning information is identical as the warning information meaning in background technique, is after alarm failure occurs for equipment
Obtained correspondence warning information may include resource identification (including the resource URI, resource name of the resource that alarm failure occurs
Deng), occur alarm failure index index mark (including CPU usage, hard disk occupancy etc.), alarm failure occur open
Begin time and end time.Specifically, warning information can be processed into the information of " resource identification, index mark " format,
Such as " URI1 | server 1 | CPU usage " " URI2 | server 2 | CPU usage ", namely by counting warning information
Data preprocess is at the calculating for realizing association analysis after preset data format to it.
S12: calculate every two warning information in each warning information as condition, another warning information as a result
When the obtained conditional probability value of every group of condition and result, and determine that the conditional probability value is greater than the condition and result of probability threshold value
Corresponding warning information is the warning information with causalnexus.
Wherein, the specific value of probability threshold value can be set according to actual needs, such as can be 70%.It needs to illustrate
, probability of happening of conditional probability self-explanatory characters' part A under the conditions of another event B has occurred and that, conditional probability is expressed as P (A
| B), pronounce " probability of A under conditions of B ".The application is after obtaining multiple warning information, it is assumed that the quantity of warning information is
N, then by this N number of warning information simultaneously be used as condition and as a result, any of each condition condition with it is every in addition to itself
One result separately constitute corresponding one group of condition and as a result, so as to obtain N* (N-1) group condition and as a result, this be will
Each warning information obtains multiple groups condition and knot as condition, another warning information as a result in every two warning information
The process of fruit.Wherein, condition is expressed as event B in above-mentioned condition probability, is as a result expressed as event in above-mentioned condition probability
A, the conditional probability value for calculating one group of condition and result is to calculate what result in this group of condition and result had occurred and that in condition
Under the premise of probability of happening namely this group of condition and result the conditional probability that causes result to occur；Therefore, work as conditional probability value
When greater than probability threshold value, it may be considered that the probability that corresponding condition causes corresponding result to occur is larger, then it is assumed that corresponding
Condition and probability have causalnexus.
S13: the warning information with causalnexus determined is stored for inquiring.
Wherein, the warning information with causalnexus is stored for inquiry can be the alarm letter with causalnexus
Breath is stored into database, in addition, can be and will obtain in step S11 when realizing the preservation with the warning information of causalnexus
The each warning information got is saved, and the warning information setting wherein with causalnexus is marked accordingly；Thus
Staff call database in data when not only it is available arrive each warning information, can also obtain between warning information
Causal correlation, to determine the reason of alarm failure occurs based on this.
Technical solution disclosed in the present application calculates after getting the multiple warning information for needing to be associated analysis
Appoint in remaining each warning information of any warning information as condition, in addition to any warning information in each warning information
The conditional probability value of one warning information as a result, so that it is determined that conditional probability value is greater than the condition of probability threshold value and result is tool
There is the warning information of causalnexus, namely determines true when a warning information causes the probability of another warning information generation larger
The two fixed warning information are the warning information with causalnexus, so that staff is by searching for the number for arriving preservation
According to, you can learn that the causalnexus between different warning information, and then based on this can rapid inference go out to generate alarm failure
Reason, achieved the purpose that carry out alarm failure analysis when can be time saving and energy saving.
In addition, technical solution disclosed in the present application realizes the association analysis between warning information automatically, make O&M trend certainly
Dynamicization, hardware and software platform, intelligence ensure the stabilization and reliability service of basis IT back-up environment, and operation maintenance personnel is helped to improve IT support
The monitoring and O&M ability of environment.
A kind of association analysis method of alarm failure provided in an embodiment of the present invention calculates the condition of every group of condition and result
Before probability value, can also include:
At the beginning of including based on each warning information and the end time, determine each warning information in preset length
Occupied time window in identical continuous multiple time windows, determine and store time window number that each warning information occupies with
The ratio of time window sum is the support of corresponding warning information, and the warning information which is less than support threshold is deleted
It removes.
