CN112988504B

CN112988504B - Alarm strategy setting method and device, electronic equipment and storage medium

Info

Publication number: CN112988504B
Application number: CN202110172766.8A
Authority: CN
Inventors: 江杰; 李勤
Original assignee: Beijing QIYI Century Science and Technology Co Ltd
Current assignee: Beijing QIYI Century Science and Technology Co Ltd
Filing date: 2021-02-08
Publication date: 2024-07-12
Anticipated expiration: 2041-02-08

Abstract

The embodiment of the invention provides a method and a device for setting an alarm strategy, electronic equipment and a storage medium, which are applied to the technical field of Internet. The method comprises the following steps: determining an alternative alarm strategy set for the monitoring index; the alternative alarm strategy includes at least one sub-alarm condition; the sub-alarm condition corresponds to at least one monitoring index; acquiring historical data of each monitoring index; for any sub-alarm condition, generating an alarm event under the condition that the historical data of the monitoring index corresponding to the sub-alarm condition hits the sub-alarm condition; generating alarm event data according to the number of alarm events, and adjusting alternative alarm strategies based on the alarm event data. Therefore, the simulation alarm condition can be intuitively displayed, a reference is provided for the adjustment of the alternative alarm strategy, the adjusted alternative alarm strategy is more accurate, mass alarms in the monitoring system can be avoided, the safety risk of the monitoring system is reduced, and the processing load is reduced.

Description

Alarm strategy setting method and device, electronic equipment and storage medium

Technical Field

The present invention relates to the field of internet technologies, and in particular, to a method and apparatus for setting an alarm policy, an electronic device, and a storage medium.

Background

In the current internet industry, when monitoring various operation data of a server, the server monitoring system often needs to set various alarm strategies for the server, correspondingly set various alarm thresholds, and when the operation data reach the alarm thresholds, the monitoring system alarms.

In the prior art, the setting of the alarm strategy has backward ductility, when the alarm strategy is set manually according to experience, the condition that the alarm strategy is set inaccurately easily occurs, so that massive alarms are generated in the monitoring system, the monitoring system is at great risk in normal and stable operation, and the processing burden of maintenance personnel of the monitoring system is increased.

Disclosure of Invention

The embodiment of the invention aims to provide a setting method and device of an alarm strategy, electronic equipment and a storage medium, so as to improve the setting accuracy of the alarm strategy, reduce the safety risk of a monitoring system and reduce the processing burden. The specific technical scheme is as follows:

in a first aspect of the present invention, there is provided a method for setting an alarm policy, including:

determining an alternative alarm strategy set for the monitoring index; the alternative alarm strategy includes at least one sub-alarm condition; the sub-alarm condition corresponds to at least one monitoring index;

Acquiring historical data of each monitoring index;

for any sub-alarm condition, generating an alarm event under the condition that the historical data of the monitoring index corresponding to the sub-alarm condition hits the sub-alarm condition;

Generating alarm event data according to the number of the alarm events, and adjusting the alternative alarm strategy based on the alarm event data.

Optionally, the generating an alarm event when the historical data of the monitoring index corresponding to the sub-alarm condition hits the sub-alarm condition includes:

Detecting whether at least two continuous data points in the historical data of the monitoring index meet the sub-alarm condition according to the time sequence of the historical data;

and generating the alarm event under the condition that at least two continuous data points exist in the historical data of the monitoring index and all meet the sub-alarm condition.

Optionally, the alarm event includes a start-stop time of the alarm event; the generating the alarm event data according to the number of the alarm events comprises the following steps:

Taking the number of the alarm events as the alarm event data;

and/or determining the generation frequency of the alarm event according to the number of the alarm events and the starting and stopping time of the alarm events; and taking the generation frequency of the alarm event as the alarm event data.

Optionally, the method further comprises:

Acquiring a preset data return address;

the adjusting the alternative alarm strategy based on the alarm event data comprises the following steps:

returning the alarm event data to the user according to the data return address;

receiving a target alarm strategy returned by a user aiming at the alarm event data; the target alarm strategy is obtained by adjusting the alternative alarm strategy by the user based on the alarm event data.

Optionally, the alarm event data includes the number and/or the frequency of generation of alarm events, and the sub-alarm conditions include an alarm threshold;

Based on the alarm event data, adjusting the alternative alarm strategy, including:

and adjusting the alarm threshold value in the sub-alarm condition according to the number and/or the generation frequency of the alarm events.

Optionally, the preset database stores historical data of different monitoring indexes generated by different servers; the obtaining the historical data of the at least one monitoring index includes:

acquiring at least one target server identifier, the name of the at least one monitoring index and the time range of the historical data;

Taking the historical data generated by the server indicated by the target server identification in the preset database as alternative historical data;

and acquiring data matched with the name and the time range from the alternative historical data to obtain the historical data.

In a second aspect of the present invention, there is also provided an apparatus for setting an alarm policy, the apparatus including:

The determining module is used for determining an alternative alarm strategy set for the monitoring index; the alternative alarm strategy includes at least one sub-alarm condition; the sub-alarm condition corresponds to at least one monitoring index;

the first acquisition module is used for acquiring historical data of each monitoring index;

The generation module is used for generating an alarm event for any sub-alarm condition under the condition that the historical data of the monitoring index corresponding to the sub-alarm condition hits the sub-alarm condition;

and the adjustment module is used for generating alarm event data according to the number of the alarm events and adjusting the alternative alarm strategy based on the alarm event data.

Optionally, the generating module is specifically configured to:

In yet another aspect of the present invention, there is also provided a computer readable storage medium having instructions stored therein, which when run on a computer, cause the computer to perform the method of setting an alarm policy as described in any one of the above.

In yet another aspect of the present invention, there is also provided a computer program product containing instructions which, when run on a computer, cause the computer to perform the method of setting an alarm policy as described in any of the above.

