CN112054915B - Processing method, device and system for client exception pre-warning and computing equipment - Google Patents
Processing method, device and system for client exception pre-warning and computing equipment Download PDFInfo
- Publication number
- CN112054915B CN112054915B CN201910492629.5A CN201910492629A CN112054915B CN 112054915 B CN112054915 B CN 112054915B CN 201910492629 A CN201910492629 A CN 201910492629A CN 112054915 B CN112054915 B CN 112054915B
- Authority
- CN
- China
- Prior art keywords
- page
- abnormal
- log
- business object
- client
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
Abstract
The embodiment of the invention discloses a processing method for early warning of abnormality of a client, which comprises the following steps: acquiring log information reported by a client, wherein the log information comprises an abnormal log and a service object corresponding to the abnormal log; based on the log information, counting the abnormal log quantity of the pages corresponding to the business objects in a preset time period; and judging whether to send out early warning or not based on the number of the abnormal logs and the access quantity of the page corresponding to the business object in the preset time period. The embodiment of the invention also discloses a corresponding device, a system and a computing device for processing the abnormal early warning of the client.
Description
Technical Field
The present invention relates to the field of data processing technologies, and in particular, to a method, an apparatus, a system, and a computing device for processing an anomaly early warning of a client.
Background
With the rapid development of the internet and the widespread use of mobile terminals, users are increasingly accustomed to processing daily transactions through various clients. In the face of a huge number of users, monitoring and early warning of abnormality of the client are very necessary to maintain stable availability of the client.
The common method for processing the abnormality early warning of the client is to perform log embedding on a code logic link to be monitored, so that logs which correspond to the success or failure of each step can be collected and recorded, and the abnormality of the client is monitored and early warned based on the logs. However, this method often needs to add information such as a module or a page corresponding to the log when the log is collected. That is, any link that makes a log entry requires additional input of this information, and this additional code can be more intrusive to the link logic. In addition, the common abnormal early warning processing mode of the client side mainly carries out early warning on pages and lacks early warning on special business objects.
Therefore, it is desirable to provide a more advanced client exception pre-alarm handling scheme to monitor clients.
Disclosure of Invention
Therefore, the embodiment of the invention provides a processing method, a processing device, a processing system and a computing device for early warning of client abnormality, so as to solve or at least alleviate at least one of the problems.
According to an aspect of the embodiment of the present invention, there is provided a method for processing abnormal early warning of a client, including: acquiring log information reported by a client, wherein the log information comprises an abnormal log and a service object corresponding to the abnormal log; based on the log information, counting the abnormal log quantity of the pages corresponding to the business objects in a preset time period; and judging whether to send out early warning or not based on the number of the abnormal logs and the access quantity of the page corresponding to the business object in the preset time period.
Optionally, in the method according to an embodiment of the present invention, further includes: determining a business object corresponding page according to the abnormal log corresponding page; and counting the access quantity of the corresponding page of the business object in the preset time period.
According to another aspect of the embodiment of the present invention, there is provided a method for processing abnormal early warning of a client, including: acquiring log information reported by a client, wherein the log information comprises an abnormal log; based on log information, counting the number of abnormal logs of pages in a preset time period; and judging whether to send out early warning or not based on the number of the abnormal logs of the pages and the access quantity of the pages in a preset time period.
According to another aspect of the embodiment of the present invention, there is provided a processing apparatus for early warning of abnormality of a client, including: the log acquisition unit is suitable for acquiring log information reported by the client, wherein the log information comprises an abnormal log and a service object corresponding to the abnormal log; the data statistics unit is suitable for counting the abnormal log quantity of the pages corresponding to the business objects in a preset time period based on the log information; and the early warning judging unit is suitable for judging whether to send out early warning or not based on the number of the abnormal logs and the access quantity of the corresponding pages of the business objects in the preset time period.
According to another aspect of the embodiment of the present invention, there is provided a processing apparatus for early warning of abnormality of a client, including: the log acquisition unit is suitable for acquiring log information reported by the client, wherein the log information comprises abnormal logs; the data statistics unit is suitable for counting the abnormal log quantity of the pages in a preset time period based on the log information; and the early warning judging unit is suitable for judging whether to send out early warning or not based on the number of the abnormal logs of the page and the access quantity of the page in a preset time period.
According to another aspect of the embodiment of the invention, a processing system for early warning of abnormality of a client is provided, which comprises the client and a server, wherein the server resides with a processing device for early warning of abnormality of the client according to the embodiment of the invention, and the client is suitable for providing pages; the method is also suitable for collecting an abnormal log and establishing a corresponding relation between the abnormal log and the current page of the client; the method is also suitable for sending log information to the server, wherein the log information comprises an abnormal log, a business object corresponding to the abnormal log and a page corresponding to the abnormal log.
