CN110457185A - A kind of abnormal alarm method, apparatus and electronic equipment - Google Patents
A kind of abnormal alarm method, apparatus and electronic equipment Download PDFInfo
- Publication number
- CN110457185A CN110457185A CN201910676208.8A CN201910676208A CN110457185A CN 110457185 A CN110457185 A CN 110457185A CN 201910676208 A CN201910676208 A CN 201910676208A CN 110457185 A CN110457185 A CN 110457185A
- Authority
- CN
- China
- Prior art keywords
- exception information
- history
- exception
- information
- informations
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 64
- 238000000034 method Methods 0.000 title claims abstract description 49
- 238000004422 calculation algorithm Methods 0.000 claims abstract description 25
- 238000005065 mining Methods 0.000 claims abstract description 21
- 238000004891 communication Methods 0.000 claims description 19
- 238000004590 computer program Methods 0.000 claims description 13
- 230000008569 process Effects 0.000 claims description 11
- 238000012545 processing Methods 0.000 claims description 5
- 238000012423 maintenance Methods 0.000 abstract description 7
- 238000003860 storage Methods 0.000 description 11
- 238000010586 diagram Methods 0.000 description 8
- 238000012544 monitoring process Methods 0.000 description 6
- 230000000694 effects Effects 0.000 description 5
- 230000001960 triggered effect Effects 0.000 description 4
- 238000004364 calculation method Methods 0.000 description 2
- 238000004519 manufacturing process Methods 0.000 description 2
- 230000002093 peripheral effect Effects 0.000 description 2
- 239000007787 solid Substances 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 1
- 238000007418 data mining Methods 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 230000002950 deficient Effects 0.000 description 1
- 238000000151 deposition Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000000802 evaporation-induced self-assembly Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000011835 investigation Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 238000002360 preparation method Methods 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 238000011144 upstream manufacturing Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/32—Monitoring with visual or acoustical indication of the functioning of the machine
- G06F11/324—Display of status information
- G06F11/327—Alarm or error message display
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Alarm Systems (AREA)
Abstract
The embodiment of the invention provides a kind of abnormal alarm method, apparatus and electronic equipments.The multiple exception informations for having been generated and not alarmed, the multiple exception information are generated to be monitored to monitored equipment；For the multiple exception information, according to the Strong association rule established previously according to data correlation mining algorithm, determine strongly connected at least two exception information in the multiple exception information, include in the Strong association rule: there are all exception information combinations of strong incidence relation in all issuable exception informations；By strongly connected at least two exception information, a warning message is merged into；For the warning message, alarm.Using the embodiment of the present invention, strongly connected multiple exception informations are merged into a warning message, reduce redundant warning information, operation maintenance personnel efficiency is promoted, helps quickly to stop loss.
Description
Technical field
The present invention relates to monitoring of tools technical fields, more particularly to a kind of abnormal alarm method, apparatus and electronic equipment.
Background technique
At present by the monitoring system of open source, for example, open-falcon, can collect every cache server (cache
Machine) operating status various information, including cpu load, disk read-write state, network parameter, kernel parameter, process resource consumption
Deng, and based on the rule that these information are arranged, each single item information is monitored, when a certain information meets alarm rule,
Then trigger alarm.
Inventor has found that at least there are the following problems for the prior art in the implementation of the present invention:
Monitoring system in the prior art is monitored for each single item information, can needle when generating multinomial information exception
Alarm is triggered respectively to multiple exception informations.However, the same failure may trigger the multiple Information abnormities of upstream and downstream, that is,
It says, the same failure can cause monitoring system to trigger multiple alarms, this will lead to warning message redundancy, the deficient validity of alarming.
Further, more and more aol servers are disposed at present, and the project of monitoring system monitoring is also more and more, the prior art
Type of alarm bring redundant warning information can more influence alarm validity, influence operation maintenance personnel investigation failure effect
Rate.
Summary of the invention
A kind of method for being designed to provide abnormal alarm of the embodiment of the present invention, with realize reduce redundant warning information,
Promote the purpose of alarm efficiency.Specific technical solution is as follows:
To reach said effect, the embodiment of the invention provides a kind of abnormal alarm methods, comprising:
The multiple exception informations for having been generated and not alarmed, the multiple exception information are to supervise to monitored equipment
Caused by survey；
For the multiple exception information, according to the Strong association rule established previously according to data correlation mining algorithm, really
Determine strongly connected at least two exception information in the multiple exception information, include in the Strong association rule: all possible productions
There are all exception information combinations of strong incidence relation in raw exception information；
By strongly connected at least two exception information, a warning message is merged into；
For the warning message, alarm.
Further, the multiple exception informations for having been generated and not alarmed, comprising:
Obtain the old abnormal letter that the current exception information of generation is monitored to monitored equipment and has generated and has not alarmed
Breath；
It is described by strongly connected at least two exception information, merge into a warning message, comprising:
In the multiple exception information, when there is the first exception information that arrived the abnormal tolerance limit moment, judgement
With the presence or absence of with the strongly connected exception information of the first exception information；The abnormal tolerance limit moment is to produce from exception information
Start at the time of raw, at the time of by default abnormal tolerance duration；
If it exists, by first exception information and with the strongly connected exception information of the first exception information, merge into
One warning message；
If it does not exist with the strongly connected exception information of the first exception information, then first exception information is determined as
One independent warning message；
For the independent warning message, alarm.
Further, the multiple exception informations for having been generated and not alarmed, comprising:
When reaching according to the alarm moment of preset alarm cycle set, generation in a nearest alarm cycle is obtained
Multiple exception informations.
Further, the establishment process of the Strong association rule, comprising:
It collects in default historical time section, generated multiple history is monitored to the monitored equipment and are believed extremely
The generation moment of breath and each history exception information；
According to the generation moment of each history exception information, the multiple history exception information is arranged to time shaft
On；
According to the preset duration section that length is fixed, to arrangement to the multiple history exception information on the time shaft
It is divided, the multiple history exception informations being divided into the same preset duration section is determined as a thing
Business；
Using data correlation mining algorithm, the number in the same affairs is appeared according to each history exception information, is obtained
All history exception information combinations in the multiple history exception information there are strong incidence relation are taken, as strong association rule
Then.
Further, the establishment process of the Strong association rule, comprising:
It collects in default historical time section, generated multiple history is monitored to the monitored equipment and are believed extremely
The generation moment of breath and each history exception information；
According to the generation moment of each history exception information, the multiple history exception information is arranged to time shaft
On；
According to the preset duration section that length is fixed, to arrangement to the multiple history exception information on the time shaft
It is divided, the multiple history exception informations being divided into the same preset duration section is determined as a thing
Business；
Using data correlation mining algorithm, the number in the same affairs is appeared according to each history exception information, is obtained
Take all history exception information combinations in the multiple history exception information there are strong incidence relation；
By in all history exception informations combinations there are strong incidence relation, between every two history exception information
There is the history exception information combination of strong incidence relation, is determined as Strong association rule.
The embodiment of the invention also provides a kind of anomaly alarming devices, comprising:
Exception information obtains module, multiple exception informations for having been generated and not alarmed, the multiple abnormal letter
Breath is generated to be monitored to monitored equipment；
Strong association determining module, for being directed to the multiple exception information, according to previously according to data correlation mining algorithm
The Strong association rule of foundation determines strongly connected at least two exception information in the multiple exception information, the strong association rule
Include in then: there are all exception information combinations of strong incidence relation in all issuable exception informations；
Merging module, for merging into a warning message for strongly connected at least two exception information；
Alarm module is alarmed for being directed to the warning message.
Further, the exception information obtains module, is monitored generation to monitored equipment specifically for obtaining
Current exception information and the old exception information for having generated and not alarmed；
The merging module, is specifically used for:
In the multiple exception information, when there is the first exception information that arrived the abnormal tolerance limit moment, judgement
With the presence or absence of with the strongly connected exception information of the first exception information；The abnormal tolerance limit moment is to produce from exception information
Start at the time of raw, at the time of by default abnormal tolerance duration；
If it exists, by first exception information and with the strongly connected exception information of the first exception information, merge into
One warning message；
If it does not exist with the strongly connected exception information of the first exception information, then first exception information is determined as
One independent warning message；
For the independent warning message, alarm.
Further, the exception information obtains module, specifically for the alarm moment according to preset alarm cycle set
When arrival, the multiple exception informations generated in a nearest alarm cycle are obtained.
Further, described device, further includes:
First history exception information collection module, the first history exception information arrangement module, the first affairs determining module and
First Strong association rule determining module；
The first history exception information collection module sets described be monitored for collecting in default historical time section
The standby generation moment for being monitored generated multiple history exception informations and each history exception information；
The first history exception information arranges module, for the generation moment according to each history exception information,
The multiple history exception information is arranged to time shaft；
The first affairs determining module, for the preset duration section fixed according to length, to arrangement to the time
The multiple history exception information on axis is divided, multiple described in the same preset duration section by being divided into
History exception information is determined as an affairs；
The first Strong association rule determining module is abnormal according to each history for using data correlation mining algorithm
Information appears in the number in the same affairs, obtains in the multiple history exception information that there are all of strong incidence relation
History exception information combination, as Strong association rule.
Further, described device, further includes:
It is second history exception information collection module, the second history exception information arrangement module, the second affairs determining module, strong
It is associated with the combination of history exception information and obtains module and the second Strong association rule determining module；
The second history exception information collection module sets described be monitored for collecting in default historical time section
The standby generation moment for being monitored generated multiple history exception informations and each history exception information；
The second history exception information arranges module, for the generation moment according to each history exception information,
The multiple history exception information is arranged to time shaft；
The second affairs determining module, for the preset duration section fixed according to length, to arrangement to the time
The multiple history exception information on axis is divided, multiple described in the same preset duration section by being divided into
History exception information is determined as an affairs；
The strong association history exception information combination obtains module, for using data correlation mining algorithm, according to each
History exception information appears in the number in the same affairs, obtains in the multiple history exception information that there are strong incidence relations
All history exception informations combinations；
The second Strong association rule determining module, for believing all history exceptions there are strong incidence relation
In breath combination, there is the history exception information combination of strong incidence relation between every two history exception information, be determined as closing by force
Connection rule.
The embodiment of the present invention also provides a kind of electronic equipment, including processor, communication interface, memory and communication bus,
Wherein, processor, communication interface, memory complete mutual communication by communication bus；
Memory, for storing computer program；
Processor, when for executing the program stored on memory, the step of realizing any of the above-described abnormal alarm method.
The embodiment of the invention also provides a kind of computer readable storage medium, the computer readable storage medium memory
Computer program is contained, the computer program realizes any of the above-described abnormal alarm method when being executed by processor the step of.
The embodiment of the invention also provides a kind of computer program products comprising instruction, when it runs on computers
When, so that computer executes any of the above-described abnormal alarm method.
The invention has the advantages that:
As seen from the above technical solutions, a kind of abnormal alarm method provided in an embodiment of the present invention, generated and
The multiple exception informations that do not alarm, the multiple exception information are generated to be monitored to monitored equipment；For described
Multiple exception informations determine the multiple abnormal letter according to the Strong association rule established previously according to data correlation mining algorithm
Strongly connected at least two exception information in breath includes: depositing in all issuable exception informations in the Strong association rule
In all exception information combinations of strong incidence relation；By strongly connected at least two exception information, a report is merged into
Alert information；For the warning message, alarm.In this way, using abnormal alarm method provided by the invention, no longer with single
Exception information triggering alarm, and associated multiple exception informations are merged into a warning message, redundant warning information is reduced,
Operation maintenance personnel efficiency is promoted, helps quickly to stop loss.
Certainly, implement any of the products of the present invention or method it is not absolutely required at the same reach all the above excellent
Point.
Detailed description of the invention
In order to more clearly explain the embodiment of the invention or the technical proposal in the existing technology, to embodiment or will show below
There is attached drawing needed in technical description to be briefly described.
Fig. 1 is a kind of flow diagram of abnormal alarm method provided in an embodiment of the present invention；
Fig. 2 is the flow diagram of another abnormal alarm method provided in an embodiment of the present invention；
Fig. 3 is the flow diagram of another abnormal alarm method provided in an embodiment of the present invention；
Fig. 4 is the flow diagram that a kind of Strong association rule provided in an embodiment of the present invention is established；
Fig. 5 is a kind of structural schematic diagram of anomaly alarming device provided in an embodiment of the present invention；
Fig. 6 is the structural schematic diagram of a kind of electronic equipment provided in an embodiment of the present invention.
Specific embodiment
Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete
Site preparation description.
Referring to Fig. 1, Fig. 1 is a kind of flow diagram of abnormal alarm method provided in an embodiment of the present invention, including as follows
Step:
Step 101: the multiple exception informations for having been generated and not alarmed.
Wherein, multiple exception informations are generated to be monitored to monitored equipment.
Further, the mode for obtaining multiple exception informations can have following two:
A kind of mode is: acquisition is monitored the current exception information of generation to monitored equipment and has generated and do not alarmed
Old exception information；
Another way is: when reaching according to the alarm moment of preset alarm cycle set, obtaining a nearest report
The multiple exception informations generated in the alert period.
Step 102: being directed to multiple exception informations, advised according to the strong association established previously according to data correlation mining algorithm
Then, strongly connected at least two exception information in multiple exception informations is determined.
Wherein, include in Strong association rule: there are all of strong incidence relation in all issuable exception informations
Exception information combination.
For ease of understanding, Strong association rule is explained by following example:
Such as: all issuable exception informations have totally 5 kinds of A, B, C, D and E, wherein are excavated and calculated according to data correlation
Method obtains: A is associated with by force with B, C；A is associated with by force with E；B is associated with by force with C, E, then includes 3 exception information groups in Strong association rule
It closes: { ABC }, { AE } and { BCE }.
Step 103: by strongly connected at least two exception information, merging into a warning message.
Step 104: being directed to warning message, alarm.
Using above-mentioned abnormal alarm method provided in an embodiment of the present invention, no longer for each exception information monitored
Triggering alarm, but according to Strong association rule trained in advance, strongly connected at least two exception information is merged into one
Warning message, alarms for this warning message, reduces redundant warning information in this way, improves operation maintenance personnel effect
Rate helps quickly to stop loss.
The embodiment of the invention also provides another abnormal alarm methods to include the following steps: referring to fig. 2
Step 201: obtaining and the current exception information of generation is monitored to monitored equipment and has generated and has not alarmed
Old exception information.
Step 202: above-mentioned multiple exception informations are directed to, according to the strong association established previously according to data correlation mining algorithm
Rule determines strongly connected at least two exception information in above-mentioned multiple exception informations.
Step 203, in multiple exception informations, when there is the first exception information that arrived the abnormal tolerance limit moment,
It judges whether there is and the strongly connected exception information of the first exception information；If so, executing step 204；If it is not, executing step 205.
Wherein, the abnormal tolerance limit moment is from the time of exception information generates, when by default abnormal tolerance
At the time of long；
Step 204, by the first exception information and with the strongly connected exception information of the first exception information, merge into an alarm
Information.Later, step 206 is executed.
Step 205, the first exception information is determined as an independent warning message.Later, step 206 is executed.
Step 206, it for warning message, alarms.
For above-mentioned abnormal alarm method shown in Fig. 2, citing is described in detail below.
For example, being directed to known issuable all exception information A, B, C, D, E, the Strong association rule pre-established are as follows:
The respective abnormal tolerance duration of each exception information, example can be respectively set for A, B, C, D, E in { ABE }, { ACD }, { CE }
Such as, can according to the exception level of exception information, by the abnormal tolerance duration of A, B, C, D, E be respectively set to 1 minute, 2 minutes,
3 minutes, 4 minutes, 5 minutes, it is abnormal to tolerate the timing since when exception information generates of limit moment；
When exception information A is generated, start the abnormal tolerance duration for calculating A, that is, starts to calculate 1 minute duration；
When A has generated 30 seconds, exception information B is generated, and starts the abnormal tolerance duration for calculating B at this time, that is, start
Calculate 2 minutes durations；
According to the Strong association rule pre-established, determine that A, B are strongly connected two exception informations；
When A has generated 40 seconds, B has been generated 10 seconds at this time, and exception information E is generated, and starts the abnormal tolerance for calculating E at this time
Duration, that is, start to calculate 5 minutes durations；
According to the Strong association rule pre-established, determine that A, B, E are strongly connected three exception informations；
When A has generated 50 seconds, B has been generated 20 seconds at this time, and E has been generated 10 seconds, and exception information C is generated, and starts to count at this time
The abnormal tolerance duration of C is calculated, that is, starts to calculate 3 minutes durations；
According to the Strong association rule pre-established, A, C be also it is strongly connected, can be according to strongly connected exception information quantity
It is selected, for example, selecting the more modes of strongly connected exception information, A, B, E is determined as strongly connected three abnormal letters
Breath；
When A has generated 1 minute, that is, when abnormal tolerance limit moment of A arrived, A, B, E are merged into one
Warning message, and it is directed to the warning message, it alarms.
C has been generated 10 seconds at this time, is not reached 3 minutes, that is to say, that and the abnormal tolerance limit moment of C does not reach, if
Remaining 2 points in 50 seconds, have and generate with the strongly connected exception information F of C, then reach at the abnormal tolerance limit moment of C or F
When, C and F are merged, if in 50 seconds, do not generated with the strongly connected exception information of C, then in the exception appearance of C at remaining 2 points
When bearing the arrival of limit moment, by C separately as an independent warning message, and it is directed to the warning message, alarmed.
In the embodiment depicted in figure 2, it is no longer triggered and is alarmed with single exception information, and by associated multiple exception informations
A warning message is merged into, redundant warning information is reduced, operation maintenance personnel efficiency is promoted, helps quickly to stop loss.Meanwhile it introducing
" abnormal tolerance limit moment ", only when the exception that there is the arrival abnormal tolerance limit moment in strongly connected multiple exception informations
When information, just above-mentioned multiple exception informations are merged, and alarms, can be further reduced the number of alarm.
The embodiment of the invention also provides another abnormal alarm methods to include the following steps: referring to Fig. 3
Step 301: when being reached according to the alarm moment of preset alarm cycle set, obtaining in a nearest alarm cycle and produce
Raw multiple exception informations.
Step 302: being directed to multiple exception informations, advised according to the strong association established previously according to data correlation mining algorithm
Then, strongly connected at least two exception information in multiple exception informations is determined.
Step 303: by strongly connected at least two exception information, merging into a warning message.
Step 304: being directed to warning message, alarm.
For above-mentioned abnormal alarm method shown in Fig. 3, citing is described in detail below.
For example, have five kinds of A, B, C, D, E for known issuable all exception informations, the strong association rule pre-established
Then are as follows: an alarm cycle can be set in { ABE }, { ACD }, { CE }, when reaching at the alarm moment of alarm cycle, carries out one
Secondary alarm, for example, the alarm cycle of setting 2 minutes, that is to say, that monitored equipment was monitored in every 2 minutes generated different
Normal information is once alarmed；
In an alarm cycle, monitored equipment is monitored when producing tetra- exception informations of A, B, C, D, when
When the alarm moment of the alarm cycle reaches, for example, according to the Strong association rule pre-established, can be determined when reaching 2 minutes
Out wherein A, C, D be it is strongly connected, A, B be also it is strongly connected, can be selected at this time according to strongly connected information content, example
Such as, the more modes of strongly connected information content are selected, using A, C, D as strongly connected one group of exception information, A, C, D are merged
For a warning message, and it is directed to the warning message, alarmed；
Flexible setting can be carried out for B, for example, can individually be alarmed at the alarm moment B, it can also be by B
It is put into next alarm cycle, is merged according to the exception information generated in Strong association rule, with next alarm cycle.
In the embodiment shown in fig. 3, it is no longer triggered and is alarmed with single exception information, and by associated multiple exception informations
A warning message is merged into, redundant warning information is reduced, operation maintenance personnel efficiency is promoted, helps quickly to stop loss.Simultaneously as
The same failure, which may trigger, there are multiple exception informations in some period, be single with a preset alarm period therefore
Position, to what is generated in the period, and strongly connected multiple exception informations are merged and are alarmed, and the accurate of alarm can be improved
Property.
Referring to fig. 4, following steps can be used, the foundation of Strong association rule is carried out:
Step 401: collecting in default historical time section, it is abnormal to be monitored generated multiple history to monitored equipment
The generation moment of information and each history exception information.
Specifically, history exception information can be the exception information generated in the past period, for example, it may be previous
It is monitored generated exception information to designated equipment.
Step 402: according to the generation moment of each history exception information, multiple history exception informations being arranged to time shaft
On.
Step 403: according to the preset duration section that length is fixed, to arrangement to multiple history exception informations on time shaft
It is divided, the multiple history exception informations being divided into the same preset duration section is determined as an affairs.
Specifically, the length in the preset duration section can be with flexible setting, for example, length is 1 minute.
Step 404: using data correlation mining algorithm, appeared in the same affairs according to each history exception information
Number obtains all history exception information combinations in multiple history exception informations there are strong incidence relation, as strong association
Rule.
Specifically, data mining algorithm can use Apriori algorithm or FP-Growth algorithm.
For the establishment process of above-mentioned Strong association rule shown in Fig. 4, citing is described in detail below.
For example, collect in the past one day to designated equipment be monitored caused by multiple history exception informations, for example, have A,
B, five exception informations of C, D, E, and collect each history exception information generate at the time of, it is to be understood that each exception
Information may all occur the past one day multiple moment, for example, A is in 00:00:01,00:01:31,00:20:22,00:
58:10,01:41:14 etc. multiple moment all occurred, and B is in 00:00:00,00:01:55,00:20:59,00:59:02,01:
40:32 etc. multiple moment all occurred；
At the time of generation according to past one day A, B, C, D, E, A, B, C, D, E are arranged to time shaft, for example, A is arranged
It is engraved when arranging multiple to 00:00:01,00:01:31,00:20:22,00:58:10,01:41:14 of time shaft etc., B is arranged
It is engraved when arranging multiple to 00:00:00,00:01:55,00:20:59,00:59:02,01:40:32 of time shaft etc.；
According to the preset duration section that length is fixed, for example, according to 1 minute duration, to arrangement on time shaft A, B,
C, D, E are divided, and the multiple history exception informations being divided into same 1 minute are determined as an affairs, for example, from
00:00:00 starts to divide, and in the 00:00:00-00:00:59 period, A, B occurs, then will be in 00:00:00-00:00:59
A, B that period occurs are determined as the 1st affairs, similarly, by the history occurred in the 00:01:00-00:01:59 period exception
Information is determined as the 2nd affairs, and so on, the history exception information that the 23:59:00-23:59:59 period is occurred determines
For the 1440th affairs, it is to be understood that may include one or more history exception information, some things in the affairs having
It may be not comprising any one history exception information in business；
Can be based on Apriori algorithm, the number in the same affairs is appeared according to A, B, C, D, E, obtain A, B, C,
D, the Strong association rule between E；
For example, the number that A, B, C, D, E are occurred in whole affairs, is defined as support；
By the way that support threshold T is arrangeds, obtain support and be greater than support threshold TsException information, pass through iterative calculation
Multiple frequent item sets are obtained, maximum frequent itemsets are finally obtained, wherein maximum frequent itemsets refer to most comprising exception information
Frequent item set；
Obtain the frequent item set comprising 2 or more exception informations；
For each frequent item set S, its proper subclass P is generated；
Calculate the difference set Q, Q=S-P of proper subclass P；
The history exception information calculated in P is both present in the times N in the same affairsP；
The history exception information calculated in P and Q is both present in the times N in the same affairsPQ；
It calculatesIt is describedFor P- > Q confidence level；
Confidence threshold value T is setN,
IfThen the history exception information in P and the history exception information in Q are strongly connected；
IfThen the history exception information in P and the history exception information in Q are not strongly connected.
In other embodiments of the invention, it can also get in multiple history exception informations and deposit in above-mentioned steps 404
After all history exception informations combinations of strong incidence relation, there are all history of strong incidence relation are abnormal by described
In information combination, there is the history exception information combination of strong incidence relation between every two history exception information, be determined as strong
Correlation rule.
Compared with Strong association rule establishment process shown in Fig. 4, there are all history of strong incidence relation are different obtaining
After normal information combination, the history exception information that there is strong incidence relation between every two history exception information is selected
Combination can make the relevance of exception information in each group conjunction stronger as final Strong association rule, therefore, can be further
Improve the accuracy of alarm.
Based on the same inventive concept, the abnormal alarm method provided according to that above embodiment of the present invention, correspondingly, the present invention
Another embodiment additionally provides a kind of anomaly alarming device, and structural schematic diagram is as shown in figure 5, specifically include:
Exception information obtains module 501, multiple exception informations for having been generated and not alarmed, the multiple exception
Information is generated to be monitored to monitored equipment；
Strong association determining module 502 is calculated for being directed to the multiple exception information according to excavating previously according to data correlation
The Strong association rule that method is established, determines strongly connected at least two exception information in the multiple exception information, the strong association
Include in rule: there are all exception information combinations of strong incidence relation in all issuable exception informations；
Merging module 503, for merging into a warning message for strongly connected at least two exception information；
Alarm module 504 is alarmed for being directed to the warning message.
Further, the exception information obtains module 501, is monitored generation to monitored equipment specifically for obtaining
Current exception information and the old exception information that has generated and do not alarmed；
The merging module 503, is specifically used for:
In the multiple exception information, when there is the first exception information that arrived the abnormal tolerance limit moment, judgement
With the presence or absence of with the strongly connected exception information of the first exception information；The abnormal tolerance limit moment is to produce from exception information
Start at the time of raw, at the time of by default abnormal tolerance duration；
If it exists, by first exception information and with the strongly connected exception information of the first exception information, merge into
One warning message；
If it does not exist with the strongly connected exception information of the first exception information, then first exception information is determined as
One independent warning message；
For the independent warning message, alarm.
Further, the exception information obtains module 501, when specifically for according to the alarm of preset alarm cycle set
Be carved into up to when, obtain the multiple exception informations generated in a nearest alarm cycle.
Further, device further include:
First history exception information collection module, the first history exception information arrangement module, the first affairs determining module and
First Strong association rule determining module；
The first history exception information collection module sets described be monitored for collecting in default historical time section
The standby generation moment for being monitored generated multiple history exception informations and each history exception information；
The first history exception information arranges module, for the generation moment according to each history exception information,
The multiple history exception information is arranged to time shaft；
The first affairs determining module, for the preset duration section fixed according to length, to arrangement to the time
The multiple history exception information on axis is divided, multiple described in the same preset duration section by being divided into
History exception information is determined as an affairs；
The first Strong association rule determining module is abnormal according to each history for using data correlation mining algorithm
Information appears in the number in the same affairs, obtains in the multiple history exception information that there are all of strong incidence relation
History exception information combination, as Strong association rule.
Further, device further include:
It is second history exception information collection module, the second history exception information arrangement module, the second affairs determining module, strong
It is associated with the combination of history exception information and obtains module and the second Strong association rule determining module；
The second history exception information collection module sets described be monitored for collecting in default historical time section
The standby generation moment for being monitored generated multiple history exception informations and each history exception information；
The second history exception information arranges module, for the generation moment according to each history exception information,
The multiple history exception information is arranged to time shaft；
The second affairs determining module, for the preset duration section fixed according to length, to arrangement to the time
The multiple history exception information on axis is divided, multiple described in the same preset duration section by being divided into
History exception information is determined as an affairs；
The strong association history exception information combination obtains module, for using data correlation mining algorithm, according to each
History exception information appears in the number in the same affairs, obtains in the multiple history exception information that there are strong incidence relations
All history exception informations combinations；
The second Strong association rule determining module, for believing all history exceptions there are strong incidence relation
In breath combination, there is the history exception information combination of strong incidence relation between every two history exception information, be determined as closing by force
Connection rule.
Using this anomaly alarming device shown in fig. 5, is no longer triggered and alarmed with single exception information, and will be associated more
A exception information merges into a warning message, reduces redundant warning information, promotes operation maintenance personnel efficiency, facilitates fast short stopping
Damage.
The embodiment of the invention also provides a kind of electronic equipment, as shown in fig. 6, include processor 601, communication interface 602,
Memory 603 and communication bus 604, wherein processor 601, communication interface 602, memory 603 are complete by communication bus 604
At mutual communication,
Memory 603, for storing computer program；
Processor 601 when for executing the program stored on memory 603, realizes following steps:
The multiple exception informations for having been generated and not alarmed, the multiple exception information are to supervise to monitored equipment
Caused by survey；
For the multiple exception information, according to the Strong association rule established previously according to data correlation mining algorithm, really
Determine strongly connected at least two exception information in the multiple exception information, include in the Strong association rule: all possible productions
There are all exception information combinations of strong incidence relation in raw exception information；
By strongly connected at least two exception information, a warning message is merged into；
For the warning message, alarm.
The communication bus that above-mentioned electronic equipment is mentioned can be Peripheral Component Interconnect standard (Peripheral Component
Interconnect, PCI) bus or expanding the industrial standard structure (Extended Industry Standard
Architecture, EISA) bus etc..The communication bus can be divided into address bus, data/address bus, control bus etc..For just
It is only indicated with a thick line in expression, figure, it is not intended that an only bus or a type of bus.
Communication interface is for the communication between above-mentioned electronic equipment and other equipment.
Memory may include random access memory (Random Access Memory, RAM), also may include non-easy
The property lost memory (Non-Volatile Memory, NVM), for example, at least a magnetic disk storage.Optionally, memory may be used also
To be storage device that at least one is located remotely from aforementioned processor.
Above-mentioned processor can be general processor, including central processing unit (Central Processing Unit,
CPU), network processing unit (Network Processor, NP) etc.；It can also be digital signal processor (Digital Signal
Processing, DSP), it is specific integrated circuit (Application Specific Integrated Circuit, ASIC), existing
It is field programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic device, discrete
Door or transistor logic, discrete hardware components.
In another embodiment provided by the invention, a kind of computer readable storage medium is additionally provided, which can
It reads to be stored with computer program in storage medium, the computer program realizes any of the above-described abnormal alarm when being executed by processor
The step of method, to obtain identical technical effect.
In another embodiment provided by the invention, a kind of computer program product comprising instruction is additionally provided, when it
When running on computers, so that the step of computer executes any abnormal alarm method in above-described embodiment, identical to obtain
Technical effect.
In the above-described embodiments, can come wholly or partly by software, hardware, firmware or any combination thereof real
It is existing.When implemented in software, it can entirely or partly realize in the form of a computer program product.The computer program
Product includes one or more computer instructions.When loading on computers and executing the computer program instructions, all or
It partly generates according to process or function described in the embodiment of the present invention.The computer can be general purpose computer, dedicated meter
Calculation machine, computer network or other programmable devices.The computer instruction can store in computer readable storage medium
In, or from a computer readable storage medium to the transmission of another computer readable storage medium, for example, the computer
Instruction can pass through wired (such as coaxial cable, optical fiber, number from a web-site, computer, server or data center
User's line (DSL)) or wireless (such as infrared, wireless, microwave etc.) mode to another web-site, computer, server or
Data center is transmitted.The computer readable storage medium can be any usable medium that computer can access or
It is comprising data storage devices such as one or more usable mediums integrated server, data centers.The usable medium can be with
It is magnetic medium, (for example, floppy disk, hard disk, tape), optical medium (for example, DVD) or semiconductor medium (such as solid state hard disk
Solid State Disk (SSD)) etc..
It should be noted that, in this document, relational terms such as first and second and the like are used merely to a reality
Body or operation are distinguished with another entity or operation, are deposited without necessarily requiring or implying between these entities or operation
In any actual relationship or order or sequence.Moreover, the terms "include", "comprise" or its any other variant are intended to
Non-exclusive inclusion, so that the process, method, article or equipment including a series of elements is not only wanted including those
Element, but also including other elements that are not explicitly listed, or further include for this process, method, article or equipment
Intrinsic element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that
There is also other identical elements in process, method, article or equipment including the element.
Each embodiment in this specification is all made of relevant mode and describes, same and similar portion between each embodiment
Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.Especially for device,
For electronic equipment, computer readable storage medium and computer program product embodiments, since it is substantially similar to method reality
Example is applied, so being described relatively simple, the relevent part can refer to the partial explaination of embodiments of method.
The foregoing is merely illustrative of the preferred embodiments of the present invention, is not intended to limit the scope of the present invention.It is all
Any modification, equivalent replacement, improvement and so within the spirit and principles in the present invention, are all contained in protection scope of the present invention
It is interior.
Claims (11)
1. a kind of abnormal alarm method characterized by comprising
The multiple exception informations for having been generated and not alarmed, the multiple exception information is is monitored institute to monitored equipment
It generates；
Institute is determined according to the Strong association rule established previously according to data correlation mining algorithm for the multiple exception information
Strongly connected at least two exception information in multiple exception informations is stated, includes in the Strong association rule: all issuable
There are all exception information combinations of strong incidence relation in exception information；
By strongly connected at least two exception information, a warning message is merged into；
For the warning message, alarm.
2. the method according to claim 1, wherein the multiple abnormal letters for having been generated and not alarmed
Breath, comprising:
Obtain the old exception information that the current exception information of generation is monitored to monitored equipment and has generated and has not alarmed；
It is described by strongly connected at least two exception information, merge into a warning message, comprising:
In the multiple exception information, when there is the first exception information that arrived the abnormal tolerance limit moment, judge whether
In the presence of with the strongly connected exception information of the first exception information；The abnormal tolerance limit moment is to generate from exception information
Moment has started, at the time of by default abnormal tolerance duration；
If it exists, by first exception information and with the strongly connected exception information of the first exception information, merge into one
Warning message；
If it does not exist with the strongly connected exception information of the first exception information, then first exception information is determined as one
Independent warning message；
For the independent warning message, alarm.
3. the method according to claim 1, wherein the multiple abnormal letters for having been generated and not alarmed
Breath, comprising:
When reaching according to the alarm moment of preset alarm cycle set, the multiple of the interior generation of a nearest alarm cycle are obtained
Exception information.
4. the method according to claim 1, wherein the establishment process of the Strong association rule, comprising:
It collects in default historical time section, generated multiple history exception informations is monitored to the monitored equipment, with
And the generation moment of each history exception information；
According to the generation moment of each history exception information, the multiple history exception information is arranged to time shaft；
According to the preset duration section that length is fixed, arrangement to the multiple history exception information on the time shaft is carried out
It divides, the multiple history exception informations being divided into the same preset duration section is determined as an affairs；
Using data correlation mining algorithm, the number in the same affairs is appeared according to each history exception information, obtains institute
All history exception information combinations in multiple history exception informations there are strong incidence relation are stated, as Strong association rule.
5. the method according to claim 1, wherein the establishment process of the Strong association rule, comprising:
It collects in default historical time section, generated multiple history exception informations is monitored to the monitored equipment, with
And the generation moment of each history exception information；
According to the generation moment of each history exception information, the multiple history exception information is arranged to time shaft；
According to the preset duration section that length is fixed, arrangement to the multiple history exception information on the time shaft is carried out
It divides, the multiple history exception informations being divided into the same preset duration section is determined as an affairs；
Using data correlation mining algorithm, the number in the same affairs is appeared according to each history exception information, obtains institute
State all history exception information combinations in multiple history exception informations there are strong incidence relation；
By in all history exception information combinations there are strong incidence relation, deposited between every two history exception information
It is combined in the history exception information of strong incidence relation, is determined as Strong association rule.
6. a kind of anomaly alarming device characterized by comprising
Exception information obtains module, multiple exception informations for having been generated and not alarmed, and the multiple exception information is
Monitored equipment is monitored generated；
Strong association determining module is established for being directed to the multiple exception information according to previously according to data correlation mining algorithm
Strong association rule, strongly connected at least two exception information in the multiple exception information is determined, in the Strong association rule
Include: there are all exception information combinations of strong incidence relation in all issuable exception informations；
Merging module, for merging into a warning message for strongly connected at least two exception information；
Alarm module is alarmed for being directed to the warning message.
7. device according to claim 6, which is characterized in that the exception information obtains module, is specifically used for acquisition pair
The old exception information that monitored equipment is monitored the current exception information of generation and has generated and do not alarmed；
The merging module, is specifically used for:
In the multiple exception information, when there is the first exception information that arrived the abnormal tolerance limit moment, judge whether
In the presence of with the strongly connected exception information of the first exception information；The abnormal tolerance limit moment is to generate from exception information
Moment has started, at the time of by default abnormal tolerance duration；
If it exists, by first exception information and with the strongly connected exception information of the first exception information, merge into one
Warning message；
If it does not exist with the strongly connected exception information of the first exception information, then first exception information is determined as one
Independent warning message；
For the independent warning message, alarm.
8. device according to claim 6, which is characterized in that the exception information obtains module, is specifically used for according to pre-
If the alarm moment of alarm cycle setting reaches, the multiple exception informations generated in a nearest alarm cycle are obtained.
9. device according to claim 6, which is characterized in that further include:
First history exception information collection module, the first history exception information arrange module, the first affairs determining module and first
Strong association rule determining module；
The first history exception information collection module, for collecting in default historical time section, to the monitored equipment into
Row monitors the generation moment of generated multiple history exception informations and each history exception information；
The first history exception information arranges module, for the generation moment according to each history exception information, by institute
Multiple history exception informations are stated to arrange to time shaft；
The first affairs determining module, for the preset duration section fixed according to length, in arrangement to the time shaft
The multiple history exception information divided, multiple history in the same preset duration section will be divided into
Exception information is determined as an affairs；
The first Strong association rule determining module, for using data correlation mining algorithm, according to each history exception information
The number in the same affairs is appeared in, all history in the multiple history exception information there are strong incidence relation are obtained
Exception information combination, as Strong association rule.
10. device according to claim 6, which is characterized in that further include:
Second history exception information collection module, the second history exception information arrange module, the second affairs determining module, Qiang Guanlian
The combination of history exception information obtains module and the second Strong association rule determining module；
The second history exception information collection module, for collecting in default historical time section, to the monitored equipment into
Row monitors the generation moment of generated multiple history exception informations and each history exception information；
The second history exception information arranges module, for the generation moment according to each history exception information, by institute
Multiple history exception informations are stated to arrange to time shaft；
The second affairs determining module, for the preset duration section fixed according to length, in arrangement to the time shaft
The multiple history exception information divided, multiple history in the same preset duration section will be divided into
Exception information is determined as an affairs；
The strong association history exception information combination obtains module, for using data correlation mining algorithm, according to each history
Exception information appears in the number in the same affairs, obtains the institute in the multiple history exception information there are strong incidence relation
Some history exception information combinations；
The second Strong association rule determining module, for there are all history exception information groups of strong incidence relation by described
In conjunction, there is the history exception information combination of strong incidence relation between every two history exception information, be determined as being associated with rule by force
Then.
11. a kind of electronic equipment, which is characterized in that including processor, communication interface, memory and communication bus, wherein processing
Device, communication interface, memory complete mutual communication by communication bus；
Memory, for storing computer program；
Processor when for executing the program stored on memory, realizes any method and step of claim 1-5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910676208.8A CN110457185B (en) | 2019-07-25 | 2019-07-25 | Abnormality alarm method and device and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910676208.8A CN110457185B (en) | 2019-07-25 | 2019-07-25 | Abnormality alarm method and device and electronic equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110457185A true CN110457185A (en) | 2019-11-15 |
| CN110457185B CN110457185B (en) | 2024-01-23 |
Family
ID=68483437
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910676208.8A Active CN110457185B (en) | 2019-07-25 | 2019-07-25 | Abnormality alarm method and device and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110457185B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111586129A (en) * | 2020-04-28 | 2020-08-25 | 北京奇艺世纪科技有限公司 | Alarm method and device for data synchronization, electronic equipment and storage medium |
| CN113868207A (en) * | 2021-10-09 | 2021-12-31 | 北京中水科水电科技开发有限公司 | Compression display method and system for information redundancy jitter characteristics |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106789138A (en) * | 2015-11-23 | 2017-05-31 | 中国移动通信集团广西有限公司 | A kind of method and device of network alarm association analysis |
| EP3208970A1 (en) * | 2014-10-14 | 2017-08-23 | ZTE Corporation | Alarm correlation data mining method and device |
| CN108156037A (en) * | 2017-12-29 | 2018-06-12 | 中国移动通信集团江苏有限公司 | Alarm correlation analysis method, device, equipment and medium |
| CN108809757A (en) * | 2018-05-22 | 2018-11-13 | 平安科技（深圳）有限公司 | A kind of system alarm method, storage medium and server |
| CN109412867A (en) * | 2018-12-06 | 2019-03-01 | 国家电网有限公司信息通信分公司 | A kind of alarm association merging method, device, system, equipment and storage medium |
| WO2019080918A1 (en) * | 2017-10-26 | 2019-05-02 | 中兴通讯股份有限公司 | Method for suppressing redundant alarms, and network management device and storage medium |
-
2019
- 2019-07-25 CN CN201910676208.8A patent/CN110457185B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP3208970A1 (en) * | 2014-10-14 | 2017-08-23 | ZTE Corporation | Alarm correlation data mining method and device |
| CN106789138A (en) * | 2015-11-23 | 2017-05-31 | 中国移动通信集团广西有限公司 | A kind of method and device of network alarm association analysis |
| WO2019080918A1 (en) * | 2017-10-26 | 2019-05-02 | 中兴通讯股份有限公司 | Method for suppressing redundant alarms, and network management device and storage medium |
| CN108156037A (en) * | 2017-12-29 | 2018-06-12 | 中国移动通信集团江苏有限公司 | Alarm correlation analysis method, device, equipment and medium |
| CN108809757A (en) * | 2018-05-22 | 2018-11-13 | 平安科技（深圳）有限公司 | A kind of system alarm method, storage medium and server |
| CN109412867A (en) * | 2018-12-06 | 2019-03-01 | 国家电网有限公司信息通信分公司 | A kind of alarm association merging method, device, system, equipment and storage medium |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111586129A (en) * | 2020-04-28 | 2020-08-25 | 北京奇艺世纪科技有限公司 | Alarm method and device for data synchronization, electronic equipment and storage medium |
| CN113868207A (en) * | 2021-10-09 | 2021-12-31 | 北京中水科水电科技开发有限公司 | Compression display method and system for information redundancy jitter characteristics |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110457185B (en) | 2024-01-23 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110224858B (en) | Log-based alarm method and related device | |
| CN106104496B (en) | The abnormality detection not being subjected to supervision for arbitrary sequence | |
| US11012289B2 (en) | Reinforced machine learning tool for anomaly detection | |
| CN110457185A (en) | A kind of abnormal alarm method, apparatus and electronic equipment | |
| Bovenzi et al. | An OS-level framework for anomaly detection in complex software systems | |
| Bhaduri et al. | Detecting abnormal machine characteristics in cloud infrastructures | |
| CN110224885A (en) | Alarm method, device, storage medium and the electronic equipment of monitoring of tools | |
| Marvasti et al. | An enterprise dynamic thresholding system | |
| EP4158480A1 (en) | Actionability metric generation for events | |
| Demirbaga et al. | Autodiagn: An automated real-time diagnosis framework for big data systems | |
| CN115328733A (en) | Alarm method and device applied to business system, electronic equipment and storage medium | |
| CN111666171A (en) | Fault identification method and device, electronic equipment and readable storage medium | |
| CN110471822A (en) | Method, apparatus, computer system and medium for monitoring host computer system | |
| WO2012167066A2 (en) | Method and system for providing information from third party applications to devices | |
| EP2882139B1 (en) | System and method for IT servers anomaly detection using incident consolidation | |
| Zeng et al. | Traceark: Towards actionable performance anomaly alerting for online service systems | |
| Augustine et al. | Outage detection via real-time social stream analysis: leveraging the power of online complaints | |
| CN113342625A (en) | Data monitoring method and system | |
| CN105490835A (en) | Information monitoring method and device | |
| CN104346246B (en) | Failure prediction method and device | |
| JP2014153736A (en) | Fault symptom detection method, program and device | |
| JP6018024B2 (en) | CHANGE DETECTION DEVICE, CHANGE DETECTION SYSTEM, CHANGE DETECTION METHOD, AND PROGRAM | |
| CN114610560B (en) | System abnormality monitoring method, device and storage medium | |
| CN110633165B (en) | Fault processing method, device, system server and computer readable storage medium | |
| Mishra et al. | Model based approach for autonomic availability management |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |