CN111143103A - Incidence relation determining method, device, equipment and readable storage medium - Google Patents
Incidence relation determining method, device, equipment and readable storage medium Download PDFInfo
- Publication number
- CN111143103A CN111143103A CN201911367789.3A CN201911367789A CN111143103A CN 111143103 A CN111143103 A CN 111143103A CN 201911367789 A CN201911367789 A CN 201911367789A CN 111143103 A CN111143103 A CN 111143103A
- Authority
- CN
- China
- Prior art keywords
- target
- fault
- event
- fault event
- cluster
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Withdrawn
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/079—Root cause analysis, i.e. error or fault diagnosis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0793—Remedial or corrective actions
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Quality & Reliability (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Evolutionary Computation (AREA)
- Evolutionary Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Bioinformatics & Computational Biology (AREA)
- Artificial Intelligence (AREA)
- Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Life Sciences & Earth Sciences (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The application discloses an incidence relation determining method, device, equipment and readable storage medium. The method disclosed by the application comprises the following steps: acquiring all fault events generated in a storage cluster; clustering analysis is carried out on the fault events by using a DBSCAN algorithm to obtain a plurality of target clusters; adding an event description field for a fault event in each target cluster to obtain a plurality of target sets; processing the multiple target sets by using an Apriori algorithm to obtain a correlation result; the correlation result comprises: different fault events having an associative relationship. The method and the device analyze the incidence relation of different fault events by using the DBSCAN algorithm and the Apriori algorithm, record the different fault events with the incidence relation as the incidence result, and can quickly determine another fault event which possibly occurs according to the incidence result when the fault event occurs in the storage cluster, thereby realizing the advance prevention of the fault event. The incidence relation determining device, the equipment and the readable storage medium disclosed by the application also have the technical effects.
Description
Technical Field
The present application relates to the field of computer technologies, and in particular, to a method, an apparatus, a device, and a readable storage medium for determining an association relationship.
Background
At present, when a storage cluster fails, a failure event can be timely prompted to a user, and the user needs a certain time to analyze the failure event and then solves the failure. In this case, the occurrence of one fault event may cause another fault event to occur, so that the user needs to solve another fault event immediately after solving the previous fault event, which not only increases the operation and maintenance workload, but also reduces the operation and maintenance efficiency. It may also cause blocking of storage cluster service operation and reduce performance of the storage cluster.
Therefore, how to find the association relationship between different fault events and implement the early prevention of the fault is a problem to be solved by those skilled in the art.
Disclosure of Invention
In view of the above, an object of the present application is to provide a method, an apparatus, a device and a readable storage medium for determining an association relationship between different fault events, so as to find the association relationship between different fault events and implement early prevention of faults. The specific scheme is as follows:
in a first aspect, the present application provides an association relation determining method, including:
acquiring all fault events generated in a storage cluster;
clustering analysis is carried out on the fault events by using a DBSCAN algorithm to obtain a plurality of target clusters;
adding an event description field for a fault event in each target cluster to obtain a plurality of target sets;
processing the plurality of target sets by using an Apriori algorithm to obtain a correlation result; the correlation result comprises: different fault events having an associative relationship.
Preferably, the clustering analysis of the fault event by using the DBSCAN algorithm to obtain a plurality of target clusters includes:
and extracting the generation time of each fault event, and performing cluster analysis on each fault event by using the DBSCAN algorithm with the generation time as a cluster center to obtain a plurality of target clusters.
Preferably, the performing cluster analysis on each fault event by using the DBSCAN algorithm to obtain a plurality of target clusters includes:
clustering analysis is carried out on each fault event by utilizing the DBSCAN algorithm to obtain a plurality of intermediate clusters;
and deleting the intermediate clusters with the number of events lower than a preset density threshold value from all the intermediate clusters to obtain the plurality of target clusters.
Preferably, the adding an event description field to the fault event in each target cluster to obtain a plurality of target sets includes:
and adding an event description field for the fault event in each target cluster according to the event fault type to obtain a plurality of target sets.
Preferably, the processing the plurality of target sets by using Apriori algorithm to obtain the association result includes:
dividing the fault events in each target set into a plurality of candidate subsets by using the Apriori algorithm;
determining the support degree and the confidence degree of each candidate subset;
and if the support degree and the confidence degree of any candidate subset meet preset conditions, determining the current candidate subset as the association result.
Preferably, after the processing the plurality of target sets by using Apriori algorithm and obtaining the association result, the method further includes:
acquiring a target fault event generated in the storage cluster;
determining an object fault event having an association relation with the target fault event according to the association result;
and generating and displaying a prompt message containing the object fault event and the target fault event.
Preferably, after the generating and presenting the prompt message containing the object fault event and the target fault event, the method further includes:
and sending the prompt message to a preset management terminal.
In a second aspect, the present application provides an association relation determining apparatus, including:
the acquisition module is used for acquiring all fault events generated in the storage cluster;
the clustering module is used for clustering and analyzing the fault events by utilizing a DBSCAN algorithm to obtain a plurality of target clusters;
the adding module is used for adding an event description field for the fault event in each target cluster to obtain a plurality of target sets;
the processing module is used for processing the plurality of target sets by using an Apriori algorithm to obtain a correlation result; the correlation result comprises: different fault events having an associative relationship.
In a third aspect, the present application provides an association relation determining apparatus, including:
a memory for storing a computer program;
a processor for executing the computer program to implement the association relation determination method disclosed in the foregoing.
In a fourth aspect, the present application provides a readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the association relation determining method disclosed in the foregoing.
According to the scheme, the application provides an incidence relation determining method, which comprises the following steps: acquiring all fault events generated in a storage cluster; clustering analysis is carried out on the fault events by using a DBSCAN algorithm to obtain a plurality of target clusters; adding an event description field for a fault event in each target cluster to obtain a plurality of target sets; processing the plurality of target sets by using an Apriori algorithm to obtain a correlation result; the correlation result comprises: different fault events having an associative relationship.
Therefore, the method carries out cluster analysis on all fault events generated in the storage cluster by using a DBSCAN algorithm to obtain a plurality of target clusters; adding an event description field for a fault event in each target cluster to obtain a plurality of target sets; thus, a plurality of target sets are further processed by an Apriori algorithm to obtain a correlation result; the correlation result comprises: different fault events having an associative relationship. The method and the device have the advantages that the correlation relation of different fault events is obtained by analyzing the DBSCAN algorithm and the Apriori algorithm, and the different fault events with the correlation relation are recorded as the correlation result, so that when a new fault event is generated in the storage cluster again, another fault event which possibly occurs can be rapidly determined according to the correlation result, thereby preventing the fault event in advance, ensuring the stable operation of the storage cluster and improving the performance of the storage cluster. Meanwhile, the operation and maintenance workload is reduced, and the operation and maintenance efficiency is improved.
Accordingly, the incidence relation determining device, the equipment and the readable storage medium provided by the application also have the technical effects.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below, it is obvious that the drawings in the following description are only embodiments of the present application, and for those skilled in the art, other drawings can be obtained according to the provided drawings without creative efforts.
Fig. 1 is a flowchart of an association relationship determination method disclosed in the present application;
FIG. 2 is a flow chart of another association determination method disclosed in the present application;
fig. 3 is a schematic diagram of an association relation determining apparatus disclosed in the present application;
fig. 4 is a schematic diagram of an association relation determining apparatus disclosed in the present application.
Detailed Description
The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
At present, the prior art increases the operation and maintenance workload and reduces the operation and maintenance efficiency. It may also cause blocking of storage cluster service operation and reduce performance of the storage cluster. Therefore, the incidence relation determining scheme is provided, incidence relations among different fault events can be found, and early prevention of faults is achieved.
Referring to fig. 1, an embodiment of the present application discloses an association relation determining method, including:
s101, acquiring all fault events generated in the storage cluster.
The number of fault events obtained in step S101 is multiple, and the fault events include: event occurrence time, event error code, event description, event occurrence reason and located service module.
S102, clustering analysis is carried out on the fault events by utilizing a DBSCAN algorithm, and a plurality of target clusters are obtained.
In a specific embodiment, performing cluster analysis on the fault event by using a DBSCAN (Density Based Clustering of applications with Noise) algorithm to obtain a plurality of target clusters, including: and extracting the generation time of each fault event, taking the generation time as a cluster center, and performing cluster analysis on each fault event by using a DBSCAN algorithm to obtain a plurality of target clusters.