According to another aspect of an embodiment of the present invention, there is provided a computing device including: one or more processors; and a memory; one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including instructions for performing a processing method for client exception pre-warning according to an embodiment of the present invention
According to yet another aspect of embodiments of the present invention, there is provided a computer-readable storage medium storing one or more programs, the one or more programs including instructions, which when executed by a computing device, cause the computing device to perform a method of handling client exception pre-warning according to embodiments of the present invention.
According to the processing scheme of the client abnormality early warning, the abnormality log is corresponding to the page, so that the invasiveness to the link logic of the client is greatly reduced. And the monitoring and early warning of the client in the dimension of the business object are realized through the exception log corresponding to the business object. In addition, the monitoring and early warning can be performed in the page dimension. Therefore, the dimension of the business object and the dimension of the page can be mutually evidence and combined, and the accuracy and the credibility of early warning are obviously improved.
By monitoring the abnormal ratio instead of the change of the abnormal quantity, inaccuracy in judgment of the quantity change is avoided, and the accuracy and the reliability of early warning are further improved.
Drawings
To the accomplishment of the foregoing and related ends, certain illustrative aspects are described herein in connection with the following description and the annexed drawings, which set forth the various ways in which the principles disclosed herein may be practiced, and all aspects and equivalents thereof are intended to fall within the scope of the claimed subject matter. The above, as well as additional objects, features, and advantages of the present disclosure will become more apparent from the following detailed description when read in conjunction with the accompanying drawings. Like reference numerals generally refer to like parts or elements throughout the present disclosure.
FIG. 1 shows a schematic diagram of a client-side exception pre-warning processing system 100, according to one embodiment of the invention;
FIG. 2 shows a schematic diagram of a computing device 200 according to one embodiment of the invention;
FIG. 3 illustrates a flow chart of a method 300 of handling client exception pre-warning according to one embodiment of the invention;
FIG. 4 shows a block diagram of a processing apparatus 400 for client exception pre-warning according to one embodiment of the invention;
FIG. 5 illustrates a flow chart of a method 500 of handling client exception pre-warning according to one embodiment of the invention; and
fig. 6 shows a block diagram of a processing apparatus 600 for client exception pre-warning according to an embodiment of the present invention.
Detailed Description
Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.
Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.
FIG. 1 shows a schematic diagram of a client-side exception pre-warning processing system 100, according to one embodiment of the invention. As shown in fig. 1, the anomaly early warning system 100 includes a client 110 and a server 120. Client 110 typically resides in a mobile terminal and may provide pages for viewing and manipulation by a user. Typically, in order to monitor the performance of the client 110, a log embedding point may be performed on the code logic link to be monitored to collect the corresponding log.
Conventionally, when a log is acquired, a module or page information corresponding to the log is often required to be acquired to record in the log. Thus, any link that collects logs needs to deploy a service code for additional acquisition of this information, which is somewhat intrusive to the link logic.
According to an embodiment of the present invention, the client 110 may collect an exception log, and establish a correspondence between the exception log and a current page of the client 110 (i.e., a page currently accessed by a user). That is, the business code for acquiring the page information is not required to be added when the log is buried, so that the invasiveness to the link logic of the client is greatly reduced. Wherein the exception log may generally indicate the occurrence of an exception event. For example, the exception log may have an exception identification (tag) that identifies the type of exception event. Thus, the page corresponding to the exception log can be determined that the page has the exception event indicated by the exception log.
In one embodiment, the client 110 may maintain a list of page accesses based on the presence and absence of pages accessed by the user via the client 110. The page access list records each page to be accessed and the access order of each page. Wherein the current page defaults to the latest record in the page access list.
For example, if the user accesses page a, page B, and page C sequentially, the maintained page access list may be as follows:
| page identification |
| C |
| B |
| A |
The uppermost layer is the current page of the latest record, namely the page C currently accessed by the user. The bottommost layer is page a that the user originally accessed.
Thus, when the abnormal log is collected, the abnormal log and the current page can be established with a corresponding relation, so that the current page is indicated to have an abnormal event. The page information is acquired almost without trace while the page information is prevented from being added in the log, so that the invasiveness to the link logic of the client is greatly reduced.
Furthermore, in addition to focusing on anomalies for a particular page, embodiments according to the present invention focus on anomalies for some business objects (e.g., some specialized business items). These business objects typically involve multiple pages, for example, the collection business items may involve collection pages for merchandise, collection pages for stores, collection pages for orders, and so forth. Special monitoring and pre-warning of these business objects is required.
Therefore, in the embodiment of the present invention, when the client 110 collects the exception log, the client may also obtain the service object corresponding to the exception log, so as to monitor and early warn the service object. The business object corresponding to the abnormal log can be directly configured when the log is buried. It should be noted that the configuration of the business objects is not intrusive to the client link logic.
After the client 110 collects the abnormal log, log information may be transmitted to the server 120, so that the server 120 monitors and pre-warns the client 110 based on the log information. It may be understood that the log information includes an exception log, a service object corresponding to the exception log, and may further include a page corresponding to the exception log.