The setting method of the alarm strategy provided by the embodiment of the invention determines the alternative alarm strategy set for the monitoring index; the alternative alarm strategy includes at least one sub-alarm condition; the sub-alarm condition corresponds to at least one monitoring index; acquiring historical data of each monitoring index; for any sub-alarm condition, generating an alarm event under the condition that the historical data of the monitoring index corresponding to the sub-alarm condition hits the sub-alarm condition; and generating alarm event data according to the number of the alarm events, and adjusting alternative alarm strategies based on the alarm event data. In this way, in the embodiment of the invention, the alarm event is determined through the history data and the alternative alarm strategy simulation, the alarm condition corresponding to the alternative alarm strategy can be intuitively displayed, the reference is provided for the adjustment of the alternative alarm strategy, the alternative alarm strategy adjusted based on the alarm event data can be more accurate to a certain extent, massive alarms in the monitoring system can be avoided, the safety risk of the monitoring system is reduced, and the processing load is reduced.

Drawings

In order to more clearly illustrate the embodiments of the invention or the technical solutions of the prior art, the drawings which are used in the description of the embodiments or the prior art will be briefly described, it being obvious that the drawings in the description below are only some embodiments of the invention, and that other drawings can be obtained according to these drawings without inventive faculty for a person skilled in the art.

Fig. 1 is a flowchart of steps of a method for setting an alarm policy according to an embodiment of the present invention.

Fig. 2 is a flowchart illustrating steps of another method for setting an alarm policy according to an embodiment of the present invention.

Fig. 3 is a schematic diagram of a setup page of an alternative alarm strategy for a single monitoring index according to an embodiment of the present invention.

Fig. 4 is a schematic diagram of a setting page of an alternative alarm composite strategy for two monitoring indexes according to an embodiment of the present invention.

FIG. 5 is a flowchart illustrating an off-line determining module generating an alarm event according to an embodiment of the present invention.

FIG. 6 is a schematic diagram of an alarm event according to an embodiment of the present invention.

Fig. 7 is a schematic flow chart of setting an alarm strategy according to an embodiment of the invention.

Fig. 8 is a block diagram of an alarm policy setting device according to an embodiment of the present invention.

Fig. 9 shows a block diagram of an electronic device according to an embodiment of the invention.

Detailed Description

The following description of the technical solutions according to the embodiments of the present invention will be given with reference to the accompanying drawings in the embodiments of the present invention, and it is apparent that the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.

It should be appreciated that reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, the appearances of the phrases "in one embodiment" or "in an embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

In various embodiments of the present invention, it should be understood that the sequence numbers of the following processes do not mean the order of execution, and the order of execution of the processes should be determined by the functions and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

Referring to fig. 1, fig. 1 shows a flowchart of steps of a method for setting an alarm policy according to an embodiment of the present invention. As shown in fig. 1, the method includes:

step 101, determining an alternative alarm strategy set for monitoring indexes; the alternative alarm strategy includes at least one sub-alarm condition; the sub-alarm condition corresponds to at least one monitoring indicator.

In the embodiment of the invention, the monitoring index can refer to various data indexes of the server, can represent the running state of the server, specifically can be related indexes of CPU (central processing unit) utilization rate, disk I/O (input/output) throughput rate or other related server availability, and can be a monitoring index customized by a user according to actual requirements. The alternative alarm strategy may refer to an alarm strategy preset by a user, and the alternative alarm strategy may include parameters such as an alarm threshold value. The sub-alarm condition may refer to an alarm condition included in the alternative alarm strategy, and the sub-alarm condition may be an alarm condition for a single monitoring indicator or an alarm condition for a plurality of monitoring indicators.

In this step, based on the actual monitoring requirement, the user may set an alternative alarm policy for one or more monitoring indexes through the front-end page. For a plurality of monitoring indexes, a user can set sub-alarm conditions for the plurality of monitoring indexes according to internal relations among the monitoring indexes, so that the setting of alternative alarm strategies of the plurality of indexes is realized.

Step 102, acquiring historical data of each monitoring index.

In the embodiment of the invention, the historical data may refer to historical monitoring data of monitoring indexes. In the normal running process of the server, the monitoring system can collect various data indexes of the server and store the data indexes into a preset database, and subsequently, historical monitoring data of at least one designated monitoring index can be directly obtained from the preset database and used as the historical data to participate in a subsequent simulation process.

Specifically, in this step, when the alarm event simulation is required, the data interface of the monitoring system may directly request at least one type of historical data of the monitoring index, store the historical data in the converter (Transfer), report the historical data to the offline judgment module by the converter, and execute the subsequent alarm event simulation process by the offline judgment module.

Step 103, for any one of the sub-alarm conditions, generating an alarm event when the historical data of the monitoring index corresponding to the sub-alarm condition hits the sub-alarm condition.

In the embodiment of the invention, the alarm event can be an alarm generated when historical data hit an alarm condition. In this step, the historical data of the monitoring index and the sub-alarm conditions in the alternative alarm strategy can be utilized to simulate and generate an alarm event in the offline judgment module.

Specifically, after the converter uploads the historical data of the monitoring index to the offline judging module, the offline judging module can judge whether the historical data of the monitoring index hits each sub-alarm condition in the alternative alarm strategy, and when the historical data of the monitoring index meets the sub-alarm condition, the offline judging module judges that the historical data hits the sub-alarm condition at the moment, and an alarm event can be generated.

Step 104, generating alarm event data according to the number of the alarm events, and adjusting the alternative alarm strategy based on the alarm event data.

In the embodiment of the invention, the alarm event simulation can be performed based on the historical data and the alternative alarm strategy to generate the alarm event data. The alarm event data may refer to various reference data corresponding to alarm events generated in the simulation process, and may specifically include alarm number, alarm frequency, alarm value, alarm time, and the like.