In this embodiment, the classification of the fault events is implemented with the generation time of each fault event as the cluster center.
In a specific embodiment, performing cluster analysis on each fault event by using a DBSCAN algorithm to obtain a plurality of target clusters, includes: clustering analysis is carried out on each fault event by using a DBSCAN algorithm to obtain a plurality of intermediate clusters; and deleting the intermediate clusters with the number of events lower than a preset density threshold value from all the intermediate clusters to obtain a plurality of target clusters.
Specifically, the radius and the preset density threshold of the DBSCAN algorithm are set according to actual requirements. The radius is the distance (which is the amount of time in this embodiment) from the cluster center to the fault event farthest from the cluster center in the same cluster. The preset density threshold value represents the number of fault events in one cluster, and if the number of fault events in one cluster is lower than the preset density threshold value, the fault events in the cluster are useless, namely noise points, and the cluster can be discarded. The radius and the preset density threshold value can be flexibly adjusted according to actual requirements.
It should be noted that the DBSCAN algorithm can cluster data sets with any density, and the clustering algorithm such as K-Means is generally only applicable to convex data sets. The DBSCAN algorithm can find abnormal points in the clustering process and eliminate noise points; the DBSCAN algorithm has no bias on the clustering result, so that the clustering result is more accurate.
S103, adding an event description field for the fault event in each target cluster to obtain a plurality of target sets.
In a specific embodiment, adding an event description field to a failure event in each target cluster, and obtaining a plurality of target sets, includes: and adding an event description field for the fault event in each target cluster according to the event fault type to obtain a plurality of target sets.
Wherein, the event description field generally includes: cause of failure, type of failure, etc.
S104, processing the multiple target sets by using an Apriori algorithm to obtain a correlation result; the correlation result comprises: different fault events having an associative relationship.
In a specific embodiment, processing a plurality of target sets by using Apriori algorithm to obtain a correlation result includes: dividing the fault events in each target set into a plurality of candidate subsets by using an Apriori algorithm; determining the support degree and the confidence degree of each candidate subset; and if the support degree and the confidence degree of any candidate subset meet preset conditions, determining the current candidate subset as a correlation result.
Specifically, if the support degree and the confidence degree of the candidate subset satisfy the preset conditions, it indicates that the incidence relation of the fault events in the candidate subset is large, and therefore when one fault event in the candidate subset occurs, the probability of another fault event in the candidate subset occurring is high. If the support degree of the candidate subset is not less than the support degree threshold and the confidence degree of the candidate subset is not less than the confidence degree threshold, the support degree and the confidence degree of the candidate subset are determined to meet preset conditions.
The support threshold and the confidence threshold may be flexibly set according to actual requirements (e.g., 75%, 80%, etc.), and may be equal or different. Typically, the confidence threshold is greater than the support threshold. If the support degree of the candidate subset meets the support degree threshold value but the confidence degree of the candidate subset does not meet the confidence degree threshold value, the candidate subset is called a frequent set. The incidence relation between different fault events in the frequent concentration is small.
It should be noted that, according to the principle of Apriori algorithm, the number of fault events in the candidate subset is not fixed, and reference may be made to the prior art specifically, and details are not described here.
In a specific embodiment, after the processing the plurality of target sets by using Apriori algorithm and obtaining the association result, the method further includes: acquiring a target fault event generated in a storage cluster; determining an object fault event having an association relation with the target fault event according to the association result; and generating and displaying a prompt message containing the object fault event and the target fault event. After the prompt message containing the object fault event and the target fault event is generated and displayed, the method further comprises the following steps: and sending the prompt message to a preset management terminal.
That is, when a new failure event occurs in the storage cluster, another failure event that may occur may be quickly determined according to the association result, and corresponding prompt information is displayed, so that the failure event is notified in advance, and a user is enabled to prevent the occurrence of another failure event in advance.
Therefore, in the embodiment of the application, for the fault event generated in the storage cluster, the DBSCAN algorithm is used for carrying out cluster analysis on the fault event to obtain a plurality of target clusters; adding an event description field for a fault event in each target cluster to obtain a plurality of target sets; thus, a plurality of target sets are further processed by an Apriori algorithm to obtain a correlation result; the correlation result comprises: different fault events having an associative relationship. The method and the device have the advantages that the correlation relation of different fault events is obtained by analyzing the DBSCAN algorithm and the Apriori algorithm, and the different fault events with the correlation relation are recorded as the correlation result, so that when a new fault event is generated in the storage cluster again, another fault event which possibly occurs can be rapidly determined according to the correlation result, thereby preventing the fault event in advance, ensuring the stable operation of the storage cluster and improving the performance of the storage cluster. Meanwhile, the operation and maintenance workload is reduced, and the operation and maintenance efficiency is improved.
Referring to fig. 2, an embodiment of the present application discloses another association relationship determining method, including: clustering the fault event set by using a DBSCAN algorithm to generate a plurality of clusters; a description field is added to the fault event in each cluster (i.e., event transactivation) to obtain training data that the Apriori algorithm can process. (i.e., output association rules).
Specifically, clustering the fault event set by using the DBSCAN algorithm to generate a plurality of clusters, specifically including: and setting the radius r and the density threshold MinTh of the DBSCAN algorithm, clustering the fault event set based on the time, the radius r and the density threshold MinTh of the fault event, and generating a plurality of clusters. And deleting the clusters with the number of events lower than a preset density threshold value to remove noise points, so that the generated clusters are more effective and more accurate.
Specifically, adding a description field to a fault event in each cluster (i.e., event transacting) to obtain training data that can be processed by the Apriori algorithm includes: traversing each cluster, adding a description field for the fault event in each cluster, so that one fault event becomes one transaction, and thus the object set (i.e. the target set described above) corresponding to each cluster can be obtained. Each set of objects includes a plurality of transactions. Wherein, the object set can be represented as { "Tid": [ Object1, Object 2, ], "Tid" is identification information of the Object set, and Object1 and Object 2 are two transactions in the Object set. The identification information of the object set is a timestamp generated for any transaction included in the object set (i.e. a time when the failure event occurs), such as: and when the target object set is traversed, determining the timestamp generated by the traversed first transaction as the identification information of the target object set.
Specifically, processing the training data by using Apriori algorithm, and outputting an association result (i.e., outputting an association rule) having an association relationship, specifically includes: setting a reasonable support degree threshold value (min _ sup) and a confidence degree threshold value (min _ conf), processing training data by using an Apriori algorithm, and in the processing process, if the support degree and the confidence degree of the candidate subset meet preset conditions, indicating that the incidence relation of fault events in the candidate subset is large, so that a corresponding incidence result is output. From which multiple correlation results can be obtained.
In the process of processing training data by an Apriori algorithm, firstly generating a candidate subset only comprising one transaction, and calculating the support degree and the confidence degree; further generating a candidate subset containing 2 transactions, and calculating the support degree and the confidence degree; and so on until a higher order candidate subset cannot be generated.
Specifically, Apriori algorithm pseudo code is as follows:
as can be seen from the above, in the present embodiment, the DBSCAN algorithm and Apriori algorithm are used to mine and analyze the failure event reported by the storage cluster. The fault events are classified according to the time factor indexes, so that the influence of personal subjectivity on the event occurrence time is avoided, the isolated fault events are deleted, and the classification accuracy is ensured. Secondly, generating a training data set according to the clustering, and analyzing the dependency and the inducement (namely, the association relationship) of each fault event in the training data set by using an Apriori algorithm so as to output an association result.
Based on the correlation results, hidden relationships between fault events may be mined. When a certain fault event occurs, other fault events which are about to occur are predicted, and managers and clients are informed of relative preventive measures as soon as possible, so that various losses caused by equipment faults can be reduced. Meanwhile, design developers can develop products based on the association result, multi-scene layout can be fully considered, and mutual association among some fault events can be avoided at the initial stage of design, so that the stability of equipment is improved, and the product competitiveness and user experience are improved.
In the following, a device for determining an association relationship provided in an embodiment of the present application is introduced, and a device for determining an association relationship described below and a method for determining an association relationship described above may be referred to each other.
Referring to fig. 3, an embodiment of the present application discloses an association relation determining apparatus, including:
an obtaining module 301, configured to obtain all fault events generated in a storage cluster;
the clustering module 302 is configured to perform clustering analysis on the fault event by using a DBSCAN algorithm to obtain a plurality of target clusters;
an adding module 303, configured to add an event description field to a failure event in each target cluster, so as to obtain a plurality of target sets;
a processing module 304, configured to process the multiple target sets by using an Apriori algorithm to obtain an association result; the correlation result comprises: different fault events having an associative relationship.
In a specific embodiment, the clustering module is specifically configured to:
and extracting the generation time of each fault event, taking the generation time as a cluster center, and performing cluster analysis on each fault event by using a DBSCAN algorithm to obtain a plurality of target clusters.
In a specific embodiment, the clustering module is specifically configured to:
clustering analysis is carried out on each fault event by using a DBSCAN algorithm to obtain a plurality of intermediate clusters; and deleting the intermediate clusters with the number of events lower than a preset density threshold value from all the intermediate clusters to obtain a plurality of target clusters.
In a specific embodiment, the adding module is specifically configured to:
and adding an event description field for the fault event in each target cluster according to the event fault type to obtain a plurality of target sets.
In one embodiment, the processing module comprises:
the dividing unit is used for dividing the fault events in each target set into a plurality of candidate subsets by using an Apriori algorithm;
a first determining unit, configured to determine a support degree and a confidence degree of each candidate subset;
and the second determining unit is used for determining the current candidate subset as the association result if the support degree and the confidence degree of any candidate subset meet preset conditions.
In a specific embodiment, the method further comprises the following steps:
the target fault event acquisition module is used for acquiring a target fault event generated in the storage cluster;
the determining module is used for determining the object fault event which has an incidence relation with the target fault event according to the incidence result by the user;
and the prompt module is used for generating and displaying a prompt message containing the object fault event and the target fault event.
In a specific embodiment, the method further comprises the following steps:
and the sending module is used for sending the prompt message to a preset management terminal.
For more specific working processes of each module and unit in this embodiment, reference may be made to corresponding contents disclosed in the foregoing embodiments, and details are not described here again.
Therefore, the present embodiment provides an association relationship determining device, where the device obtains an association relationship between different fault events by using a DBSCAN algorithm and an Apriori algorithm, and records the different fault events having the association relationship as an association result, so that when a new fault event is generated again in a storage cluster, another fault event that may occur may be quickly determined according to the association result, thereby implementing advance prevention of the fault event, ensuring stable operation of the storage cluster, and improving performance of the storage cluster. Meanwhile, the operation and maintenance workload is reduced, and the operation and maintenance efficiency is improved.
In the following, an association relation determining device provided in the embodiment of the present application is introduced, and an association relation determining device described below and an association relation determining method and apparatus described above may be referred to each other.
Referring to fig. 4, an embodiment of the present application discloses an association relation determining apparatus, including:
a memory 401 for storing a computer program;
a processor 402 for executing said computer program for implementing the method disclosed in any of the embodiments described above.
In the following, a readable storage medium provided by an embodiment of the present application is introduced, and a readable storage medium described below and an association relationship determination method, apparatus, and device described above may be referred to each other.
A readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the association relationship determination method disclosed in the foregoing embodiments. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the foregoing embodiments, which are not described herein again.
References in this application to "first," "second," "third," "fourth," etc., if any, are intended to distinguish between similar elements and not necessarily to describe a particular order or sequence. It will be appreciated that the data so used may be interchanged under appropriate circumstances such that the embodiments described herein may be practiced otherwise than as specifically illustrated or described herein. Furthermore, the terms "comprises" and "comprising," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, or apparatus.
It should be noted that the descriptions in this application referring to "first", "second", etc. are for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In addition, technical solutions between various embodiments may be combined with each other, but must be realized by a person skilled in the art, and when the technical solutions are contradictory or cannot be realized, such a combination should not be considered to exist, and is not within the protection scope of the present application.
The embodiments are described in a progressive manner, each embodiment focuses on differences from other embodiments, and the same or similar parts among the embodiments are referred to each other.
The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in Random Access Memory (RAM), memory, Read Only Memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, a removable disk, a CD-ROM, or any other form of readable storage medium known in the art.
The principle and the implementation of the present application are explained herein by applying specific examples, and the above description of the embodiments is only used to help understand the method and the core idea of the present application; meanwhile, for a person skilled in the art, according to the idea of the present application, there may be variations in the specific embodiments and the application scope, and in summary, the content of the present specification should not be construed as a limitation to the present application.
Claims (10)
1. An association relation determination method, comprising:
acquiring all fault events generated in a storage cluster;
clustering analysis is carried out on the fault events by using a DBSCAN algorithm to obtain a plurality of target clusters;
adding an event description field for a fault event in each target cluster to obtain a plurality of target sets;
processing the plurality of target sets by using an Apriori algorithm to obtain a correlation result; the correlation result comprises: different fault events having an associative relationship.
2. The association relation determining method according to claim 1, wherein the performing cluster analysis on the fault event by using the DBSCAN algorithm to obtain a plurality of target clusters includes:
and extracting the generation time of each fault event, and performing cluster analysis on each fault event by using the DBSCAN algorithm with the generation time as a cluster center to obtain a plurality of target clusters.
3. The association relation determining method according to claim 2, wherein the performing cluster analysis on each fault event by using the DBSCAN algorithm to obtain a plurality of target clusters includes:
clustering analysis is carried out on each fault event by utilizing the DBSCAN algorithm to obtain a plurality of intermediate clusters;
and deleting the intermediate clusters with the number of events lower than a preset density threshold value from all the intermediate clusters to obtain the plurality of target clusters.
4. The association relationship determining method according to claim 1, wherein the adding an event description field to the fault event in each target cluster to obtain a plurality of target sets comprises:
and adding an event description field for the fault event in each target cluster according to the event fault type to obtain a plurality of target sets.
5. The method according to claim 1, wherein the processing the plurality of target sets by using Apriori algorithm to obtain the association result comprises:
dividing the fault events in each target set into a plurality of candidate subsets by using the Apriori algorithm;
determining the support degree and the confidence degree of each candidate subset;
and if the support degree and the confidence degree of any candidate subset meet preset conditions, determining the current candidate subset as the association result.
6. The method according to any one of claims 1 to 5, wherein the processing the plurality of target sets by using Apriori algorithm to obtain the association result further comprises:
acquiring a target fault event generated in the storage cluster;
determining an object fault event having an association relation with the target fault event according to the association result;
and generating and displaying a prompt message containing the object fault event and the target fault event.
7. The association relationship determination method according to claim 6, wherein after generating and presenting the prompt message containing the object fault event and the target fault event, the method further comprises:
and sending the prompt message to a preset management terminal.
8. An association relationship determination apparatus, comprising:
the acquisition module is used for acquiring all fault events generated in the storage cluster;
the clustering module is used for clustering and analyzing the fault events by utilizing a DBSCAN algorithm to obtain a plurality of target clusters;
the adding module is used for adding an event description field for the fault event in each target cluster to obtain a plurality of target sets;
the processing module is used for processing the plurality of target sets by using an Apriori algorithm to obtain a correlation result; the correlation result comprises: different fault events having an associative relationship.
9. An association relationship determination device characterized by comprising:
a memory for storing a computer program;
a processor for executing the computer program to implement the association relation determination method according to any one of claims 1 to 7.
10. A readable storage medium storing a computer program, wherein the computer program when executed by a processor implements the association determination method according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911367789.3A CN111143103A (en) | 2019-12-26 | 2019-12-26 | Incidence relation determining method, device, equipment and readable storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911367789.3A CN111143103A (en) | 2019-12-26 | 2019-12-26 | Incidence relation determining method, device, equipment and readable storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN111143103A true CN111143103A (en) | 2020-05-12 |
Family
ID=70520433
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911367789.3A Withdrawn CN111143103A (en) | 2019-12-26 | 2019-12-26 | Incidence relation determining method, device, equipment and readable storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111143103A (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112463847A (en) * | 2020-10-30 | 2021-03-09 | 深圳市安云信息科技有限公司 | Fault correlation analysis method and device based on time sequence data |
| CN113505018A (en) * | 2021-07-27 | 2021-10-15 | 联想(北京)有限公司 | Interference process detection method and device and electronic equipment |
| CN117573428A (en) * | 2023-11-08 | 2024-02-20 | 安徽鼎甲计算机科技有限公司 | Disaster recovery backup method, device, computer equipment and storage medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103812719A (en) * | 2012-11-12 | 2014-05-21 | 华为技术有限公司 | Failure prediction method and device for cluster system |
| CN106909664A (en) * | 2017-02-28 | 2017-06-30 | 国网福建省电力有限公司 | A kind of power equipment data stream failure recognition methods |
| CN109358602A (en) * | 2018-10-23 | 2019-02-19 | 山东中创软件商用中间件股份有限公司 | A kind of failure analysis methods, device and relevant device |
| CN110351150A (en) * | 2019-07-26 | 2019-10-18 | 中国工商银行股份有限公司 | Fault rootstock determines method and device, electronic equipment and readable storage medium storing program for executing |
-
2019
- 2019-12-26 CN CN201911367789.3A patent/CN111143103A/en not_active Withdrawn
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103812719A (en) * | 2012-11-12 | 2014-05-21 | 华为技术有限公司 | Failure prediction method and device for cluster system |
| CN106909664A (en) * | 2017-02-28 | 2017-06-30 | 国网福建省电力有限公司 | A kind of power equipment data stream failure recognition methods |
| CN109358602A (en) * | 2018-10-23 | 2019-02-19 | 山东中创软件商用中间件股份有限公司 | A kind of failure analysis methods, device and relevant device |
| CN110351150A (en) * | 2019-07-26 | 2019-10-18 | 中国工商银行股份有限公司 | Fault rootstock determines method and device, electronic equipment and readable storage medium storing program for executing |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112463847A (en) * | 2020-10-30 | 2021-03-09 | 深圳市安云信息科技有限公司 | Fault correlation analysis method and device based on time sequence data |
| CN113505018A (en) * | 2021-07-27 | 2021-10-15 | 联想(北京)有限公司 | Interference process detection method and device and electronic equipment |
| CN117573428A (en) * | 2023-11-08 | 2024-02-20 | 安徽鼎甲计算机科技有限公司 | Disaster recovery backup method, device, computer equipment and storage medium |
| CN117573428B (en) * | 2023-11-08 | 2024-05-07 | 安徽鼎甲计算机科技有限公司 | Disaster recovery backup method, device, computer equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11710131B2 (en) | Method and apparatus of identifying a transaction risk | |
| US11675672B2 (en) | Automation and optimization of data recovery after a ransomware attack | |
| US8423616B2 (en) | Identifying and correlating electronic mail messages | |
| US11640349B2 (en) | Real time application error identification and mitigation | |
| CN111143103A (en) | Incidence relation determining method, device, equipment and readable storage medium | |
| US10263833B2 (en) | Root cause investigation of site speed performance anomalies | |
| US20170155570A1 (en) | Analysis of site speed performance anomalies caused by server-side issues | |
| Ying et al. | An improved KNN-based efficient log anomaly detection method with automatically labeled samples | |
| US20210133742A1 (en) | Detection of security threats in a network environment | |
| CN113992340B (en) | User abnormal behavior identification method, device, equipment and storage medium | |
| CN112579327A (en) | Fault detection method, device and equipment | |
| CN113641526A (en) | Alarm root cause positioning method and device, electronic equipment and computer storage medium | |
| US11182267B2 (en) | Methods and systems to determine baseline event-type distributions of event sources and detect changes in behavior of event sources | |
| CN110942314A (en) | Abnormal account supervision method and device | |
| CN116071133A (en) | Cross-border electronic commerce environment analysis method and system based on big data and computing equipment | |
| CN115659045A (en) | User operation identification method and device, storage medium and electronic equipment | |
| US11621966B1 (en) | Detection of malicious user accounts of an online service using feature analysis | |
| CN114547406A (en) | Data monitoring method, system, storage medium and electronic device | |
| JP2008171282A (en) | Optimal parameter search program, device and method | |
| CN113468029A (en) | Log management method and device, electronic equipment and readable storage medium | |
| CN114756401B (en) | Abnormal node detection method, device, equipment and medium based on log | |
| CN117234429B (en) | Writing-in and erasing speed analysis method and device for memory chip | |
| CN113032242B (en) | Data marking method and device, computer storage medium and electronic equipment | |
| CN113590558A (en) | Log correlation analysis method and device, storage medium and equipment | |
| CN116302652A (en) | System alarm information processing method and device and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WW01 | Invention patent application withdrawn after publication |
Application publication date: 20200512 |
|
| WW01 | Invention patent application withdrawn after publication |