Specifically, a processing device 400 for client anomaly pre-warning resides in the server 120 and may communicate with the client 110 over one or more networks 130, such as a Local Area Network (LAN) or a Wide Area Network (WAN). According to an embodiment of the present invention, the processing apparatus 400 for client anomaly pre-warning may be implemented by the computing device 200 as described below.
FIG. 2 shows a schematic diagram of a computing device 200 according to one embodiment of the invention. As shown in FIG. 2, in a basic configuration 202, computing device 200 typically includes a system memory 206 and one or more processors 204. A memory bus 208 may be used for communication between the processor 204 and the system memory 206.
Depending on the desired configuration, the processor 204 may be any type of processing including, but not limited to: a microprocessor (μp), a microcontroller (μc), a digital information processor (DSP), or any combination thereof. Processor 204 may include one or more levels of cache, such as a first level cache 210 and a second level cache 212, a processor core 214, and registers 216. The example processor core 214 may include an Arithmetic Logic Unit (ALU), a Floating Point Unit (FPU), a digital signal processing core (DSP core), or any combination thereof. The example memory controller 218 may be used with the processor 204, or in some implementations, the memory controller 218 may be an internal part of the processor 204.
Depending on the desired configuration, system memory 206 may be any type of memory including, but not limited to: volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.), or any combination thereof. The system memory 206 may include an operating system 220, one or more applications 222, and program data 224. In some implementations, the application 222 may be arranged to execute instructions on an operating system by the one or more processors 204 using the program data 224.
Computing device 200 may also include an interface bus 240 that facilitates communication from various interface devices (e.g., output devices 242, peripheral interfaces 244, and communication devices 246) to basic configuration 202 via bus/interface controller 230. The example output device 242 includes a graphics processing unit 248 and an audio processing unit 250. They may be configured to facilitate communication with various external devices, such as a display or speakers, via one or more a/V ports 252. The example peripheral interface 244 may include a serial interface controller 254 and a parallel interface controller 256, which may be configured to facilitate communication via one or more I/O ports 258 and external devices such as input devices (e.g., keyboard, mouse, pen, voice input device, touch input device) or other peripherals (e.g., printer, scanner, etc.). The example communication device 246 may include a network controller 260 that may be arranged to facilitate communication with one or more other computing devices 262 over a network communication link via one or more communication ports 264.
The network communication link may be one example of a communication medium. Communication media may typically be embodied by computer readable instructions, data structures, program modules, and may include any information delivery media in a modulated data signal, such as a carrier wave or other transport mechanism. A "modulated data signal" may be a signal that has one or more of its data set or changed in such a manner as to encode information in the signal. By way of non-limiting example, communication media may include wired media such as a wired network or special purpose network, and wireless media such as acoustic, radio Frequency (RF), microwave, infrared (IR) or other wireless media. The term computer readable media as used herein may include both storage media and communication media.
Computing device 200 may be implemented as a server, such as a database server, an application server, a WEB server, etc., or as a personal computer including desktop and notebook computer configurations. Of course, computing device 200 may also be implemented as part of a small-sized portable (or mobile) electronic device.
In an embodiment according to the present invention, the computing device 200 is implemented as each component in the processing apparatus 400 of the client exception pre-warning and is configured to perform the processing method 300 of the client exception pre-warning according to an embodiment of the present invention. The application 222 of the computing device 200 includes a plurality of instructions for executing the processing method 300 for client exception pre-warning according to an embodiment of the present invention, and the program data 224 may also store configuration information of the client exception pre-warning processing system 100, etc.
FIG. 3 illustrates a flow chart of a method 300 of handling client exception pre-warning in accordance with one embodiment of the invention. The abnormality pre-warning method 300 is executed in the processing device 400 for client abnormality pre-warning. As shown in fig. 3, the processing method 300 of the client exception pre-warning starts in step S310.
In step S310, log information reported by the client 110 is obtained, where the log information may include an abnormal log and a service object corresponding to the abnormal log. As described previously, the exception log corresponds to a page of the client 110 and may indicate the occurrence of an exception event. Therefore, through the exception log and the page corresponding to the exception log, the occurrence of the exception event indicated by the exception log on the page can be determined. Among other things, the exception event may be an abnormal event such as a page element (picture or script) loading exception, page interaction logic exception, etc. when a user browses or operates on a page. The invention is not limited by the specific type and content of the exception event.
Then, in step S320, based on the log information, the number of abnormal logs of the corresponding page of the service object in the predetermined period is counted. The length of the predetermined period of time may be specifically set according to the specific case, and may be set to several seconds or several minutes, for example.
Specifically, the page corresponding to the business object may be determined according to the page corresponding to the exception log. And counting the number of abnormal logs of the page corresponding to the service object. The number of exception logs for the page corresponding to the business object may describe the number of exception events occurring for the page corresponding to the business object.
Finally, in step S330, it is determined whether to issue an early warning based on the number of abnormal logs of the page corresponding to the business object in the predetermined period and the access amount of the page corresponding to the business object in the predetermined period.