Specifically, in this step, the alarm event simulation process may be performed in the offline determining module (Judge Offline). The off-line judging module can call the alternative alarm strategy, acquire historical data of at least one monitoring index, simulate the monitoring index in an off-line state and generate a corresponding alarm event. Therefore, by simulating the alarm event in the off-line judging module, the alternative alarm strategy does not directly act on the production environment, and the abnormal conditions such as massive alarms and the like caused by directly setting the alternative alarm strategy in the production environment can be avoided.

In the embodiment of the invention, after the alarm event simulation is carried out and the alarm event data is generated, the alternative alarm strategy can be adjusted according to the reference data such as the alarm quantity and the like included in the alarm data, so that the adjustment of the alternative alarm strategy is realized.

In summary, the method for setting an alarm policy provided by the embodiment of the invention determines an alternative alarm policy set for a monitoring index; the alternative alarm strategy includes at least one sub-alarm condition; the sub-alarm condition corresponds to at least one monitoring index; acquiring historical data of each monitoring index; for any sub-alarm condition, generating an alarm event under the condition that the historical data of the monitoring index corresponding to the sub-alarm condition hits the sub-alarm condition; and generating alarm event data according to the number of the alarm events, and adjusting alternative alarm strategies based on the alarm event data. In this way, in the embodiment of the invention, the alarm event data is determined through the history data and the alternative alarm strategy simulation, the alarm condition corresponding to the alternative alarm strategy can be intuitively displayed, the reference is provided for the adjustment of the alternative alarm strategy, the alternative alarm strategy adjusted based on the alarm event data can be more accurate to a certain extent, massive alarms in the monitoring system can be avoided, the safety risk of the monitoring system is reduced, and the processing load is reduced.

Referring to fig. 2, a flowchart of steps of another method for setting an alarm policy according to an embodiment of the present invention is shown. The method specifically comprises the following steps:

Step 201, determining an alternative alarm strategy set for monitoring indexes; the alternative alarm strategy includes at least one sub-alarm condition; the sub-alarm condition corresponds to at least one monitoring indicator.

In the embodiment of the invention, when the alternative alarm strategy is set, the user can set various parameters of the alternative alarm strategy in the front-end page of the simulated alarm, for example, the name of at least one monitoring index, the coverage server range of the alternative alarm strategy, the time range of historical data, a mailbox for receiving the simulation of the alarm event and the like.

Illustratively, fig. 3 shows a setup page of an alternative alarm strategy for a single monitoring indicator according to an embodiment of the present invention. As shown in fig. 3, counter is the name of a monitor indicator, which may be, for example, a percentage of the total amount of disk available (df. Strides is a step size, that is, the number of history data needed for each judgment of the alternative alarm strategy, for example, the step size may be 5.Threshold is an alarm Threshold, which may refer to a Threshold value for an alarm, for example, the alarm Threshold may be 90.Sql is a structured query language (Structured Query Language), and a user can input a conditional statement of the source server of the selection history data through the option, and can also input a conditional statement of the coverage server range of the alternative alarm strategy. For example, a user may determine the origin server of the history data by entering a SELECT statement to SELECT a host name, an IP address, and a universally unique identification code (Universally Unique Identifier, UUID); in this way, by designating the history data origin server through the input of the Sql condition, it is possible to avoid the difference of the same index history data due to the server configuration difference or the deployed service difference. The Method may be a Method of processing history data, and may be, for example, averaging (avg). Operater is an operator, and may be equal to (eq), not equal to (ne, not equal) less than (lt, less than), greater than (gt, GREATER THAN), for example. The date range is a time range of the history data to be acquired, and may be 2020-08-01 to 2020-08-31, for example. EMAIL ADDRESS is a mailbox address that may be used to receive alarm event data. In addition, a submit button 301 is further arranged in the page, and after the setting is completed, a user can click on the submit button 301 to submit an alternative alarm strategy for the completion of the setting. When alternative alarm strategies are needed for a plurality of monitoring index devices, a user can respectively select alarm composite strategies for two or more monitoring index devices, the setting of the alternative alarm strategies of multiple indexes is realized, and the setting mode of the strategies is more flexible.

By way of example, FIG. 4 illustrates a setup page for an alternative alarm compounding strategy for two monitoring metrics in accordance with an embodiment of the present invention. The sub-alarm conditions in the alternative alarm composite strategy may correspond to at least two monitoring indicators. As shown in fig. 4, the user may set alternative alarm policies for both monitoring indicators. In policy one, the user may input the monitoring index name, step size, alarm threshold, source server and/or covered server range of history data, history data handling, and operators, as in the policy setup page of the single monitoring index of fig. 3. In policy two, the user may input another monitoring index, step size, alarm threshold, historical data processing mode, and operator. Likewise, a submit button 401 is also provided on the composite alternative alarm policy setting page, and after the setting is completed, the user may click on the submit button 301 to submit the alternative alarm composite policy. It should be noted that when setting the alternative alarm composite policy for multiple indexes, for parameters that are the same for each monitoring index, for example, the source server of the historical data and/or the covered server range, the date range, and the mailbox address, the user may input only once, so that the parameter setting efficiency of the alternative alarm policy for multiple monitoring indexes may be improved. Of course, only two monitoring indexes are shown in fig. 4, and the user may set alternative alarm strategies for three or more monitoring indexes based on actual requirements, which is not limited by the embodiment of the present invention.

Step 202, acquiring historical data of each monitoring index.

Optionally, in the embodiment of the present invention, historical data of different monitoring indexes generated by different servers are stored in a preset database.

In the embodiment of the present invention, the preset database may be a database for storing historical data, and specifically may be an Hbase database (a distributed, column-oriented database) or the like. The monitoring system can collect actual data of various monitoring indexes of different servers and store the actual data into the preset database.