Commonly used four concepts of association analysis are frequent item set, correlation rule, confidence level and support respectively.The application
In using warning information respective conditions probability as confidence level, using warning information probability of occurrence as support, and frequent item set is
It is not less than the warning information of corresponding support threshold for support, correlation rule is whether there is cause and effect to close between warning information
Connection.Wherein, support threshold can be set according to actual needs, at the beginning of each warning information includes and at the end of
Between be to be divided into all warning information corresponding time multiple at the beginning of corresponding alarm failure occurs and the end time
Length identical continuous period, each period are an event window, and the length of each time window can be according to reality
It is set, such as can be 1 minute；After determining time window, at the beginning of being based on each warning information and terminate
Time can determine the time window occupied by it, and the number of the time window occupied from there through each warning information can determine that
The support of warning information, and then the warning information that support is less than support threshold is deleted.
It should be noted that the warning information that deletion is less than support threshold in the present embodiment is certain accidental in order to exclude
The alarm failure that factor may cause, or can be regarded as some alarm failures generation number it is seldom, the probability very little of generation,
Substantially accidental situation at last, illustrate in this case there may be the problem of, as alarm failure A is only in 10000 datas
It has occurred 2 times, at this time if being not excluded for A, after sliced time window, the time window where A has alarm failure B, that is calculated
Result be exactly that under conditions of A occurs, the probability that B occurs is 100%, and in fact, alarm failure C has occurred 100 times, in C
B has occurred 92 times in the time window of place, and B occurs 100 times altogether, wherein there is A for 2 times, has C 92 times, and remaining 6 AC do not have, and
And AC did not occur simultaneously；At this point, the probability that B occurs under the conditions of C is 92%, 100% occurred less than B under A occurrence condition
Probability, it is evident that be incorrect；So needing to exclude the warning information less than support threshold in the present embodiment.The present invention
A kind of association analysis method for alarm failure that embodiment provides determines that each warning information is identical continuous in preset length
Occupied time window in multiple time windows may include:
For any warning information in each warning information, be at the beginning of determining any warning information when
Between window be the first time window that occupies of any warning information, by the difference of the end time of any warning information and time started
The value that value is obtained divided by the length of time window is the time window number that any warning information occupies, and is based on any warning information
The first time window occupied and the time window number occupied determine the last one time window that any warning information occupies, really
It is the time window between first time window and the last one time window that fixed any warning information occupies, first time window, last
One time window is the time window that any warning information occupies.
It should be noted that there are many modes for the time window that determining each warning information occupies, such as following three kinds of methods:
(1) traverse every warning information, traverse each time window, by warning information at the beginning of and the end time sentence
This warning information break whether in the time window currently traversed, and then acquired results are added in preset list.
(2) traverse every warning information, for any warning information, according to any warning information at the beginning of and tie
The beam time recycles all time windows, is start recording, circulation in a time window at the beginning of any warning information
The end time of any warning information is judged whether in next time window, if not then recording next time
Window, until determining the time window where the end time, the time window where the record end time simultaneously stops circulation time window, from
And it determines time window that each warning information occupies and stores acquired results.
(3) it creates map to be used to receive the warning information in each time window, traverses every warning information, determine every announcement
Locating time window is the first time window that corresponding warning information occupies at the beginning of alert information, and by twice, (alarm is believed
The end time and time started of breath) subtraction calculations are carried out, and the result subtracted each other is obtained divided by the length of each time window
To value be time window number that corresponding warning information is in；It is successively counted backward according to the first time window of every warning information
A corresponding several time windows (including first time window) store warning information in map respectively.
Wherein, first method needs to be traversed for all warning information, will also be all over while traversing every warning information
Go through all time windows, thus the calculation amount of this method be equivalent to it is exponential, when the data volume of warning information increases, operation
Amount then can make system become gruelling；It, still can be by warning information although second method does not traverse all time windows
The shared time all traverses, and stops in the last one time window until the end time, it is very big to also result in calculation amount.The
Three kinds of methods are the method taken in the present embodiment, it is only necessary to determine after going out first time window, are subtracted out by the end time
Divided by the length of each time window after time beginning, time window number shared by warning information is obtained, it is successively past after first time window
It stores afterwards, it is seen that the third method is optimal algorithm, and calculating speed is fast and accurate.
In addition, the present embodiment when the first time for determining that any warning information occupies is long, which can be believed
At the beginning of subtracting first time window at the beginning of breath, and by obtained result divided by the length of each time window, most
Whole acquired results are which time window the first time window of any warning information is in All Time window, thus into
One step reduces calculation amount.
A kind of association analysis method of alarm failure provided in an embodiment of the present invention calculates the condition of every group of condition and result
Probability value may include:
The conditional probability value of any group of condition and result in every group of condition and result is calculated according to the following formula:
Wherein, P (A | B) indicates that the conditional probability value of condition B and result A, P (AB) indicate what condition B and result A was occupied
The number of time window, P (B) indicate the number for the time window that condition B is occupied.
It should be noted that occupied when calculating the conditional probability value of every group of condition and result based on each warning information
Time window realizes that the information (time window occupied) obtained when so as to be calculated based on support is realized, fast and easy.
A kind of association analysis method of alarm failure provided in an embodiment of the present invention, determines the alarm with causalnexus
After information, can also include:
Determine and store the corresponding strength of association grade of conditional probability value of every group of warning information with causalnexus.
It should be noted that the corresponding relationship between conditional probability value and strength of association grade can be preset, thus
As long as determining conditional probability value, that is, it can determine that corresponding strength of association grade, the in general bigger correspondence of conditional probability value
Warning information is bigger a possibility that there are causalnexus, strength of association higher grade, so that staff is in inquiry based on pass
A possibility that connection strength grade can determine that corresponding warning information there are causalnexus size facilitates staff and carries out pair
The analysis work answered.
A kind of association analysis method of alarm failure provided in an embodiment of the present invention stores every group of announcement with causalnexus
Alert information, corresponding strength of association grade and wherein after the support of each warning information can also include:
The querying condition for receiving extraneous input, determining that querying condition corresponds to warning information is target alarms information, by target
Corresponding warning information, mesh as a result when warning information, the support of target alarms information, target alarms information are as condition
The warning information for the condition that should be used as and corresponding each strength of association grade are exported when marking warning information as a result.
Wherein, querying condition can be the keyword that warning information includes, such as resource identification, so that it is determined that going out and inquiry
After the corresponding warning information of condition, by the warning information, the support of the warning information, other corresponding alarms of the warning information
Information (when including the warning information as condition corresponding warning information as a result, the warning information as a result when it is corresponding
Warning information as condition) and the corresponding each strength of association of the warning information exported, to pass through this relevant information
Comprehensive displaying, facilitate staff's directly acquiring and analyzing for information.
In addition it can export the corresponding each conditional probability value of target alarms information, the time window number occupied etc., thus
Further enhance the comprehensive of output information.
A kind of association analysis method of alarm failure provided in an embodiment of the present invention exports target alarms information as condition
When corresponding warning information as a result, target alarms information as a result when to the warning information of the condition that should be used as and corresponding
Each strength of association grade is exported, and may include:
According to the sequence of respective conditions probability value from large to small, to should be used as tying when exporting target alarms information as condition
The warning information of fruit, target alarms information as a result when to the warning information for the condition that should be used as and corresponding each strength of association etc.
Grade.
When being exported to above- mentioned information, according to respective conditions probability value every group of target alarms information of descending output and right
Other warning information are answered, staff is enabled to further intuitively to determine the incidence relation between each warning information.Separately
Outside, different information can also be labeled with different background colors, is also can be improved when worker information obtains
Intuitive, and then information analysis is realized convenient for it.
In addition, in staff based on a kind of association analysis device realization association analysis of alarm failure provided by the invention
When, alarm main menu and after alerting entree single-click association analysis function is clicked in staff, below the interface in list
Show the information of above-mentioned needs output, so can be provided for staff after the external world clicks help button every terms of information or
The detailed description of function.
The embodiment of the invention also provides a kind of association analysis devices of alarm failure, as shown in Fig. 2, may include:
Module 11 is obtained, is used for: obtaining the warning information for needing to be associated multiple alarm failures of analysis；
Computing module 12, is used for: each warning information is as condition, another alarm in calculating every two warning information
Information as a result when the obtained conditional probability value of every group of condition and result, and determine that the conditional probability value is greater than probability threshold value
Condition and result correspond to warning information be the warning information with causalnexus；
Preserving module 13, is used for: the warning information with causalnexus determined is stored for inquiring.
A kind of association analysis device of alarm failure provided in an embodiment of the present invention can also include:
Filtering module is used for: before the conditional probability value for calculating every group of condition and result, including based on each warning information
At the beginning of and the end time, determine that each warning information is occupied in the identical continuous multiple time windows of preset length
Time window, determining and storing time window number that each warning information occupies with the ratio of time window sum is that corresponding alarm is believed
The support of breath deletes the warning information that the support is less than support threshold.
A kind of association analysis device of alarm failure provided in an embodiment of the present invention, filtering module may include:
First determining module, is used for: for any warning information in each warning information, determining any warning information
At the beginning of the time window that is in be first time window that any warning information occupies, by the end of any warning information
The value that the difference of time and time started are obtained divided by the length of time window is the time window number that any warning information occupies,
The first time window occupied based on any warning information and the time window number occupied determine that any warning information occupies
The last one time window, determine the time between first time window and the last one time window that any warning information occupies
Window, first time window, the last one time window are the time window that any warning information occupies.
A kind of association analysis device of alarm failure provided in an embodiment of the present invention, computing module may include:
Computing unit is used for: calculating the condition of any group of condition and result in every group of condition and result according to the following formula
Probability value:
Wherein, P (A | B) indicates that the conditional probability value of condition B and result A, P (AB) indicate what condition B and result A was occupied
The number of time window, P (B) indicate the number for the time window that condition B is occupied.
A kind of association analysis device of alarm failure provided in an embodiment of the present invention can also include:
Second determining module, is used for: determining after having the warning information of causalnexus, determining and storing every group has
The corresponding strength of association grade of the conditional probability value of the warning information of causalnexus.
A kind of association analysis device of alarm failure provided in an embodiment of the present invention can also include:
Output module is used for: storing every group of warning information with causalnexus, corresponding strength of association grade and wherein each
After the support of warning information, the querying condition of extraneous input is received, determines that querying condition corresponds to warning information as target announcement
Alert information corresponds to as a result using target alarms information, the support of target alarms information, target alarms information as when condition
Warning information, target alarms information as a result when warning information to the condition that should be used as and corresponding each strength of association grade
It is exported.
A kind of association analysis device of alarm failure provided in an embodiment of the present invention, output module may include:
Output unit is used for: according to the sequence of respective conditions probability value from large to small, exporting target alarms information as item
When part corresponding warning information as a result, target alarms information as a result when to the warning information and correspondence of the condition that should be used as
Each strength of association grade.
The embodiment of the invention also provides a kind of association analysis equipment of alarm failure, may include:
Memory, for storing computer program；
Processor realizes the step of the as above association analysis method of any one alarm failure when for executing computer program
Suddenly.
The embodiment of the invention also provides a kind of computer readable storage medium, it is stored on computer readable storage medium
The association analysis method of alarm failure any one of as above may be implemented in computer program when computer program is executed by processor
Step.
It should be noted that association analysis device, equipment and the calculating of a kind of alarm failure provided in an embodiment of the present invention
The explanation of relevant portion refers to a kind of association analysis of alarm failure provided in an embodiment of the present invention in machine readable storage medium storing program for executing
The detailed description of corresponding part in method, details are not described herein.In addition in above-mentioned technical proposal provided in an embodiment of the present invention with
The consistent part of technical solution realization principle and unspecified is corresponded in the prior art, in order to avoid excessively repeat.
The foregoing description of the disclosed embodiments can be realized those skilled in the art or using the present invention.To this
A variety of modifications of a little embodiments will be apparent for a person skilled in the art, and the general principles defined herein can
Without departing from the spirit or scope of the present invention, to realize in other embodiments.Therefore, the present invention will not be limited
It is formed on the embodiments shown herein, and is to fit to consistent with the principles and novel features disclosed in this article widest
Range.
Claims (10)
1. a kind of association analysis method of alarm failure characterized by comprising
Obtain the warning information for needing to be associated multiple alarm failures of analysis；
Calculate described in every two in warning information each warning information as condition, another warning information as a result when obtain
The conditional probability value of the every group of condition and result that arrive, and determine that the conditional probability value is greater than the condition of probability threshold value and result corresponds to
Warning information is the warning information with causalnexus；
The warning information with causalnexus determined is stored for inquiring.
2. the method according to claim 1, wherein before the conditional probability value for calculating every group of condition and result,
Further include:
At the beginning of including based on each warning information and the end time, determine each warning information preset
Occupied time window, determines and stores the time that each warning information occupies in the identical continuous multiple time windows of length
Window number is the support of corresponding warning information with the ratio of time window sum, which is less than to the alarm of support threshold
Information deletion.
3. according to the method described in claim 2, it is characterized in that, determining that each warning information is identical in preset length
Continuous multiple time windows in occupied time window, comprising:
For any warning information in each warning information, be at the beginning of determining any warning information when
Between window be the first time window that occupies of any warning information, by the difference of the end time of any warning information and time started
The value that value is obtained divided by the length of the time window is the time window number that any warning information occupies, and is based on any alarm
First time window that information occupies and the time window number occupied determine the last one time that any warning information occupies
Window, determine time window between first time window and the last one time window that any warning information occupies, first time window,
The last one time window is the time window that any warning information occupies.
4. according to the method described in claim 2, it is characterized in that, calculating the conditional probability value of every group of condition and result, comprising:
The conditional probability value of any group of condition and result in every group of condition and result is calculated according to the following formula:
Wherein, P (A | B) indicates that the conditional probability value of condition B and result A, P (AB) indicate the time that condition B and result A is occupied
The number of window, P (B) indicate the number for the time window that condition B is occupied.
5. according to the method described in claim 4, it is characterized in that, determining after there is the warning information of causalnexus, also
Include:
Determine and store the corresponding strength of association grade of conditional probability value of every group of warning information with causalnexus.
6. according to the method described in claim 5, it is characterized in that, storing every group has the warning information of causalnexus, correspondence
After strength of association grade and the wherein support of each warning information, further includes:
The querying condition for receiving extraneous input, determining that the querying condition corresponds to warning information is target alarms information, will be described
It is corresponded to as a result when target alarms information, the support of the target alarms information, the target alarms information are as condition
Warning information, the target alarms information as a result when warning information to the condition that should be used as and corresponding each strength of association
Grade is exported.
7. according to the method described in claim 6, it is characterized in that, corresponding when exporting the target alarms information as condition make
Warning information and corresponding each pass when for the warning information of result, the target alarms information as a result to the condition that should be used as
Connection strength grade is exported, comprising:
According to the sequence of respective conditions probability value from large to small, to should be used as tying when exporting the target alarms information as condition
The warning information of fruit, the target alarms information as a result when it is strong to the warning information of the condition that should be used as and corresponding each association
Spend grade.
8. a kind of association analysis device of alarm failure characterized by comprising
Module is obtained, is used for: obtaining the warning information for needing to be associated multiple alarm failures of analysis；
Computing module is used for: being calculated each warning information in warning information described in every two and is believed as condition, another alarm
The conditional probability value of the every group of condition and result that are obtained when ceasing as a result, and determine that the conditional probability value is greater than probability threshold value
It is the warning information with causalnexus that condition and result, which correspond to warning information,；
Preserving module is used for: the warning information with causalnexus determined is stored for inquiring.
9. a kind of association analysis equipment of alarm failure characterized by comprising
Memory, for storing computer program；
Processor realizes the association of the alarm failure as described in any one of claim 1 to 7 when for executing the computer program
The step of analysis method.
10. a kind of computer readable storage medium, which is characterized in that be stored with computer on the computer readable storage medium
Program realizes the association point of the alarm failure as described in any one of claim 1 to 7 when the computer program is executed by processor
The step of analysis method.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811511502.5A CN109687999A (en) | 2018-12-11 | 2018-12-11 | A kind of association analysis method of alarm failure, device and equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811511502.5A CN109687999A (en) | 2018-12-11 | 2018-12-11 | A kind of association analysis method of alarm failure, device and equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109687999A true CN109687999A (en) | 2019-04-26 |
Family
ID=66186663
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811511502.5A Pending CN109687999A (en) | 2018-12-11 | 2018-12-11 | A kind of association analysis method of alarm failure, device and equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109687999A (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112052151A (en) * | 2020-10-09 | 2020-12-08 | 腾讯科技（深圳）有限公司 | Fault root cause analysis method, device, equipment and storage medium |
| CN113051308A (en) * | 2019-12-27 | 2021-06-29 | 深信服科技股份有限公司 | Alarm information processing method, equipment, storage medium and device |
| CN114760186A (en) * | 2022-03-23 | 2022-07-15 | 深信服科技股份有限公司 | Alarm analysis method and device, electronic equipment and storage medium |
| CN114760186B (en) * | 2022-03-23 | 2024-05-28 | 深信服科技股份有限公司 | Alarm analysis method, alarm analysis device, electronic equipment and storage medium |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101997709A (en) * | 2009-08-10 | 2011-03-30 | 中兴通讯股份有限公司 | Root alarm data analysis method and system |
| CN102487334A (en) * | 2010-12-06 | 2012-06-06 | 中国移动通信集团上海有限公司 | Method and device for determining associated alarm information |
| US9838248B1 (en) * | 2014-12-18 | 2017-12-05 | Juniper Networks, Inc. | Confidence level information for network alarms |
| CN107918629A (en) * | 2016-10-11 | 2018-04-17 | 北京神州泰岳软件股份有限公司 | The correlating method and device of a kind of alarm failure |
| CN108156037A (en) * | 2017-12-29 | 2018-06-12 | 中国移动通信集团江苏有限公司 | Alarm correlation analysis method, device, equipment and medium |
-
2018
- 2018-12-11 CN CN201811511502.5A patent/CN109687999A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101997709A (en) * | 2009-08-10 | 2011-03-30 | 中兴通讯股份有限公司 | Root alarm data analysis method and system |
| CN102487334A (en) * | 2010-12-06 | 2012-06-06 | 中国移动通信集团上海有限公司 | Method and device for determining associated alarm information |
| US9838248B1 (en) * | 2014-12-18 | 2017-12-05 | Juniper Networks, Inc. | Confidence level information for network alarms |
| CN107918629A (en) * | 2016-10-11 | 2018-04-17 | 北京神州泰岳软件股份有限公司 | The correlating method and device of a kind of alarm failure |
| CN108156037A (en) * | 2017-12-29 | 2018-06-12 | 中国移动通信集团江苏有限公司 | Alarm correlation analysis method, device, equipment and medium |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113051308A (en) * | 2019-12-27 | 2021-06-29 | 深信服科技股份有限公司 | Alarm information processing method, equipment, storage medium and device |
| CN112052151A (en) * | 2020-10-09 | 2020-12-08 | 腾讯科技（深圳）有限公司 | Fault root cause analysis method, device, equipment and storage medium |
| CN112052151B (en) * | 2020-10-09 | 2022-02-18 | 腾讯科技（深圳）有限公司 | Fault root cause analysis method, device, equipment and storage medium |
| CN114760186A (en) * | 2022-03-23 | 2022-07-15 | 深信服科技股份有限公司 | Alarm analysis method and device, electronic equipment and storage medium |
| CN114760186B (en) * | 2022-03-23 | 2024-05-28 | 深信服科技股份有限公司 | Alarm analysis method, alarm analysis device, electronic equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111309567B (en) | Data processing method, device, database system, electronic equipment and storage medium | |
| CN104407964B (en) | A kind of centralized monitoring system and method based on data center | |
| CN111158977A (en) | Abnormal event root cause positioning method and device | |
| JP5913145B2 (en) | Log visualization device, method, and program | |
| CN107704387B (en) | Method, device, electronic equipment and computer readable medium for system early warning | |
| CN112070416B (en) | AI-based RPA flow generation method, apparatus, device and medium | |
| CN116049146B (en) | Database fault processing method, device, equipment and storage medium | |
| CN113986595A (en) | Abnormity positioning method and device | |
| CN114327964A (en) | Method, device, equipment and storage medium for processing fault reasons of service system | |
| CN107111609A (en) | Lexical analyzer for neural language performance identifying system | |
| CN111400189A (en) | Code coverage rate monitoring method and device, electronic equipment and storage medium | |
| CN109687999A (en) | A kind of association analysis method of alarm failure, device and equipment | |
| CN116010220A (en) | Alarm diagnosis method, device, equipment and storage medium | |
| CN108809770A (en) | A kind of resource monitoring method and system | |
| CN113157521B (en) | Monitoring method and monitoring system for block chain full life cycle | |
| CN112800061B (en) | Data storage method, device, server and storage medium | |
| CN114443437A (en) | Alarm root cause output method, apparatus, device, medium, and program product | |
| CN115022153B (en) | Fault root cause analysis method, device, equipment and storage medium | |
| CN110971488A (en) | Data processing method, device, server and storage medium | |
| CN113535458B (en) | Abnormal false alarm processing method and device, storage medium and terminal | |
| CN115767601A (en) | 5GC network element automatic nanotube method and device based on multidimensional data | |
| CN115514627A (en) | Fault root cause positioning method and device, electronic equipment and readable storage medium | |
| US11243937B2 (en) | Log analysis apparatus, log analysis method, and log analysis program | |
| CN114697247A (en) | Fault detection method, device, equipment and storage medium of streaming media system | |
| CN110677271B (en) | Big data alarm method, device, equipment and storage medium based on ELK |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20190426 |
|
| RJ01 | Rejection of invention patent application after publication |