According to one embodiment of the present invention, before step S330, the access amount (Page View) of the corresponding Page of the service object in the predetermined period may be counted.
After the access amount of the business object corresponding page in the predetermined period is obtained through statistics, in some embodiments, the abnormal ratio of the business object in the predetermined period may be calculated according to the number of abnormal logs of the business object corresponding page in the predetermined period and the access amount of the business object corresponding page in the predetermined period. Then, whether to send out early warning is judged based on the abnormal ratio of the business object. It will be appreciated that the anomaly rate of a business object may describe the rate at which anomaly events occur for the corresponding page of the business object.
In some embodiments, the number of the abnormality logs of the page corresponding to the business object in the predetermined period of time obtained by statistics is divided by the access amount of the page corresponding to the business object in the predetermined period of time, so as to obtain the abnormality ratio of the business object.
It should be noted that the business object may be a single business object or may be a plurality of business objects. That is, a single business object may be monitored, or multiple business objects may be monitored simultaneously.
In addition, since the abnormal events can be of various types, the business object can also be monitored for one or more types of abnormal events.
According to one embodiment of the present invention, the anomaly ratio of a business object may be an anomaly ratio of the business object for at least one type of anomaly event. Specifically, the number of the abnormal logs, which are corresponding to the pages of the business object and indicate at least one type of abnormal event, in the preset time period can be counted, and then the abnormal ratio of the business object to the at least one type of abnormal event in the preset time period is calculated according to the number of the abnormal logs, which are corresponding to the pages of the business object and indicate the at least one type of abnormal event, in the preset time period and the access amount of the pages corresponding to the business object in the preset time period. Finally, whether to send out early warning is judged based on the abnormal ratio of the business object aiming at least one kind of abnormal event. The anomaly rate of a business object for at least one type of anomaly event may describe the rate at which the at least one type of anomaly event occurs for a page to which the business object corresponds.
For example, it is necessary to monitor the situation of two types of abnormal events, namely, picture loading errors and script loading errors, of the business object. Therefore, firstly, determining the abnormal logs which are corresponding to the page of the business object and indicate the picture loading errors and the script loading errors in a preset time period, and counting the quantity of the abnormal logs. And then, calculating the abnormal ratio of the business object to the picture loading error and the script loading error in the preset time period, and judging whether to send out early warning or not based on the abnormal ratio.
After the abnormal ratio of the service object in the predetermined period is calculated, the abnormal ratio of the service object in the predetermined period can be compared with the corresponding historical average value and/or the predetermined threshold value, and whether to send out early warning is judged based on the comparison result.
Typically, abnormality logs for a plurality of predetermined time periods may be continuously or discontinuously collected to calculate an abnormality ratio of the business object for each predetermined time period. For example, the anomaly ratio for business objects within 5 minutes may be calculated every 5 minutes. In this way, the corresponding historical average may be calculated based on the anomaly ratio for each predetermined period of time preceding the current predetermined period of time. The respective predetermined threshold value may then be set based on the respective historical average.
It will be appreciated that, under normal circumstances, the anomaly rates of traffic objects for the same type of anomaly event should tend to agree within each predetermined period of time. Thus, in some embodiments, an early warning is issued if the abnormal ratio of the business object is greater than a predetermined change threshold value as compared to the corresponding historical average and/or the change value of the predetermined threshold value. If the preset change threshold value is not greater than the preset change threshold value, no early warning is sent out.
According to another embodiment of the present invention, the abnormal ratio of the business object in the predetermined period may be compared with the abnormal ratio of the business object in the previous predetermined period, and whether to issue the early warning may be determined based on the comparison result. And sending out early warning if the variation value of the abnormal ratio of the business object in the preset time period is larger than a preset variation threshold value compared with the variation value of the abnormal ratio of the business object in the previous preset time period. If the preset change threshold value is not greater than the preset change threshold value, no early warning is sent out.
In some embodiments, in the case of determining to send out the early warning, the responsible party of the service object may be determined first, and then the early warning may be sent out to the responsible party. The pre-warning may include information about the business object regarding anomaly rates. Wherein the pre-warning may be sent via a variety of transmission channels, such as a communication number, instant messaging software, or mail, etc. The invention does not limit the sending channel of the early warning.
Of course, besides monitoring and early warning in the dimension of the business object, monitoring and early warning can be performed in the dimension of the page, so that the dimension of the business object and the dimension of the page can be mutually evidence and combined, and the accuracy and the reliability of early warning are improved.
According to the embodiment of the invention, for the page of the client, based on the log information, the number of the abnormal logs of the page in the preset time period can be counted, and whether to send out early warning is judged based on the number of the abnormal logs of the page and the access amount of the page in the preset time period.
Specifically, the abnormality ratio of the page in the predetermined period may be calculated from the number of abnormality logs of the page in the predetermined period and the access amount of the page in the predetermined period. The anomaly rate of a page may describe the rate at which the anomaly event occurs to the page. Then, whether to send out an early warning is judged based on the abnormal ratio of the page.