Of course, in this step, the user may also monitor the monitoring index of the server or the service defined by other users by developing the plug-in, and report the monitoring index data. For example, when the user collects and reports the historical data of the monitoring index by adopting the setting custom plug-in, the following data reporting format can be adopted:

accordingly, step 202 may include the following steps (1) to (3):

And (1) acquiring at least one target server identifier, the name of the at least one monitoring index and the time range of the historical data.

In the embodiment of the present invention, the target server identifier may refer to an identifier of each server within the coverage range of the alternative alarm policy, for example, may specifically be an IP address of each server, etc. The time range may refer to the start-stop time of the historical data that needs to be acquired.

And (2) taking the historical data generated by the server indicated by the target server identification in the preset database as alternative historical data.

In the embodiment of the invention, when the historical data is acquired, various generated historical data of the target server covered by the alternative alarm strategy can be determined in the preset database, and used as the alternative historical data, and can be further determined according to the name and the time range of the monitoring index.

And (3) acquiring data matched with the name and the time range from the alternative historical data to obtain the historical data.

In the embodiment of the invention, after the alternative historical data corresponding to the target server is determined, the historical data required by finally simulating the alarm event can be further determined according to the name and the time range of at least one monitoring index.

It should be noted that in the embodiment of the present invention, the order of steps (2) and (3) may be changed, that is, the historical data of the name of at least one monitoring index in the time range may be determined first as the candidate database, and then the historical data of the target server corresponding to the at least one target server identifier may be determined from the candidate database. The sequence of the steps (2) and (3) may be specifically determined according to a storage structure of the history data in the preset database, which is not limited in the embodiment of the present invention.

In the embodiment of the invention, the preset database stores the historical data of different monitoring indexes generated by different servers; acquiring at least one target server identifier, at least one monitoring index name and a time range of historical data; then, taking the historical data generated by a server indicated by a target server identification in a preset database as alternative historical data; and obtaining data matched with the name and the time range from the alternative historical data to obtain the historical data. In this way, in the embodiment of the invention, according to the time range, the name of the monitoring index and the identification of the target server, the historical data is obtained to simulate the subsequent alarm event, so that the difference of the historical data of the same monitoring index caused by the server configuration difference or the deployed service difference can be avoided, and the interference of irrelevant factors in the simulation process is reduced; meanwhile, compared with monitoring data simulated by using random numbers or algorithms, the historical data of the actual production environment is more true in value and change trend, the actual production environment can be truly restored, and the simulation accuracy of alarm events is improved.

Step 203, detecting whether at least two continuous data points exist in the historical data of the monitoring index according to the time sequence of the historical data, wherein the at least two continuous data points meet the sub-alarm condition.

In the embodiment of the invention, the time sequence can be used for representing the time points corresponding to each historical data, and the historical data are ordered according to the time points corresponding to each historical data, so that the time sequence historical data are obtained. A data point may be used to represent historical data corresponding to a certain point in time of a time series, and the value of the data point is a specific value of the historical data.

Specifically, in this step, according to the number of data points corresponding to the sub-alarm condition in the time sequence, it may be verified whether the number of continuous data points satisfies the sub-alarm condition.

Illustratively, the time series history data may include a ₁～a_n (n pieces of data in total) and the sub-alarm condition may be greater than 90 for 3 consecutive times. The converter reports the historical data to the offline judging module in turn, and if a _x-2、a_x-1 and a _x are simultaneously larger than 90, the converter can judge that a _x-2、a_x-1 and a _x hit sub-alarm conditions.

Step 204, generating the alarm event when at least two continuous data points exist in the historical data of the monitoring index and all meet the sub-alarm condition.

In the embodiment of the invention, when the data in the historical data meets the sub-alarm condition, an alarm event is correspondingly generated and the time attribute of the historical data is recorded as the starting time of the alarm event until the historical data which does not meet the sub-alarm condition exists, and the time attribute of the historical data is recorded as the ending time of the alarm event. In this way, alarm events are continuously generated along with the detection of historical data, and the start-stop time corresponding to the alarm events can be determined and recorded while the alarm events are generated.

Illustratively, the time series history data may include a ₁～a_n (n pieces of data in total) and the sub-alarm condition may be greater than 90 for 3 consecutive times. The converter sequentially reports the historical data to the offline judging module, if a _x-2、a_x-1 and a _x are simultaneously larger than 90, the hit sub-alarm conditions of a _x-2、a_x-1 and a _x can be judged, the time attribute of the historical data a _x is recorded as the starting time of the alarm event, the converter sequentially reports the subsequent historical data to the offline judging module until a _x+y is smaller than 90, at the moment, the time attribute of the historical data a _x+y is recorded as the ending time of the alarm event, and an alarm event is correspondingly generated; if a _x+y subsequent a _x+y+1、a_x+y+2 and a _x+y+3 are simultaneously greater than 90, then a _x+y+1、a_x+y+2 and a _x+y+3 hit sub-alarm conditions can be determined until there is less than 90 history, corresponding to a re-generation of an alarm event.

In the embodiment of the invention, the off-line judging module generates an alarm event under the condition that at least two continuous data points in the historical data meet the sub-alarm condition. Specifically, in this step, when at least two data points meet the sub-alarm condition, an alarm is started and an alarm event is generated, and at this time, the start time of the alarm is recorded, until the at least two data points do not meet the sub-alarm condition, the alarm is ended, the end time of the alarm is recorded, and the end time and the values of at least two consecutive data points, that is, the alarm value, are added to the alarm event.

Illustratively, the time series history data may include a ₁～a_n (n pieces of data in total) and the sub-alarm condition may be greater than 90 for 2 out of 5 consecutive times. The converter sequentially reports the historical data to the offline judging module, if 2 pieces of data in a _x-4、a_x-3、a_x-2、a_x-1 and a _x are more than 90, the condition that a _x-4、a_x-3、a_x-2、a_x-1 and a _x hit sub-alarm is judged, the time attribute of a _x is recorded as the starting time of the alarm event until the time attribute of the historical data recorded as the ending time of the alarm event is less than 2 times and is more than 90 times in the continuous 5 times of the historical data reported subsequently, and the alarm event is generated.

Illustratively, FIG. 5 shows a flow chart of an off-line determination module generating an alarm event in accordance with an embodiment of the present invention. As shown in fig. 5, the converter (Transfer) reports the historical data to the offline determining module (Judge-offline), and at the same time, the offline determining module obtains an alternative alarm policy (strategy), and when at least one continuous data point meets the policy, that is, meets the sub-alarm condition corresponding to the alternative alarm policy, the offline determining module generates an alarm event and records the start time until the end time is recorded when the next data point not meeting the policy, and writes the alarm event into the cache.

It should be noted that the alternative alarm strategy may refer to an alternative alarm strategy that includes sub-alarm conditions for a single monitoring indicator, or may refer to an alternative alarm strategy that includes sub-alarm conditions for two or more monitoring indicators. When the two alternative alarm strategies are subjected to simulation judgment, under the condition that the data points of the historical data meet the sub-alarm conditions, only one alarm event can be correspondingly generated by the two alternative alarm strategies.

In addition, when at least two monitoring indexes are corresponding to the sub-alarm conditions, an alarm event can be generated under the condition that the historical data of each monitoring index hits the sub-alarm condition corresponding to the monitoring index. Specifically, the sub-alarm conditions in the alternative alarm strategy may correspond to two or more monitoring indicators. When judging whether the historical data of at least two monitoring indexes meet the sub-alarm condition, at least two continuous data points of the at least two monitoring indexes in the same time are required to be read, and an alarm event is generated under the condition that the data points of the at least two monitoring indexes meet the sub-alarm condition.

For example, the alternative alarm policy includes sub-alarm conditions corresponding to the monitoring index A, B, the time series history data corresponding to the monitoring index a may include a ₁～a_n (n pieces of data in total), and the time series history data corresponding to the monitoring index B may include B ₁～b_n (n pieces of data in total); the sub-alarm conditions comprise threshold conditions corresponding to A, B monitoring indexes respectively, namely, A in two continuous data is greater than 30, and B in two continuous data is less than 10. The converter reports A, B historical data to the offline judging module simultaneously according to the same time sequence, and if a _x-1 and a _x are both more than 30 and b _x-1 and b _x are both less than 10, an alarm event is generated.

In the embodiment of the invention, according to the time sequence of the historical data, whether at least two continuous data points exist in the historical data of the monitoring index or not is detected to meet the sub-alarm condition; and generating an alarm event under the condition that at least two continuous data points in the historical data of the monitoring index meet the sub-alarm condition. Therefore, by judging whether the historical data meets the sub-alarm conditions set by the alternative alarm strategy, the alarm event corresponding to the historical data under the alternative alarm strategy can be accurately determined, and an accurate reference can be provided for the optimization adjustment of the subsequent alternative alarm strategy. And moreover, judgment simulation of the alarm event is carried out in the off-line judgment module, so that the real production environment is not influenced, and the interference to the normal operation of the system in the adjustment process of the alternative alarm strategy can be reduced to the greatest extent.

Step 205, generating alarm event data according to the number of alarm events.

In this step, the alarm event data may refer to a plurality of alarm events among the alarm events. The alarm event data can directly reflect the alarm condition of the corresponding server under the alternative alarm strategy. After the off-line judging module completes the simulation of the historical data, the number of the generated alarm events can be determined, and the number of the alarm events are exported to obtain alarm event data.

Illustratively, FIG. 6 shows a schematic diagram of an alarm event in accordance with an embodiment of the present invention. The alarm event includes a start Time (Begin Time), an End Time (End Time), an IP address, a universal unique identifier UUID, a group (group), a node (node), a hostname (hostname), etc., which can clearly determine the Time when the alarm event occurs and a corresponding server.

Optionally, in an embodiment of the present invention, the alarm event includes a start-stop time of the alarm event; accordingly, step 205 may be implemented by the following steps (4) and/or (5):

And (4) taking the number of the alarm events as the alarm event data.

In the embodiment of the invention, when the alternative alarm strategy is simulated to act on the alarm condition of the production environment, the number of alarm events, namely the alarm quantity, can be directly obtained as a reference. If the alarm quantity is too high, the alternative alarm strategy is unreasonable to set, and the monitoring index data in the normal running state can easily reach the sub-alarm condition corresponding to the alternative alarm strategy. Thus, the number of alarm events can be directly taken as alarm event data.

Step (5), determining the generation frequency of the alarm event according to the number of the alarm events and the starting and stopping time of the alarm events; and taking the generation frequency of the alarm event as the alarm event data.

In the embodiment of the invention, the start-stop time can refer to the start time and the end time of the alarm event. The frequency of generation may refer to the number of alarm events generated per unit time. In adjusting the alternative alarm strategy, the user may also adjust the alternative alarm strategy based on the alarm generation frequency. If the alarm generation frequency is too high, the alternative alarm strategy is unreasonable to set, and the monitoring index data in the normal running state can easily reach the sub-alarm condition corresponding to the alternative alarm strategy. Therefore, the generation frequency of the alarm event can also be directly used as alarm event data.

Of course, in the embodiment of the present invention, the number of alarm events and the frequency of generating the alarm events may be used as the alarm event data at the same time, which is not limited in the embodiment of the present invention.

In the embodiment of the invention, the number of the alarm events and/or the generation frequency of the alarm events are used as the alarm event data, so that a user can directly acquire the alarm quantity and the alarm frequency corresponding to the alternative alarm strategy without receiving a large number of alarm events generated in the alarm event simulation process, thereby not only providing accurate reference for the adjustment of the alternative alarm strategy, but also simplifying the analysis process of the user and improving the adjustment efficiency of the alarm strategy.

Step 206, adjusting the alternative alarm strategy based on the alarm event data.

Optionally, in the embodiment of the present invention, the method for setting an alarm policy may further include the following step (6):

And (6) acquiring a preset data return address.

In the embodiment of the present invention, the data return address may refer to an address for receiving alarm event data, for example, may be a mailbox address of a user.

Accordingly, step 206 may be implemented by the following steps (7) to (8):

And (7) returning the alarm event data to the user according to the data return address.

In the embodiment of the invention, after the offline judgment module completes the simulation process of the acquired historical data, the alarm event in the cache can be exported to generate the alarm event data. And then the back-end server calls an email transport (SIMPLE MAIL TRANSFER Protocol, SMTP) service to send the alarm event data transmission to the data return address.

Step (8), receiving a target alarm strategy returned by a user aiming at the alarm event data; the target alarm strategy is obtained by adjusting the alternative alarm strategy by the user based on the alarm event data.

In the embodiment of the invention, the target alarm strategy is obtained by optimizing and adjusting the alternative alarm strategy based on the reference indexes in the alarm event data, such as the alarm quantity, the alarm data and the like by a user. Compared with the alternative alarm strategy, the target alarm strategy is more reasonable, and does not generate massive alarms, namely, the generation quantity of alarm events corresponding to the target alarm strategy is more in accordance with the actual condition of monitoring indexes. Specifically, after the alarm event data is sent to the data return address, the user can read the alarm event data from the data return address, and then can optimally adjust the alternative alarm strategy according to each reference data in the alarm event data, so as to set a more reasonable target alarm strategy.

In the embodiment of the invention, the alarm event data is sent to the data return address, and then the target alarm strategy obtained by the user for adjusting the alternative alarm strategy based on the alarm event data is received. In this way, the embodiment of the invention provides references for the adjustment of the alarm strategy of the user by intuitively displaying the alarm event data corresponding to the alternative alarm strategy, improves the accuracy of the alarm strategy setting, overcomes the defect of the postnatal ductility of the alarm strategy, and ensures that the setting of the alarm strategy is more accurate and efficient.

Optionally, in an embodiment of the present invention, the alarm event data includes the number and/or the frequency of generation of alarm events, and the sub-alarm condition includes an alarm threshold.

Accordingly, step 206 may be implemented by the following step (9):

And (9) adjusting the alarm threshold value in the sub-alarm condition according to the number and/or the generation frequency of the alarm events.

In the embodiment of the invention, the alarm threshold value in the alternative alarm strategy can be automatically adjusted by the system. The manner of automatic adjustment may be set correspondingly based on the alarm condition selected by the user.

For example, the user hits a sub-alarm condition in the event that data in the set history data is greater than an alarm threshold. Under the limitation of the sub-alarm condition, the lower the alarm threshold is set, the more times each data in the historical data is larger than the alarm threshold, and the larger the corresponding number and/or frequency of alarm events are generated. Thus, after the number and/or frequency of alarm events is obtained, if the number and/or frequency of alarm events is greater than the normal range, the system may appropriately increase the alarm threshold to decrease the number and/or frequency of alarm events. Moreover, the increasing amount of the alarm threshold value can be positively correlated with the number and/or the generation frequency of the alarm events, namely, the larger the number and/or the generation frequency of the alarm events is, the larger the corresponding adjusting amount of the alarm threshold value is, namely, the increasing amount is, so that the number of the alarm events can be effectively reduced.

Illustratively, the time series of historical data has 20,5, 18, 10, 30,0. The preset greater than the alarm threshold 10 generates alarm events, and the number of the alarm events is 3. After the system receives the number of alarm events, the alarm threshold value can be adjusted to 20, that is, the alarm threshold value is set to be larger than the alarm threshold value 20 to generate alarm events, and the number of alarm events is 1. Thus, by this automatic adjustment process of increasing the alarm threshold, the number of alarm events is reduced.

For another example, the user hits a sub-alarm condition if the data in the set history data is less than the alarm threshold. Under the limitation of the sub-alarm condition, the higher the alarm threshold is set, the more times each data in the historical data is smaller than the alarm threshold, and the larger the corresponding number and/or frequency of alarm events are generated. Thus, after the number and/or frequency of alarm events is obtained, if the number and/or frequency of alarm events is greater than the normal range, the system may appropriately decrease the alarm threshold to decrease the number and/or frequency of alarm events. Also, the decrease in alarm threshold may be positively correlated with the number and/or frequency of alarm events. Specifically, the greater the alarm number and/or the generation frequency, the greater the corresponding adjustment amount, i.e., the decrease amount, of the alarm threshold can be, so that the alarm number can be effectively reduced.

Illustratively, the time series of historical data is 20,5, 22, 18, 30, 15, 33. The preset is less than the alarm threshold 20 to generate alarm events, and the number of alarm events at this time is 3. After the system receives the number of alarm events, the alarm threshold value can be adjusted to 10, namely, the alarm threshold value is set to be smaller than the alarm threshold value 10 to generate alarm events, and the number of alarm events is 1. By this automatic adjustment process of reducing the alarm threshold, the number of alarm events is reduced.

Of course, in the embodiment of the present invention, the user may also set to trigger the alarm event when the historical data is equal to or not equal to the alarm threshold, and the user may adjust the alarm threshold at this time, which is not limited in the embodiment of the present invention.

In the embodiment of the invention, after the number of the alarm events is obtained, the alarm threshold value in the sub-alarm conditions corresponding to the alternative alarm strategy is automatically adjusted according to the number and/or the generation frequency of the alarm events. Therefore, the adjustment process of the alternative alarm strategy does not need to be manually participated, the intelligent adjustment of the alarm strategy is realized, and the labor cost is further reduced.

Fig. 7 is a schematic flow chart of setting an alarm strategy according to an embodiment of the present invention. As shown in fig. 7, the user sets respective parameters of the alternative alarm policy for at least one monitoring index in a simulated alarm page of an internal operation system (OM system), and then the OM system transmits the respective parameters (parameters) set by the user in the simulated alarm page to a back-end server (back-end server), the back-end server requests historical data (request history data) in a corresponding time range from a database (Hubble Druid) of the monitoring system, and transmits the historical data and the alternative alarm policy (structey) for at least one monitoring index generated based on the respective parameters to a Cloud Storage (Cloud Storage), wherein the historical data (data) is transmitted to a converter (Transfer) Storage, and the alternative alarm policy is directly transmitted to an offline judgment module. The converter (Transfer) reports the historical data (raw data) to the offline judging module, the offline judging module (Judge (offline)) carries out Alarm event simulation based on the historical data and the alternative Alarm strategy, an Alarm event (Alarm Info) is generated, after the simulation process of the Alarm event is completed, the Alarm event data is derived, the back-end server calls the SMTP service to send the Alarm event data to a mailbox (email) of a user, and the user can optimally adjust the alternative Alarm strategy based on the Alarm event data.

Optionally, in the embodiment of the present invention, the at least one monitoring indicator includes at least one of a central processing unit usage rate, a disk throughput rate, a response time, a memory usage rate, a network connection number, a graphics processor usage rate, a disk mounting state, a service process state, and a network card rate.

In the embodiment of the invention, the monitoring index can refer to various state indexes of the server, and can reflect the performance and the running state of the server. The CPU (central processing unit) usage may refer to the proportion of the running program occupying CPU resources. Disk usage may refer to the ratio of occupied disk capacity to the total capacity of the disk. Disk throughput may refer to the amount of disk input/output traffic per second. The response time may refer to the processing time of a transaction, that is, the time interval from a request to return after processing by the server to receive the completion response data. Memory usage may refer to the proportion of memory occupied by a running program or service to the total memory size. The network connection number may refer to the machine network connection situation. GPU utilization may refer to utilization efficiency of a GPU (graphics processor Graphics Processing Unit). The disk mount status may refer to whether the disk was successfully mounted. The service process state may refer to the execution state of a service or process in a server. The network card rate may refer to the traffic of the network per second.

Of course, the monitoring index in the embodiment of the present invention may also include other indexes, or may be a user-defined monitoring index, which is not limited in the embodiment of the present invention.

In summary, the method for setting an alarm policy provided by the embodiment of the invention determines an alternative alarm policy set for a monitoring index; the alternative alarm strategy includes at least one sub-alarm condition; the sub-alarm condition corresponds to at least one monitoring index; acquiring historical data of each monitoring index; detecting whether at least two continuous data points in the historical data of the monitoring index meet sub-alarm conditions according to the time sequence of the historical data; generating an alarm event under the condition that at least two continuous data points in the historical data of the monitoring index meet the sub-alarm condition; and generating alarm event data according to the number of the alarm events, and adjusting alternative alarm strategies based on the alarm event data. In this way, the embodiment of the invention can intuitively display the alarm condition corresponding to the alternative alarm strategy by simulating the alarm event, and provide reference for the adjustment of the alternative alarm strategy, so that the alternative alarm strategy adjusted based on the alarm event data can be more accurate to a certain extent, massive alarms in the monitoring system can be avoided, the safety risk of the monitoring system is reduced, and the processing load is reduced.

Referring to fig. 8, the embodiment of the present invention further provides a device for setting an alarm policy, where the device 80 includes:

a determining module 801, configured to determine an alternative alarm policy set for a monitoring indicator; the alternative alarm strategy includes at least one sub-alarm condition; the sub-alarm condition corresponds to at least one monitoring indicator.

A first obtaining module 802, configured to obtain historical data of each monitoring indicator.

The generating module 803 is configured to generate, for any of the sub-alarm conditions, an alarm event if the historical data of the monitoring indicator corresponding to the sub-alarm condition hits the sub-alarm condition.

The adjustment module 804 is configured to generate alarm event data according to the number of alarm events, and adjust the alternative alarm policy based on the alarm event data.

Optionally, the generating module 803 is specifically configured to:

and generating the alarm event under the condition that at least two continuous data points exist in the historical data of the monitoring index and all meet the sub-alarm condition. Optionally, the alarm event includes a start-stop time of the alarm event; the adjusting module 804 is specifically configured to:

Taking the number of the alarm events as the alarm event data;

Optionally, the apparatus 80 further includes:

the second acquisition module is used for acquiring a preset data return address;

the adjusting module 804 is specifically configured to:

Optionally, the alarm event data includes the number and/or the frequency of generation of alarm events, and the sub-alarm conditions include an alarm threshold; the adjusting module 804 is specifically configured to:

Optionally, the preset database stores historical data of different monitoring indexes generated by different servers; the first obtaining module 802 is specifically configured to:

In summary, the setting device of the alarm strategy provided by the embodiment of the invention determines the alternative alarm strategy set for the monitoring index; the alternative alarm strategy includes at least one sub-alarm condition; the sub-alarm condition corresponds to at least one monitoring index; acquiring historical data of each monitoring index; for any sub-alarm condition, generating an alarm event under the condition that the historical data of the monitoring index corresponding to the sub-alarm condition hits the sub-alarm condition; and generating alarm event data according to the number of the alarm events, and adjusting alternative alarm strategies based on the alarm event data. In this way, in the embodiment of the invention, the alarm event is determined through the history data and the alternative alarm strategy simulation, the alarm condition corresponding to the alternative alarm strategy can be intuitively displayed, the reference is provided for the adjustment of the alternative alarm strategy, the alternative alarm strategy adjusted based on the alarm event data can be more accurate to a certain extent, massive alarms in the monitoring system can be avoided, the safety risk of the monitoring system is reduced, and the processing load is reduced.

The embodiment of the present invention also provides an electronic device, as shown in fig. 9, including a processor 901, a communication interface 902, a memory 903, and a communication bus 904, where the processor 901, the communication interface 902, and the memory 903 perform communication with each other through the communication bus 904,

A memory 903 for storing a computer program;

the processor 901 is configured to execute a program stored in the memory 903, and implement the following steps:

Acquiring historical data of each monitoring index;

generating alarm event data according to the number of the alarm events, and adjusting the alternative alarm strategy based on the alarm event data. The communication bus mentioned by the above terminal may be a peripheral component interconnect standard (PERIPHERAL COMPONENT INTERCONNECT, abbreviated as PCI) bus or an extended industry standard architecture (Extended Industry Standard Architecture, abbreviated as EISA) bus, etc. The communication bus may be classified as an address bus, a data bus, a control bus, or the like. For ease of illustration, the figures are shown with only one bold line, but not with only one bus or one type of bus.

The communication interface is used for communication between the terminal and other devices.

The memory may include random access memory (Random Access Memory, RAM) or may include non-volatile memory (non-volatile memory), such as at least one disk memory. Optionally, the memory may also be at least one memory device located remotely from the aforementioned processor.

The processor may be a general-purpose processor, including a central processing unit (Central Processing Unit, abbreviated as CPU), a network processor (Network Processor, abbreviated as NP), etc.; but may also be a digital signal processor (DIGITAL SIGNAL Processing, DSP), application Specific Integrated Circuit (ASIC), field-Programmable gate array (FPGA) or other Programmable logic device, discrete gate or transistor logic device, discrete hardware components.

In yet another embodiment of the present invention, a computer readable storage medium is provided, where instructions are stored, which when executed on a computer, cause the computer to perform the method for setting an alarm policy according to any one of the above embodiments.

In a further embodiment of the present invention, a computer program product comprising instructions, which when run on a computer, causes the computer to perform the method of setting an alarm policy as described in any of the above embodiments is also provided.

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loaded and executed on a computer, produces a flow or function in accordance with embodiments of the present invention, in whole or in part. The computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable apparatus. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another, for example, by wired (e.g., coaxial cable, optical fiber, digital Subscriber Line (DSL)), or wireless (e.g., infrared, wireless, microwave, etc.). The computer readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that contains an integration of one or more available media. The usable medium may be a magnetic medium (e.g., floppy disk, hard disk, tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk Solid STATE DISK (SSD)), etc.

It is noted that relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

In this specification, each embodiment is described in a related manner, and identical and similar parts of each embodiment are all referred to each other, and each embodiment mainly describes differences from other embodiments. In particular, for system embodiments, since they are substantially similar to method embodiments, the description is relatively simple, as relevant to see a section of the description of method embodiments.

The foregoing description is only of the preferred embodiments of the present invention and is not intended to limit the scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A method for setting an alarm strategy, the method comprising:

acquiring historical data of each monitoring index; the historical data are obtained according to at least one target server identifier, at least one name of the monitoring index and a time range of the historical data;

For any sub-alarm condition, under the condition that the historical data of the monitoring index corresponding to the sub-alarm condition hits the sub-alarm condition, simulating and generating an alarm event, wherein the alarm event is generated under the condition that at least two continuous data points in the historical data of the monitoring index meet the sub-alarm condition;

Generating alarm event data according to the number of the alarm events, and adjusting the alternative alarm strategy based on the alarm event data, wherein the adjustment of the alternative alarm strategy is realized by adjusting the alarm threshold value in the sub-alarm condition.

2. The method of claim 1, wherein generating an alarm event in the event that the historical data of the monitor indicator corresponding to the sub-alarm condition hits the sub-alarm condition comprises:

3. The method of claim 2, wherein the alarm event comprises a start-stop time of the alarm event; the generating the alarm event data according to the number of the alarm events comprises the following steps:

Taking the number of the alarm events as the alarm event data;

4. The method according to claim 1, wherein the method further comprises:

Acquiring a preset data return address;

5. A method according to claim 3, wherein the alarm event data comprises the number and/or frequency of alarm events, and the sub-alarm conditions comprise alarm thresholds;

6. The method of claim 1, wherein the predetermined database stores historical data of different monitoring indicators generated by different servers; the step of obtaining the historical data of each monitoring index comprises the following steps:

7. An alarm policy setting device, characterized in that the device comprises:

The first acquisition module is used for acquiring historical data of each monitoring index; the historical data are obtained according to at least one target server identifier, at least one name of the monitoring index and a time range of the historical data;

The generation module is used for simulating and generating an alarm event when the historical data of the monitoring index corresponding to any one of the sub-alarm conditions hits the sub-alarm condition, wherein the alarm event is generated when at least two continuous data points in the historical data of the monitoring index meet the sub-alarm condition;

And the adjustment module is used for generating alarm event data according to the number of the alarm events, adjusting the alternative alarm strategy based on the alarm event data, wherein the adjustment of the alternative alarm strategy is realized by adjusting the alarm threshold value in the sub-alarm condition.

8. The apparatus of claim 7, wherein the generating module is specifically configured to:

9. The electronic equipment is characterized by comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory are communicated with each other through the communication bus;

a memory for storing a computer program;

A processor for implementing the steps of the alarm policy setting method according to any one of claims 1 to 6 when executing a program stored in a memory.

10. A computer-readable storage medium, on which a computer program is stored, characterized in that the program, when being executed by a processor, implements a method of setting an alarm strategy as claimed in any one of claims 1-6.