In some embodiments, the number of abnormality logs for the page in the predetermined period of time obtained by statistics is divided by the access amount of the page in the predetermined period of time, so as to obtain the abnormality ratio of the page in the predetermined period of time.
It should be noted that the page may be a single page or may be a plurality of pages. That is, anomalies of a single page may be monitored, or anomalies of multiple pages may be monitored simultaneously.
Further, similarly to the business object dimension, since the exception event may be of multiple types, the page may also be monitored for one or more types of exception events.
According to one embodiment of the invention, the anomaly rate of a page may be an anomaly rate of the page for at least one type of anomaly event. Specifically, the number of the abnormality logs indicating at least one type of abnormality event of the page in the predetermined period of time can be counted, and then the abnormality ratio of the page to the at least one type of abnormality event in the predetermined period of time is calculated according to the number of the abnormality logs indicating the at least one type of abnormality event of the page in the predetermined period of time and the access amount of the page in the predetermined period of time. Finally, whether to send out early warning is judged based on the abnormal ratio of the page aiming at least one type of abnormal event. The anomaly rate of a page for at least one type of anomaly event may describe the rate at which the page occurs for the at least one type of anomaly event.
For example, it is necessary to monitor the page for two types of abnormal events, namely picture loading errors and script loading errors. Therefore, firstly, determining the abnormal logs of the page, indicating the picture loading errors and the script loading errors, and counting the number of the abnormal logs. And then, calculating the abnormal ratio of the page to the picture loading error and the script loading error in a preset time period, and judging whether to send out early warning or not based on the abnormal ratio.
After obtaining the abnormality ratio of the page in the predetermined period, the abnormality ratio of the page may be compared with a corresponding historical average and/or a predetermined threshold, and whether to issue an early warning may be determined based on the comparison result.
Typically, anomaly logs for a plurality of predetermined time periods may be collected continuously or discontinuously to calculate anomaly ratios for pages within the respective predetermined time periods. For example, the anomaly rate for a page within 5 minutes may be calculated every 5 minutes. In this way, the corresponding historical average may be calculated based on the anomaly ratios of the pages for each predetermined period of time prior to the current predetermined period of time. The respective predetermined threshold value may then be set based on the respective historical average.
It will be appreciated that the anomaly rate of pages with respect to the same type of anomaly should normally be consistent over each predetermined period of time. Thus, in some embodiments, an early warning is issued if the variation value of the anomaly ratio of the page as compared to the corresponding historical average and/or the predetermined threshold is greater than the predetermined variation threshold. If the preset change threshold value is not greater than the preset change threshold value, no early warning is sent out.
According to another embodiment of the present invention, the abnormality ratio of the page in the predetermined period may be compared with the abnormality ratio of the page in the previous predetermined period, and whether or not to issue the warning may be determined based on the comparison result. And if the variation value of the abnormality ratio of the page in the preset time period is larger than the preset variation threshold value compared with the abnormality ratio of the page in the previous preset time period, sending out early warning. If the preset change threshold value is not greater than the preset change threshold value, no early warning is sent out.
The specific process of sending out the early warning in the page dimension is similar to the early warning process in the business object dimension described above, and will not be repeated here.
Fig. 4 shows a block diagram of a processing apparatus 400 for client exception pre-warning according to an embodiment of the present invention. As shown in fig. 4, the processing apparatus 400 for client anomaly early warning may include a log acquisition unit 410, a data statistics unit 420, and an early warning judgment unit 430.
The log obtaining unit 410 is adapted to obtain log information reported by the client 110, where the log information includes an abnormal log and a service object corresponding to the abnormal log. In some embodiments, the log information may also include pages corresponding to the exception log. The data statistics unit 420 is connected to the log obtaining unit 410, and is adapted to count the number of abnormal logs of the corresponding pages of the business object in the predetermined period of time based on the log information. The early warning judging unit 430 is connected to the data statistics unit 420, and is adapted to judge whether to send out an early warning based on the number of abnormal logs of the page corresponding to the business object in the predetermined period and the access amount of the page corresponding to the business object in the predetermined period.
For detailed processing logic and implementation procedures of each unit in the processing 400 of the client exception pre-warning, reference may be made to the related description of the processing method 300 of the client exception pre-warning in conjunction with fig. 1-3, which is not repeated herein.
FIG. 5 illustrates a block diagram of a method 500 for handling client-side anomaly early warning in accordance with one embodiment of the present invention. The method 500 for processing the client abnormality pre-warning may be executed in the apparatus 600 for processing the client abnormality pre-warning. It should be noted that the processing method 500 of client exception pre-warning monitors and pre-warns the client 110 in the page dimension in a manner that is less intrusive to the client 110 code logic.
As shown in fig. 5, the processing method 500 of the client anomaly early warning starts in step S510. In step S510, the acquiring client 110 acquires log information reported by the client, where the log information includes an abnormal log. The exception log corresponds to a page of the client 110 and may indicate the occurrence of an exception event. Then, in step 520, based on the log information, the number of abnormal logs of the page in the predetermined period is counted. Finally, in step S530, it is determined whether to issue an early warning based on the number of abnormal logs of the page in the predetermined period and the access amount of the page in the predetermined period.
For detailed processing logic and implementation procedures of each step in the processing method 500 for client exception pre-warning, reference may be made to the related description of the processing method 300 for client exception pre-warning in conjunction with fig. 1-3, which is not repeated here.
Accordingly, fig. 6 shows a block diagram of a processing apparatus 600 for client exception pre-warning according to an embodiment of the present invention. As shown in fig. 6, the processing apparatus 600 for client anomaly early warning may include a log acquisition unit 610, a data statistics unit 620, and an early warning judgment unit 630.
The log obtaining unit 610 is adapted to obtain log information reported by the client 110, where the log information includes an abnormal log. The data statistics unit 620 is connected to the log obtaining unit 610, and is adapted to count the number of abnormal logs of the page in a predetermined period of time based on the above log information. The early warning judging unit 630 is connected to the data statistics unit 620, and is adapted to judge whether to send out an early warning based on the number of abnormal logs of the page in the predetermined period and the access amount of the page in the predetermined period.
For detailed processing logic and implementation procedures of each unit in the processing apparatus 600 for client exception pre-warning, refer to the relevant description of the processing method 300 for client exception pre-warning in conjunction with fig. 1-3, which is not repeated here.
In summary, according to the processing scheme of the client exception pre-warning in the embodiment of the invention, the invasiveness to the link logic of the client is greatly reduced by corresponding the exception log to the page. And the monitoring and early warning of the client in the dimension of the business object are realized through the exception log corresponding to the business object. In addition, the monitoring and early warning can be performed on the page dimension, so that the business object dimension and the page dimension can be mutually evidence and combined, and the accuracy and the reliability of early warning are improved.
The abnormal quantity can be normalized by monitoring the abnormal ratio instead of the abnormal quantity alone, so that inaccuracy in judgment on the change of the abnormal quantity alone is avoided, and the accuracy and the reliability of early warning are further improved.
It should be appreciated that in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the disclosure and aiding in the understanding of one or more of the various inventive aspects. However, the disclosed method should not be construed as reflecting the intention that: i.e., the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of this invention.
Those skilled in the art will appreciate that the modules or units or components of the devices in the examples disclosed herein may be arranged in a device as described in this embodiment, or alternatively may be located in one or more devices different from the devices in this example. The modules in the foregoing examples may be combined into one module or may be further divided into a plurality of sub-modules.
Those skilled in the art will appreciate that the modules in the apparatus of the embodiments may be adaptively changed and disposed in one or more apparatuses different from the embodiments. The modules or units or components of the embodiments may be combined into one module or unit or component and, furthermore, they may be divided into a plurality of sub-modules or sub-units or sub-components. Any combination of all features disclosed in this specification (including any accompanying claims, abstract and drawings), and all of the processes or units of any method or apparatus so disclosed, may be used in combination, except insofar as at least some of such features and/or processes or units are mutually exclusive. Each feature disclosed in this specification (including any accompanying claims, abstract and drawings), may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.
Furthermore, those skilled in the art will appreciate that while some embodiments described herein include some features but not others included in other embodiments, combinations of features of different embodiments are meant to be within the scope of the invention and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.
Furthermore, some of the embodiments are described herein as methods or combinations of method elements that may be implemented by a processor of a computer system or by other means of performing the functions. Thus, a processor with the necessary instructions for implementing the described method or method element forms a means for implementing the method or method element. Furthermore, the elements of the apparatus embodiments described herein are examples of the following apparatus: the apparatus is for carrying out the functions performed by the elements for carrying out the objects of the invention.
As used herein, unless otherwise specified the use of the ordinal terms "first," "second," "third," etc., to describe a general object merely denote different instances of like objects, and are not intended to imply that the objects so described must have a given order, either temporally, spatially, in ranking, or in any other manner.
While the invention has been described with respect to a limited number of embodiments, those skilled in the art, having benefit of the above description, will appreciate that other embodiments are contemplated within the scope of the invention as described herein. Furthermore, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter. Accordingly, many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is intended to be illustrative, but not limiting, of the scope of the invention, which is defined by the appended claims.
Claims (11)
1. A processing method for early warning of client abnormality comprises the following steps:
acquiring log information reported by a client, wherein the log information comprises an abnormal log and a service object corresponding to the abnormal log;
based on the log information, counting the abnormal log quantity of the pages corresponding to the business objects in a preset time period; and
based on the number of the abnormal logs and the access amount of the corresponding pages of the business objects in the preset time period, judging whether to send out early warning,
the judging whether to send out the early warning based on the abnormal log number and the access amount of the page corresponding to the business object in the preset time period comprises the following steps:
comparing the abnormal ratio of the business object or the given page with a corresponding historical average value, wherein the abnormal ratio of the business object is calculated according to the abnormal log quantity and the access quantity of the page corresponding to the business object in the preset time period, or the abnormal ratio of the given page is calculated according to the abnormal log quantity of the given page and the access quantity of the given page in the preset time period, and the given page is a single page in the page corresponding to the business object;
and if the variation value of the abnormal ratio of the business object or the given page compared with the corresponding historical average value is larger than a preset variation threshold value, sending out early warning.
2. The method of claim 1, wherein the calculating the anomaly ratio of the business object according to the anomaly log number and the access amount of the corresponding page of the business object in the predetermined period of time comprises:
determining the page corresponding to the business object according to the page corresponding to the abnormal log;
counting the access quantity of the page corresponding to the business object in the preset time period;
and calculating the abnormal ratio of the business object in the preset time period according to the abnormal log quantity and the access quantity of the page corresponding to the business object in the preset time period.
3. The method of claim 1, wherein the calculating the anomaly ratio of the given page from the anomaly log number of the given page and the access amount of the given page in the predetermined period of time comprises:
based on the log information, counting the abnormal log quantity of the given page in the preset time period;
and calculating the abnormality ratio of the page in the preset time period according to the number of the abnormality logs of the given page and the access quantity of the given page in the preset time period.
4. The method of claim 1, wherein the anomaly log indicates occurrence of an anomaly event, the anomaly rate of the business object includes an anomaly rate of the business object for at least one type of anomaly event, and the step of counting the anomaly log number of the business object corresponding page in a predetermined period of time includes:
and counting the number of the abnormal logs, which correspond to the pages and indicate the at least one type of abnormal event, of the business object in the preset time period.
5. The method of claim 1, wherein the anomaly log indicates occurrence of an anomaly event, the anomaly rate for the given page includes an anomaly rate for at least one type of anomaly event for the given page, and the step of counting the number of anomaly logs for the given page over the predetermined period of time includes:
counting the number of the abnormal logs indicating the at least one type of abnormal event of the given page in the preset time period.
6. The method of claim 1, the step of issuing an alert comprising:
determining a responsible party of the business object or the given page;
and sending out early warning to the responsible party.
7. The method of claim 6, wherein the step of issuing an alert comprises:
the early warning is sent out through a communication number, instant messaging software or mail.
8. A processing device for early warning of abnormality of a client comprises:
the system comprises a log acquisition unit, a client and a server, wherein the log acquisition unit is suitable for acquiring log information reported by the client, and the log information comprises an abnormal log and a service object corresponding to the abnormal log;
the data statistics unit is suitable for counting the number of abnormal logs of the business object corresponding page in a preset time period and the access quantity of the business object corresponding page in the preset time period based on the log information, counting the number of abnormal logs of a given page and the access quantity of the given page in the preset time period, calculating to obtain the abnormal ratio of the business object according to the number of the abnormal logs and the access quantity of the business object corresponding page in the preset time period, and calculating to obtain the abnormal ratio of the given page according to the number of the abnormal logs of the given page and the access quantity of the given page in the preset time period, wherein the given page is a single page in the business object corresponding page; and
and the early warning judging unit is suitable for comparing the abnormal ratio of the business object or the given page with the corresponding historical average value, and sending out early warning when the change value of the abnormal ratio of the business object or the given page compared with the corresponding historical average value is larger than a preset change threshold value.
9. A processing system for client exception pre-warning, comprising a client and a server hosting the processing device for client exception pre-warning as defined in claim 8, wherein
The client is suitable for providing pages; the method is also suitable for collecting an abnormal log and establishing a corresponding relation between the abnormal log and the current page of the client; the method is also suitable for sending log information to the server, wherein the log information comprises an abnormal log, a business object corresponding to the abnormal log and a page corresponding to the abnormal log.
10. A computing device, comprising:
one or more processors; and
a memory;
one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs comprising instructions for performing any of the methods of processing of client anomaly pre-warning according to claims 1-7.
11. A computer readable storage medium storing one or more programs, the one or more programs comprising instructions, which when executed by a computing device, cause the computing device to perform any of the methods of processing of client anomaly pre-warning of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910492629.5A CN112054915B (en) | 2019-06-06 | 2019-06-06 | Processing method, device and system for client exception pre-warning and computing equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910492629.5A CN112054915B (en) | 2019-06-06 | 2019-06-06 | Processing method, device and system for client exception pre-warning and computing equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112054915A CN112054915A (en) | 2020-12-08 |
| CN112054915B true CN112054915B (en) | 2023-10-03 |
Family
ID=73608682
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910492629.5A Active CN112054915B (en) | 2019-06-06 | 2019-06-06 | Processing method, device and system for client exception pre-warning and computing equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112054915B (en) |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113127319A (en) * | 2021-04-06 | 2021-07-16 | 北京大米科技有限公司 | Information monitoring method, related device and computer storage medium |
| CN113746703B (en) * | 2021-09-03 | 2023-01-20 | 上海众源网络有限公司 | Abnormal link monitoring method, system and device |
| CN115982703B (en) * | 2023-03-22 | 2023-06-16 | 新兴际华集团财务有限公司 | User behavior data processing method, device, electronic equipment and computer readable medium |
| CN116846782B (en) * | 2023-08-31 | 2024-01-02 | 北京仁科互动网络技术有限公司 | Business anomaly observation method and device for mobile terminal of SAAS CRM system |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102752141A (en) * | 2012-06-29 | 2012-10-24 | 杭州迪普科技有限公司 | Method and device for detecting accessibility of IP (internet protocol) address |
| CN105468765A (en) * | 2015-12-03 | 2016-04-06 | 中国南方电网有限责任公司信息中心 | Multi-node web service anomaly detection method and system |
| CN107423194A (en) * | 2017-06-30 | 2017-12-01 | 阿里巴巴集团控股有限公司 | Front end abnormality alarming processing method, apparatus and system |
| CN107979477A (en) * | 2016-10-21 | 2018-05-01 | 苏宁云商集团股份有限公司 | A kind of method and system of business monitoring |
| CN108900339A (en) * | 2018-07-02 | 2018-11-27 | 阿里巴巴集团控股有限公司 | A kind of method, apparatus and electronic equipment for measuring quality of service |
-
2019
- 2019-06-06 CN CN201910492629.5A patent/CN112054915B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102752141A (en) * | 2012-06-29 | 2012-10-24 | 杭州迪普科技有限公司 | Method and device for detecting accessibility of IP (internet protocol) address |
| CN105468765A (en) * | 2015-12-03 | 2016-04-06 | 中国南方电网有限责任公司信息中心 | Multi-node web service anomaly detection method and system |
| CN107979477A (en) * | 2016-10-21 | 2018-05-01 | 苏宁云商集团股份有限公司 | A kind of method and system of business monitoring |
| CN107423194A (en) * | 2017-06-30 | 2017-12-01 | 阿里巴巴集团控股有限公司 | Front end abnormality alarming processing method, apparatus and system |
| CN108900339A (en) * | 2018-07-02 | 2018-11-27 | 阿里巴巴集团控股有限公司 | A kind of method, apparatus and electronic equipment for measuring quality of service |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112054915A (en) | 2020-12-08 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112054915B (en) | Processing method, device and system for client exception pre-warning and computing equipment | |
| CN106953740B (en) | Processing method, client, server and system for page access data in application | |
| US10581886B1 (en) | Computer system anomaly detection | |
| US10263833B2 (en) | Root cause investigation of site speed performance anomalies | |
| CN110377569B (en) | Log monitoring method, device, computer equipment and storage medium | |
| US9672242B2 (en) | System for automatically detecting abnormalities statistical data on usage, method therefor, and apparatus applied to same | |
| CN112148674B (en) | Log data processing method, device, computer equipment and storage medium | |
| WO2017113677A1 (en) | User behavior data processing method and system | |
| US20170155570A1 (en) | Analysis of site speed performance anomalies caused by server-side issues | |
| US7610172B2 (en) | Method and system for monitoring non-occurring events | |
| US9223672B1 (en) | Method and system for providing error repair status data to an application user | |
| CN113220540B (en) | Service management method, device, computer equipment and storage medium | |
| CN114996103A (en) | Page abnormity detection method and device, electronic equipment and storage medium | |
| CN111158926B (en) | Service request analysis method, device and equipment | |
| CN110807050B (en) | Performance analysis method, device, computer equipment and storage medium | |
| US20170154275A1 (en) | Statistical detection of site speed performance anomalies | |
| CN112130944A (en) | Page abnormity detection method, device, equipment and storage medium | |
| CN113127878A (en) | Risk assessment method and device for threat event | |
| CN115187364A (en) | Method and device for monitoring deposit risk under bank distributed scene | |
| US20120173495A1 (en) | Computer Readable Medium, Systems, and Methods of Detecting a Discrepancy in a Chain-of-title of an Asset | |
| CN114595765A (en) | Data processing method and device, electronic equipment and storage medium | |
| CN110677271B (en) | Big data alarm method, device, equipment and storage medium based on ELK | |
| CN113326064A (en) | Method for dividing business logic module, electronic equipment and storage medium | |
| CN113342619A (en) | Log monitoring method and system, electronic device and readable medium | |
| CN110825592A (en) | Method and computing device for generating alarm content |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20230721 Address after: No. 699, Wangshang Road, Binjiang District, Hangzhou, Zhejiang Applicant after: Alibaba (China) Network Technology Co.,Ltd. Address before: Grand Cayman capital building, a mailbox four / 847 Applicant before: ALIBABA GROUP HOLDING Ltd. |
|
| TA01 | Transfer of patent application right | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |