CN113220543B - Service automatic alarm method and device - Google Patents
Service automatic alarm method and device Download PDFInfo
- Publication number
- CN113220543B CN113220543B CN202110404375.4A CN202110404375A CN113220543B CN 113220543 B CN113220543 B CN 113220543B CN 202110404375 A CN202110404375 A CN 202110404375A CN 113220543 B CN113220543 B CN 113220543B
- Authority
- CN
- China
- Prior art keywords
- log information
- alarm
- information
- log
- storage area
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 32
- 230000002159 abnormal effect Effects 0.000 claims abstract description 80
- 230000002776 aggregation Effects 0.000 claims abstract description 67
- 238000004220 aggregation Methods 0.000 claims abstract description 67
- 238000001914 filtration Methods 0.000 claims description 10
- 230000001419 dependent effect Effects 0.000 claims description 8
- 238000001514 detection method Methods 0.000 claims description 3
- 238000004364 calculation method Methods 0.000 claims description 2
- 230000000694 effects Effects 0.000 abstract description 11
- 230000005856 abnormality Effects 0.000 description 9
- 230000009286 beneficial effect Effects 0.000 description 9
- 238000012423 maintenance Methods 0.000 description 9
- 230000006870 function Effects 0.000 description 6
- 230000003139 buffering effect Effects 0.000 description 4
- 238000012544 monitoring process Methods 0.000 description 4
- 238000013461 design Methods 0.000 description 3
- 238000012986 modification Methods 0.000 description 3
- 230000004048 modification Effects 0.000 description 3
- 230000008569 process Effects 0.000 description 3
- 230000008901 benefit Effects 0.000 description 2
- 239000003795 chemical substances by application Substances 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 230000007547 defect Effects 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 238000011160 research Methods 0.000 description 2
- 230000004044 response Effects 0.000 description 2
- 239000000523 sample Substances 0.000 description 2
- 230000004931 aggregating effect Effects 0.000 description 1
- 230000004075 alteration Effects 0.000 description 1
- 230000002547 anomalous effect Effects 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 238000004422 calculation algorithm Methods 0.000 description 1
- 238000004590 computer program Methods 0.000 description 1
- 230000003111 delayed effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 239000000835 fiber Substances 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
- 230000000007 visual effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/32—Monitoring with visual or acoustical indication of the functioning of the machine
- G06F11/324—Display of status information
- G06F11/327—Alarm or error message display
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3466—Performance evaluation by tracing or monitoring
- G06F11/3476—Data logging
Abstract
The embodiment of the invention provides a service automatic alarm method and a device, which form a single alarm associated with abnormal recorded data by carrying out aggregation operation on a designated field and the abnormal recorded data in log information, solve the problems of alarm bombing, low alarm association and incomplete alarm information, achieve the effects of quickly acquiring abnormal wrong interface address information, associating a plurality of alarms and avoiding the bombing of the alarms, avoid the inefficiency and complexity caused by the existing mode, and simultaneously quickly improve the service quality.
Description
Technical Field
The invention relates to the field of server service alarm, in particular to a service automatic alarm method and device.
Background
In the prior art, the service log alarming mode is to monitor the value of a monitoring item of a service through open source monitoring zabbix software. At present, the received alarms are alarm values and monitoring names, and when the business personnel remove the fault, the business personnel manually search program logs, application logs, error logs and system logs in all servers of the gradual login business according to the alarm monitoring names, and gradually check information such as abnormal information sources, abnormal information interface addresses, dependence on resources and the like. Then manually breaking those resources according to the above filtering information results in triggering the problem.
Disclosure of Invention
The inventor summarizes and discovers that the zabbix monitoring software alarms through the numerical value reported by business through using and analyzing the zabbix monitoring software, and has the following defects:
if the same type of alarm is encountered, the alarm receiving personnel receives a large amount of alarm information, and the same type of alarm cannot judge whether the type of alarm is abnormal or not, and time consumption is caused by reading the alarm information.
If the alarm relevance is low, the receiving personnel of the abnormal alarm of the business receives a large amount of alarm information, and can not quickly correlate a large amount of alarm information to quickly find the root of the alarm. The time consumption and the complexity are brought to the debugging personnel to find out the alarm root from each alarm information.
If the alarm information is not sound, the address of the abnormal alarm interface cannot be displayed rapidly and effectively according to the current alarm mode when the business is abnormal, and time consumption is brought to debugging personnel for searching the abnormal interface.
The inventor aims at the defects, and provides a service automatic alarm method and device, which are used for forming a single alarm associated with abnormal recorded data by carrying out aggregation operation on specified fields in log information and the abnormal recorded data, so as to achieve the effects of quickly acquiring abnormal error interface address information, associating a plurality of alarms and avoiding the bombness of the alarms, avoiding the inefficiency and complexity caused by the existing mode, and simultaneously quickly improving the service quality.
In order to achieve the above object, in one aspect, an embodiment of the present invention provides a service automatic alarm method, including:
periodically acquiring the log information in a first specified time interval range which is nearest to the message queue according to the first specified time interval as interval log information;
executing a first aggregation operation on the interval log information according to a first appointed field set to obtain aggregation log information, and writing the aggregation log information into a first storage area;
acquiring log information from the message queue in real time as real-time log information; filtering the real-time log information according to a second designated field set to obtain filtered log information, and storing the filtered log information into a second storage area;
periodically searching the log information in the nearest second specified time interval range in the first storage area according to the second specified time interval to serve as log information to be detected;
executing a second aggregation operation on the log information to be detected according to the first specific field to obtain an aggregation value; the first specific field exists in the first specified field set;
when the aggregate value is judged to be greater than or equal to a specified abnormal threshold value, acquiring the log information in a second nearest specified time interval range from the second storage area as abnormal log information;
And executing aggregation operation on the abnormal log information to obtain and report at least one single alarm information and alarm log information associated with each single alarm information.
Further, the performing a first aggregation operation on the interval log information according to the first specified field set to obtain aggregate log information, and writing the aggregate log information into the first storage area includes:
classifying the interval log information according to the field value of the first specific field to obtain at least one classified log information;
merging the logs with the same field value and each field in the first appointed field set in each classified log information into a log to obtain the aggregate log information;
each log in the aggregate log information is written to a first storage area.
Further, the performing a second aggregation operation on the log information to be detected according to the first specific field to obtain an aggregate value includes:
and counting the number of logs with the field value of the first specific field larger than a specified field threshold value in the log information to be detected as the aggregate value.
Further, the performing an aggregation operation on the abnormal log information to obtain and report at least one single alarm information and alarm log information associated with each single alarm information includes:
And classifying and converging the abnormal log information according to the single machine error, the machine room error, the interface error and the resource-dependent alarm categories to form at least one single alarm information corresponding to the alarm categories and alarm log information associated with each single alarm information, and reporting the at least one single alarm information and the alarm log information associated with each single alarm information.
Further, the method further comprises the following steps:
and pushing the total log information acquired in real time to the message queue in a streaming manner in real time.
On the other hand, the embodiment of the invention also provides a service automatic alarm device, which comprises:
a section log obtaining unit, configured to obtain, periodically, at a first specified time interval, log information in a first specified time interval range closest to the message queue as section log information;
the interval log aggregation unit is used for executing a first aggregation operation on the interval log information according to a first appointed field set to obtain aggregated log information, and writing the aggregated log information into a first storage area;
the real-time log acquisition unit is used for acquiring log information from the message queue in real time to serve as real-time log information; filtering the real-time log information according to a second designated field set to obtain filtered log information, and storing the filtered log information into a second storage area;
The log to be detected acquisition unit is used for periodically searching the log information in the nearest second specified time interval range in the first storage area as the log information to be detected according to the second specified time interval;
the aggregation value calculation unit is used for performing a second aggregation operation on the log information to be detected according to the first specific field to obtain an aggregation value; the first specific field exists in the first specified field set;
an anomaly detection unit, configured to acquire, from the second storage area, log information in a second specified time interval range most recently as anomaly log information when the aggregate value is determined to be greater than or equal to a specified anomaly threshold;
and the alarm unit is used for executing aggregation operation on the abnormal log information to obtain and report at least one single alarm information and alarm log information associated with each single alarm information.
Further, the interval log aggregation unit includes:
the classification module is used for classifying the interval log information according to the field value of the first specific field to obtain at least one classification log information;
the log aggregation module is used for merging the logs with the same field and field value in the first appointed field set in each classified log information into one log to obtain the aggregated log information;
Each log in the aggregate log information is written to a first storage area.
Further, the aggregate value calculating unit is specifically configured to:
and counting the number of logs with the field value of the first specific field larger than a specified field threshold value in the log information to be detected as the aggregate value.
Further, the alarm unit is specifically configured to:
and classifying and converging the abnormal log information according to the single machine error, the machine room error, the interface error and the resource-dependent alarm categories to form at least one single alarm information corresponding to the alarm categories and alarm log information associated with each single alarm information, and reporting the at least one single alarm information and the alarm log information associated with each single alarm information.
Further, the method further comprises the following steps:
and the message pushing unit is used for pushing the total log information acquired in real time to the message queue in a streaming manner in real time.
The technical scheme has the following beneficial effects:
according to the invention, through carrying out aggregation operation on the appointed field in the log information and the data of the abnormal record, a single alarm associated with the data of the abnormal record is formed, the problems of alarm bombing, low alarm association and incomplete alarm information are solved, the effects of rapidly acquiring abnormal wrong interface address information, associating a plurality of alarms and avoiding the bombing of the alarms are achieved, the inefficiency and complexity caused by the existing mode are avoided, and meanwhile, the service quality is rapidly improved. The time for eliminating the obstacle of the business personnel is reduced, and the root cause of the business occurrence problem can be quickly found out from N multiple alarms. The positioning time of service personnel aiming at the error interface is improved, the error interface and the root cause causing the abnormal service can be acquired at the first time through the alarm information, and the high quality of service is improved. The alarm bombing performance of short messages, mails and WeChats is reduced, and the importance of business personnel on alarm is improved. Based on the Internet open source software, the content is fixed, and the development cost is low.
Drawings
In order to more clearly illustrate the embodiments of the invention or the technical solutions in the prior art, the drawings that are required in the embodiments or the description of the prior art will be briefly described, it being obvious that the drawings in the following description are only some embodiments of the invention, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is a flow chart of a business automatic alarm method according to one embodiment of the present invention;
FIG. 2 is a schematic diagram of a business automatic alarm device according to one embodiment of the present invention;
FIG. 3 is another flow chart of a business automatic alarm method according to one embodiment of the present invention;
FIG. 4 is a schematic diagram of a business automatic alarm method according to one embodiment of the present invention;
Detailed Description
The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
As shown in fig. 1, in one aspect, an embodiment of the present invention provides a service automatic alarm method, including:
step S100, periodically acquiring the log information in a first specified time interval range closest to the message queue as interval log information according to the first specified time interval;
in one embodiment, the first specified time interval may be defined as 30 seconds, and in particular other embodiments, may be defined as other values as the case may be. The first designated time interval cannot be too short, otherwise, a large number of repeated logs cannot be aggregated into one log in the step S101, and an alarm is more easily generated due to the excessive number of abnormal logs in the step S105, so that alarm bombing is triggered; the first specified time interval cannot be too long, otherwise, excessive repeated exception logs are combined into one log, and when the number of the exception logs is calculated in step S104, the obtained number of the exception logs is too small, so that an alarm is not required, and the opportunity for handling the exception problem is delayed. The specific value of the first designated time interval needs to be determined according to frequency debugging generated by the system log.
Step S101, performing a first aggregation operation on the interval log information according to a first designated field set to obtain aggregated log information, and writing the aggregated log information into a first storage area; the first storage area can be realized by an elastic research storage cluster, and can also be realized by using other data or file storage modes;
In one embodiment, the first set of specified fields may include, but is not limited to status, domain, uri, and in other embodiments the first set of specified fields may also be composed of other fields; the domain, uri, status field in the interval log information can be filtered out by calling the spark built-in function and the repeated logs in the interval log information are combined into one log by executing the first aggregation operation so as to reduce the number of the logs, meanwhile, the logs which are repeated for a plurality of times in a first designated time interval can be ignored, and the logs which are repeated for a plurality of times in a short time, such as the first designated time interval and recorded with abnormal information, can be considered to come from the same fault source, so that the possibility of alarming bombing is reduced.
Step S102, acquiring log information in real time from a message queue as real-time log information; filtering the real-time log information according to the second designated field set to obtain filtered log information, and storing the filtered log information in a second storage area; the second storage area can be realized by an elastic research storage cluster, and can also be realized by using other data or file storage modes;
in one embodiment, the real-time log information is acquired, but only part of fields in the real-time log information can be used for analyzing and detecting faults and providing alarm information, so the real-time log information is filtered through a second designated field set, fields and field values thereof which can be used for providing fault analysis and providing alarm information are filtered, and the filtered results are stored in a second storage area; the second set of specified fields may include, but is not limited to, domain, uri, status, body, http _user_agent, x_forwarded_for, request_id, method. The domain, uri, status, body, http _user_agent, x_forwarded_for, request_id, method fields and corresponding field values for each log in the real-time log information from the message queue may be filtered out by the log-table filter module and written into the second storage area. The first storage area and the second storage area may be the same or different data or file storage modes, for example, may be different tables of the same database, may be different databases, or may be different file storage modes.
Step S103, periodically searching the log information in the nearest second designated time interval range in the first storage area as the log information to be detected according to the second designated time interval;
in one embodiment, the second specified time interval may be 1 minute, and the log information within the last 1 minute is periodically read from the first storage area at 1 minute intervals as the log information to be detected; the frequency of the alarm can be controlled through the second designated time interval, and the longer the second designated time interval is, the longer the delay of detecting the abnormal system is, but the alarm bombing is less likely to occur at the same time. The second designated time interval also needs to be determined based on system specific operating conditions.
Step S104, executing a second aggregation operation on the log information to be detected according to the first specific field to obtain an aggregation value; the first specific field exists in a first designated field set;
in one embodiment, step S103 may be implemented by a crontab timing task, and call DSL statements in an elastic search-py module by a python self-writing program every 1 minute (corresponding to a second designated time interval), and filter service logs from an elastic search cluster (corresponding to a first storage area) to obtain log information to be detected; in step S104, an aggregate value is obtained from the log information to be detected according to the field value of the first specific field, which may be that the field value of the status field (corresponding to the field value of the first specific field) in each log of the log information to be detected is greater than or equal to a specific field threshold, for example, 499 logs are used as logs with abnormal information, and a second aggregate operation is performed on such logs to obtain an aggregate value, in one embodiment, the second aggregate operation may be that the number of logs with abnormal information is obtained through statistics as an aggregate value, in other embodiments, a second aggregate operation with other functions may be used, for example, for fields in an abnormal record, a plurality of fields are combined and analyzed according to the characteristics of various fields in the log, which may specifically but not be limited to weighting the values of the fields; the semantic analysis can be carried out on the field value of the text type in the abnormal record, whether the abnormality occurs truly or not and the specific type of the abnormality and other information are further determined, and an aggregate value is quantized according to the analyzed information and used for finally judging whether an alarm needs to be generated or not.
Step S105, when the aggregation value is larger than or equal to the specified abnormal threshold value, acquiring the log information in a second specified time interval range which is nearest to the second storage area as abnormal log information;
in one embodiment, the first storage area stores the log information after the first aggregation operation is performed in step S101, retrieves the log information to be detected from the first storage area, determines whether the current log records the abnormal information according to the field value of the first specific field in each log of the log information to be detected, and counts the number of the logs with the abnormal information recorded as an aggregation value;
the specified anomaly threshold may be 50, which may be set to other values in other embodiments depending on the system operating conditions. When the aggregate value is greater than or equal to the specified abnormal threshold, an alarm is considered to be required to be sent out, and operation and maintenance personnel are required to intervene in the process.
At this time, in order to obtain the alarm information, the log information within the latest second specified time interval range is read from the second storage area, for example, the log information within the latest 1 minute is read from the second storage area as the abnormal log information;
step S101, step S104 and step S105 are combined, the logs with repeated content are combined through step S101, the number of logs to be detected in step S104 is reduced, and by detecting the number of logs with abnormal information recorded in a second designated time interval in step S105, only the logs with abnormal information exceed a certain number in the second designated time interval to trigger an alarm, so that the probability of alarm bombing is reduced.
And step S106, performing aggregation operation on the abnormal log information to obtain and report at least one single alarm information and alarm log information associated with each single alarm information.
In one embodiment, step S105 may be processed in two results:
first kind: if the aggregate value is smaller than the specified anomaly threshold 50, the service is considered to be running in a normal period, and the python self-research program is called again to periodically detect whether the service is anomaly in real time.
Second kind: if the aggregate value is greater than or equal to the specified anomaly threshold 50, the business is considered to be anomalous, the python self-research program is called again to gather the data in each index according to the single machine error, the machine room error, the interface error and the dependence resource dimension, so that a single alarm and the association of each data are formed, and related personnel are notified in a mail, short message and WeChat alarm mode and visual display is carried out through granfan. The python self-research program detects whether the service is normal again in real time. If normal, mail, short message and micro message alarm are sent to relevant personnel.
As shown in fig. 3 and fig. 4, in one embodiment, log information such as an application log, a program log, an error log, a system log and the like of a service server is saved in a local file of the service server through rsyslog, the log information is pushed to a kafka message queue cluster, a python program acquires interval log information in a first designated time interval range from the kafka cluster, a python program invokes an aggregate function of spark to perform log analysis, and an aggregate analysis result, namely aggregate log information, is saved in a first storage area realized by an elastic search cluster; acquiring real-time log information from the kafka message queue by the logstack cluster, filtering according to a second designated field set to obtain filtered log information, and storing the filtered log information in a second storage area realized by the elastiscearch cluster; detecting whether an abnormality occurs in a service server in real time through a python abnormality detection program, namely, the python abnormality detection program reads a field value of a first specific field from a first storage area realized by an elastic search cluster and executes second aggregation operation to obtain an aggregation value, judging whether the abnormality occurs, when the abnormality exists, acquiring log information corresponding to the abnormality from a second storage area realized by searching the elastic search cluster in a multi-dimensional manner, classifying and aggregating the log information with the abnormality information according to single machine errors, machine room errors, interface errors and resource-dependent dimensions to form single alarm information, sending an alarm in a mail, short messages, weChats and the like, and displaying data in the single alarm information through granfan.
The embodiment of the invention has the following beneficial technical effects: step S106 analyzes the abnormal log information, classifies the logs therein, detects whether the alarm is needed for different classifications, thereby generating respective single alarm information for different classifications, and obtains alarm log information associated with each single alarm information according to the abnormal information in each classification. The step S101, the step S104 and the step S105 judge that the alarm is required in the latest second designated time interval, and the step S106 classifies the abnormal log information to generate single alarm information corresponding to each type, so that the number of alarm times is further reduced, and only one alarm is generated in each type in the latest second designated time interval. Meanwhile, alarm log information associated with each single alarm is generated from the abnormal log information of each class, and further associated information for analyzing abnormal sources is provided for the single alarm information. The embodiment has the advantages of further reducing the alarm bombing probability and providing accurate positioning log information for the operation and maintenance personnel to find abnormal sources, and avoiding the operation and maintenance personnel from manually finding log information related to the alarm in a large amount of log information, thereby improving the efficiency of the operation and maintenance personnel in solving abnormal problems, reducing maintenance cost and reducing loss caused by downtime due to faults.
Further, performing a first aggregation operation on the interval log information according to the first specified field set to obtain aggregate log information, writing the aggregate log information into the first storage area, including:
classifying the interval log information according to the field value of the first specific field to obtain at least one classified log information;
merging the logs with the same field value and each field in the first appointed field set in each classified log information into a log to obtain aggregate log information;
each log in the aggregate log information is written to the first storage area.
In one embodiment, the interval log information includes a plurality of logs, each log including a plurality of fields, and in this step, the fields in the first designated sub-segment set and the field values thereof, particularly the first specific field are of interest; after the interval log information is obtained, firstly classifying the logs in the interval log information according to the field value of the first specific field, then executing a first aggregation operation on the logs in each class according to the first specific field set, merging repeated logs and logs which can be merged according to a specified predefined rule, and merging a plurality of logs with the same or similar attribute as the similar semantic or similar numerical value or similar service type or similar or representative abnormal information or similar fault source in each class into a small number of logs. For example, in one embodiment, the first designated set of sub-segments may comprise domain, uri, status, where status represents a state, the field value of which is an integer; domain is a domain name, and the field value is a character string; uri is a website, and the field value of uri is a character string; taking status as a first specific field, classifying logs in the interval log information according to the field value of status, for example, taking status as one class with the field value less than or equal to 100, taking status as a second class with the field value more than 100 and less than or equal to 200, and similarly separating a third class, a fourth class and the like; the method of classifying field values according to status is merely illustrative of the present embodiment, and other classification methods may be defined by themselves as needed in other embodiments. Performing a first aggregation operation on status, domain, uri in each category according to a preset aggregation rule, for example, setting values of fields of status less than or equal to 100 to be 100, and setting values of fields of status greater than 100 and less than or equal to 200 to be 200; or classifying according to the actual meaning of the status field value, for example, classifying into a normal state, a busy state, a first exception type, a second exception type, a third exception type, etc., or classifying the status field value according to the required rule; for the field value of domain, different domains can be combined into one or several domain names or description strings related to the sources according to the common characteristics of the domain name strings or whether the domain name strings are from the same source or from the specified sources, and the like, and the url can also be treated in the same manner as the domain.
The embodiment of the invention has the following beneficial technical effects: the interval log information is subjected to a first aggregation operation to obtain aggregated log information, the number of logs is obviously reduced on the basis of keeping necessary log information, and because the interval log information also comprises logs with abnormal information, the logs with similar abnormal information can be combined into one or a few logs with abnormal information, so that the number of the logs with abnormal information is reduced, and the necessary abnormal information is still kept at the same time; the pressure of the data volume of subsequent storage and analysis is reduced, for example, the combined aggregate log information is less likely to cause communication blockage of the first storage area when written into the first storage area, the stability of the system is improved, fewer log data can be intensively analyzed during subsequent analysis and alarm, and meanwhile, the number of alarms can be reduced, so that the alarm bombing is avoided.
Further, performing a second aggregation operation on the log information to be detected according to the first specific field to obtain an aggregate value, including:
and counting the number of logs with the field value of the first specific field larger than the specified field threshold value in the log information to be detected as an aggregate value.
In one embodiment, the content of the log information to be detected is aggregate log information obtained by performing the first aggregation operation in step S101, in this embodiment, the log with the field value of the first specific field greater than the specified field threshold is used as the log with the abnormal information, and the number of logs with the abnormal information in the last second specified time interval can be counted to be used as the aggregate value, and when the value is greater than or equal to the specified abnormal threshold, it is considered that the abnormal condition which has to be processed actually occurs, instead of giving an alarm to each log with the abnormal information, thereby significantly reducing alarm bombing. In one embodiment, a status field may be used as a first specific field, 499 is used as a specified field threshold, when the field value of status is equal to or greater than 499, the status is considered as a log with abnormal information, and the number of logs with abnormal information in the log information to be detected is counted as an aggregate value.
The embodiment of the invention has the following beneficial technical effects: on the basis of reducing repeated or similar or homologous or homoenergetic logs by the first aggregation operation in step S101, the probability of alarm bombing is further reduced by limiting only logs with abnormal information to a certain number, and at the same time, the period or frequency of executing the second aggregation operation is limited by setting a proper second designated time interval according to the specific situation of the embodiment, thereby ensuring that the alarm is given to the abnormal problems which have occurred with a proper response speed or delay. On the basis of ensuring timely response, the improved alarm effective rate obviously reduces alarm bombing and avoids the fatigue of operation and maintenance personnel caused by the alarm bombing.
Further, performing an aggregation operation on the abnormal log information to obtain and report at least one single alarm information and alarm log information associated with each single alarm information, including:
the abnormal log information is classified and converged according to four alarm categories including single machine errors, machine room errors, interface errors and dependent resources to form at least one single alarm information corresponding to the alarm category and alarm log information associated with each single alarm information, and at least one single alarm information and the alarm log information associated with each single alarm information are reported.
In one embodiment, in step S102, log information in a message queue is stored in real time in a second storage area, in step S105, by judging that an aggregate value is greater than or equal to a specified exception threshold, so as to find that an exception problem exists in a last second specified time interval, and log information in a last second specified time interval range is obtained from the second storage area as exception log information, the exception log information includes log information of the exception problem occurring in the last second specified time interval range, one or more logs with exception information may be included in the exception log information, the logs may belong to one or more errors, the logs are classified into one or more errors through a convergence operation, for example, the logs with exception information may be classified according to four categories of single machine errors, machine room errors, interface errors and dependent resources, and corresponding alarm information is established only according to the classification of the occurrence errors, and meanwhile the log information corresponding to the classification of the occurrence errors is used as associated alarm log information, and the obtained single piece or multiple pieces of the single piece of alarm information and the alarm information corresponding to the single piece of alarm information are reported;
The embodiment of the invention has the following beneficial technical effects: the embodiment of the invention classifies the abnormal log information in the second specified time interval range into single machine errors, machine room errors, interface errors and resource dependence, and generates and reports single alarm information and alarm log information according to classification; the number of alarms is further reduced, meanwhile, by associating single piece of alarm information with related alarm log information, related alarm logs are provided for operation and maintenance personnel when the alarms are sent, the operation and maintenance personnel are not required to manually search and determine the log range related to the alarms from a large number of alarm logs according to the single piece of alarm information, the problem solving speed of the operation and maintenance personnel is increased, the problem solving difficulty is reduced, and the abnormal problem is rapidly positioned. On the basis of reducing alarming bombing, the efficiency of solving the problems is improved, the unavailable time of the system is shortened, the operation cost is reduced, and great economic benefits are brought to enterprises.
Further, the method further comprises the following steps: and pushing the total log information acquired in real time to a message queue in a streaming manner in real time.
In one embodiment, rsyslog may be installed on the server that obtains the information, and the log printed by the native server program (i.e., log information) may be pushed in a streaming manner to our corresponding kafka message queue (i.e., message queue) by the omkafka module of the rsyslog program, where the full log includes normal and abnormal program log information, application log, and related hardware information.
The embodiment of the invention has the following beneficial technical effects: the whole log information is pushed in real time, real-time and complete analysis data with analysis are provided for subsequent alarm analysis, and timely and accurate alarm and treatment on abnormal problems are ensured.
Further, pushing the total log information acquired in real time to the message queue in a streaming manner in real time, and further comprising:
if the log information is failed to be pushed to the message queue in a streaming mode, the log information is stored in a first temporary storage area, the message queue is detected in real time, and the log information in the first temporary storage area is tried to be pushed to the message queue; and when the time for the first temporary storage area to continuously buffer the log information reaches a first specified timeout threshold, clearing the log information in the first temporary storage area.
In one embodiment, when log information is stored in the kafka message queue, if the connection to the kafka message queue fails or the storage fails, the pushed data (i.e. log information) is preferentially stored in the memory queue (corresponding to the first temporary storage area), where real-time probe writing to the kafka message queue is performed, for example, pushing the data for more than 10 minutes (corresponding to the first specified timeout threshold) discards the log information in the first temporary storage area.
The embodiment of the invention has the following beneficial technical effects: based on pushing the total log information in real time, the log information is saved to the maximum extent by temporarily caching the data which cannot be written into the message queue, real-time and complete data with analysis are provided for subsequent alarm analysis, and timely and accurate alarm and treatment on abnormal problems are ensured.
Further, writing the aggregate log information into the first storage area further includes:
if the writing of the aggregate log information into the first storage area fails, buffering the aggregate log information into a second temporary storage area; detecting the first storage area in real time, and attempting to write the aggregate log information in the second temporary storage area into the first storage area; and when the time of the continuously cached aggregate log information in the second temporary storage area reaches a second specified timeout threshold, clearing the aggregate log information in the second temporary storage area. In one embodiment, the aggregate log information obtained by the first aggregate operation is stored in a first storage area implemented by the elastic search storage cluster by calling the elastic search-py module, if the storage of the data fails, the aggregate log information is buffered in a server memory (corresponding to a second temporary storage area), the first storage area is detected in real time to attempt to write the aggregate log information in the second temporary storage area into the first storage area, if the aggregate log information after the first aggregate operation exceeds 5 minutes (corresponding to a second specified timeout threshold) in the memory, the data in the second temporary storage area is discarded.
The embodiment of the invention has the following beneficial technical effects: based on pushing the total log information in real time, the log information can not be saved to the maximum extent by temporarily caching the data which cannot be written into the first storage area, real-time and complete data with analysis are provided for subsequent alarm analysis, and timely and accurate alarm and treatment on abnormal problems are ensured.
Further, storing the filtered log information in a second storage area, further comprising;
if the writing of the filtered log information into the second storage area fails, buffering the filtered log information into a third temporary storage area; detecting the second storage area in real time, and attempting to write the log filtering information in the third temporary storage area into the second storage area; and when the time of the continuously cached filtered log information in the third temporary storage area reaches a third appointed timeout threshold, clearing the filtered log information in the third temporary storage area.
In one embodiment, the filtered log information is stored in a second storage area implemented by the elastic search storage cluster, if the filtered log information is not stored, the filtered log information is buffered in a server memory (equivalent to a third temporary storage area), and the second storage area is detected in real time to attempt to write the filtered log information in the third temporary storage area into the second storage area. Discarding the data of the third temporary storage area is performed if the data in the third temporary storage area exceeds 2 minutes (corresponding to a third specified timeout threshold).
The embodiment of the invention has the following beneficial technical effects: based on pushing the total log information in real time, the log information can not be saved to the maximum extent by temporarily caching the data which cannot be written into the second storage area, real-time and complete data with analysis are provided for subsequent alarm analysis, and timely and accurate alarm and treatment on abnormal problems are ensured.
On the other hand, as shown in fig. 2, the embodiment of the present invention further provides a service automatic alarm device, including:
a section log obtaining unit 200, configured to obtain, periodically, at a first specified time interval, log information in a first specified time interval range nearest to the message queue as section log information;
a section log aggregation unit 201, configured to perform a first aggregation operation on the section log information according to a first specified field set to obtain aggregated log information, and write the aggregated log information into a first storage area;
a real-time log obtaining unit 202, configured to obtain log information in real time from the message queue as real-time log information; filtering the real-time log information according to a second designated field set to obtain filtered log information, and storing the filtered log information into a second storage area;
A log to be detected obtaining unit 203, configured to periodically retrieve, at a second specified time interval, log information in a second specified time interval range nearest to the first storage area as log information to be detected;
an aggregate value calculating unit 204, configured to perform a second aggregate operation on the log information to be detected according to the first specific field to obtain an aggregate value; the first specific field exists in the first specified field set;
an anomaly detection unit 205, configured to acquire, when it is determined that the aggregate value is equal to or greater than a specified anomaly threshold value, log information in a second specified time interval range from the second storage area as anomaly log information;
and the alarm unit 206 is configured to perform an aggregation operation on the abnormal log information, so as to obtain and report at least one single alarm information and alarm log information associated with each single alarm information.
Further, the section log aggregation unit 201 includes:
the classification module is used for classifying the interval log information according to the field value of the first specific field to obtain at least one classification log information;
the log aggregation module is used for merging the logs with the same field and field value in the first appointed field set in each classified log information into one log to obtain the aggregated log information;
And the log aggregation storage module is used for writing each piece of log in the aggregation log information into the first storage area.
Further, the aggregate value calculating unit 204 is specifically configured to:
and counting the number of logs with the field value of the first specific field larger than a specified field threshold value in the log information to be detected as the aggregate value.
Further, the alarm unit 206 is specifically configured to:
and classifying and converging the abnormal log information according to the single machine error, the machine room error, the interface error and the resource-dependent alarm categories to form at least one single alarm information corresponding to the alarm categories and alarm log information associated with each single alarm information, and reporting the at least one single alarm information and the alarm log information associated with each single alarm information.
Further, the method further comprises the following steps:
and the message pushing unit is used for pushing the total log information acquired in real time to the message queue in a streaming manner in real time.
Further, the message pushing unit further includes:
the message buffer module is used for storing the log information into the first temporary storage area if the log information fails to be pushed to the message queue in a streaming mode, detecting the message queue in real time and attempting to push the log information in the first temporary storage area to the message queue; and when the time for the first temporary storage area to continuously buffer the log information reaches a first specified timeout threshold, clearing the log information in the first temporary storage area.
Further, writing the aggregate log information into the first storage area further includes:
the aggregation log buffer module is used for buffering the aggregation log information to the second temporary storage area if the aggregation log information fails to be written into the first storage area; detecting the first storage area in real time, and attempting to write the aggregate log information in the second temporary storage area into the first storage area; and when the time of the continuously cached aggregate log information in the second temporary storage area reaches a second specified timeout threshold, clearing the aggregate log information in the second temporary storage area.
Further, storing the filtered log information in a second storage area, further comprising;
the filtered log buffer module is used for buffering the filtered log information to a third temporary storage area if the writing of the filtered log information into the second storage area fails; detecting the second storage area in real time, and attempting to write the log filtering information in the third temporary storage area into the second storage area; and when the time of the continuously cached filtered log information in the third temporary storage area reaches a third appointed timeout threshold, clearing the filtered log information in the third temporary storage area.
The service automatic alarm device provided by the embodiment of the invention is a device corresponding to a service alarm method one by one, and a person skilled in the art can understand that the embodiment of the invention provides the service automatic alarm device through the description of the service alarm method, and the description is omitted here.
It should be understood that the specific order or hierarchy of steps in the processes disclosed are examples of exemplary approaches. Based on design preferences, it is understood that the specific order or hierarchy of steps in the processes may be rearranged without departing from the scope of the present disclosure. The accompanying method claims present elements of the various steps in a sample order, and are not meant to be limited to the specific order or hierarchy presented.
In the foregoing detailed description, various features are grouped together in a single embodiment for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed embodiments of the subject matter require more features than are expressly recited in each claim. Rather, as the following claims reflect, invention lies in less than all features of a single disclosed embodiment. Thus the following claims are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate preferred embodiment of this invention.
The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. As will be apparent to those skilled in the art; various modifications to these embodiments will be readily apparent, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the disclosure. Thus, the present disclosure is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
The foregoing description includes examples of one or more embodiments. It is, of course, not possible to describe every conceivable combination of components or methodologies for purposes of describing the aforementioned embodiments, but one of ordinary skill in the art may recognize that many further combinations and permutations of various embodiments are possible. Accordingly, the embodiments described herein are intended to embrace all such alterations, modifications and variations that fall within the scope of the appended claims. Furthermore, as used in the specification or claims, the term "comprising" is intended to be inclusive in a manner similar to the term "comprising," as interpreted when employed as a transitional word in a claim. Furthermore, any use of the term "or" in the specification of the claims is intended to mean "non-exclusive or".
Those of skill in the art will further appreciate that the various illustrative logical blocks (illustrative logical block), units, and steps described in connection with the embodiments of the invention may be implemented by electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components (illustrative components), elements, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design requirements of the overall system. Those skilled in the art may implement the described functionality in varying ways for each particular application, but such implementation is not to be understood as beyond the scope of the embodiments of the present invention.
The various illustrative logical blocks or units described in the embodiments of the invention may be implemented or performed with a general purpose processor, a digital signal processor, an Application Specific Integrated Circuit (ASIC), a field programmable gate array or other programmable logic system, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in the alternative, the general purpose processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, e.g., a digital signal processor and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a digital signal processor core, or any other similar configuration.
The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. In an example, a storage medium may be coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an ASIC, which may reside in a user terminal. In the alternative, the processor and the storage medium may reside as distinct components in a user terminal.
In one or more exemplary designs, the above-described functions of embodiments of the present invention may be implemented in hardware, software, firmware, or any combination of the three. If implemented in software, the functions may be stored on a computer-readable medium or transmitted as one or more instructions or code on the computer-readable medium. Computer readable media includes both computer storage media and communication media that facilitate transfer of computer programs from one place to another. A storage media may be any available media that can be accessed by a general purpose or special purpose computer. For example, such computer-readable media may include, but is not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that may be used to carry or store program code in the form of instructions or data structures and other data structures that may be read by a general or special purpose computer, or a general or special purpose processor. Further, any connection is properly termed a computer-readable medium, e.g., if the software is transmitted from a website, server, or other remote source via a coaxial cable, fiber optic cable, twisted pair, digital Subscriber Line (DSL), or wireless such as infrared, radio, and microwave, and is also included in the definition of computer-readable medium. The disks (disks) and disks (disks) include compact disks, laser disks, optical disks, DVDs, floppy disks, and blu-ray discs where disks usually reproduce data magnetically, while disks usually reproduce data optically with lasers. Combinations of the above may also be included within the computer-readable media.
The foregoing description of the embodiments has been provided for the purpose of illustrating the general principles of the invention, and is not meant to limit the scope of the invention, but to limit the invention to the particular embodiments, and any modifications, equivalents, improvements, etc. that fall within the spirit and principles of the invention are intended to be included within the scope of the invention.
Claims (10)
1. A business automatic alarm method, comprising:
periodically acquiring the log information in a first specified time interval range which is nearest to the message queue according to the first specified time interval as interval log information;
executing a first aggregation operation on the interval log information according to a first appointed field set to obtain aggregation log information, and writing the aggregation log information into a first storage area;
acquiring log information from the message queue in real time as real-time log information; filtering the real-time log information according to a second designated field set to obtain filtered log information, and storing the filtered log information into a second storage area;
periodically searching the log information in the nearest second specified time interval range in the first storage area according to the second specified time interval to serve as log information to be detected;
Executing a second aggregation operation on the log information to be detected according to the first specific field to obtain an aggregation value; the first specific field exists in the first specified field set;
when the aggregate value is judged to be greater than or equal to a specified abnormal threshold value, acquiring the log information in a second nearest specified time interval range from the second storage area as abnormal log information;
and executing aggregation operation on the abnormal log information to obtain and report at least one single alarm information and alarm log information associated with each single alarm information.
2. The service automatic alarm method according to claim 1, wherein performing a first aggregation operation on the section log information according to a first specified field set to obtain aggregate log information, writing the aggregate log information into a first storage area, comprises:
classifying the interval log information according to the field value of the first specific field to obtain at least one classified log information;
merging the logs with the same field value and each field in the first appointed field set in each classified log information into a log to obtain the aggregate log information;
each log in the aggregate log information is written to a first storage area.
3. The service automatic alarm method according to claim 1, wherein the performing a second aggregation operation on the log information to be detected according to the first specific field to obtain an aggregate value includes:
and counting the number of logs with the field value of the first specific field larger than a specified field threshold value in the log information to be detected as the aggregate value.
4. The service automatic alarm method according to claim 1, wherein the performing an aggregation operation on the abnormal log information to obtain and report at least one single alarm information and alarm log information associated with each single alarm information includes:
and classifying and converging the abnormal log information according to the single machine error, the machine room error, the interface error and the resource-dependent alarm categories to form at least one single alarm information corresponding to the alarm categories and alarm log information associated with each single alarm information, and reporting the at least one single alarm information and the alarm log information associated with each single alarm information.
5. The service automatic alarm method according to claim 1, further comprising:
and pushing the total log information acquired in real time to the message queue in a streaming manner in real time.
6. A service automatic alarm device, comprising:
a section log obtaining unit, configured to obtain, periodically, at a first specified time interval, log information in a first specified time interval range closest to the message queue as section log information;
the interval log aggregation unit is used for executing a first aggregation operation on the interval log information according to a first appointed field set to obtain aggregated log information, and writing the aggregated log information into a first storage area;
the real-time log acquisition unit is used for acquiring log information from the message queue in real time to serve as real-time log information; filtering the real-time log information according to a second designated field set to obtain filtered log information, and storing the filtered log information into a second storage area;
the log to be detected acquisition unit is used for periodically searching the log information in the nearest second specified time interval range in the first storage area as the log information to be detected according to the second specified time interval;
the aggregation value calculation unit is used for performing a second aggregation operation on the log information to be detected according to the first specific field to obtain an aggregation value; the first specific field exists in the first specified field set;
An anomaly detection unit, configured to acquire, from the second storage area, log information in a second specified time interval range most recently as anomaly log information when the aggregate value is determined to be greater than or equal to a specified anomaly threshold;
and the alarm unit is used for executing aggregation operation on the abnormal log information to obtain and report at least one single alarm information and alarm log information associated with each single alarm information.
7. The service automatic alarm device according to claim 6, wherein the section log aggregation unit includes:
the classification module is used for classifying the interval log information according to the field value of the first specific field to obtain at least one classification log information;
the log aggregation module is used for merging the logs with the same field and field value in the first appointed field set in each classified log information into one log to obtain the aggregated log information;
each log in the aggregate log information is written to a first storage area.
8. The service automatic alarm device according to claim 6, wherein the aggregate value calculating unit is specifically configured to:
and counting the number of logs with the field value of the first specific field larger than a specified field threshold value in the log information to be detected as the aggregate value.
9. The service automatic alarm device according to claim 6, wherein the alarm unit is specifically configured to:
and classifying and converging the abnormal log information according to the single machine error, the machine room error, the interface error and the resource-dependent alarm categories to form at least one single alarm information corresponding to the alarm categories and alarm log information associated with each single alarm information, and reporting the at least one single alarm information and the alarm log information associated with each single alarm information.
10. The service automatic alarm device according to claim 6, further comprising:
and the message pushing unit is used for pushing the total log information acquired in real time to the message queue in a streaming manner in real time.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110404375.4A CN113220543B (en) | 2021-04-15 | 2021-04-15 | Service automatic alarm method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110404375.4A CN113220543B (en) | 2021-04-15 | 2021-04-15 | Service automatic alarm method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113220543A CN113220543A (en) | 2021-08-06 |
| CN113220543B true CN113220543B (en) | 2024-02-23 |
Family
ID=77087373
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110404375.4A Active CN113220543B (en) | 2021-04-15 | 2021-04-15 | Service automatic alarm method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113220543B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115935359B (en) * | 2023-01-04 | 2023-05-16 | 北京微步在线科技有限公司 | File processing method, device, computer equipment and storage medium |
Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2017115458A1 (en) * | 2015-12-28 | 2017-07-06 | 日本電気株式会社 | Log analysis system, method, and program |
| CN110427307A (en) * | 2019-06-21 | 2019-11-08 | 平安科技（深圳）有限公司 | Log analytic method, device, computer equipment and storage medium |
| WO2020012579A1 (en) * | 2018-07-11 | 2020-01-16 | 日本電気株式会社 | Log analysis device, log analysis method, and program |
| CN111078513A (en) * | 2018-10-22 | 2020-04-28 | 杭州海康威视数字技术股份有限公司 | Log processing method, device, equipment, storage medium and log alarm system |
| CN111221702A (en) * | 2019-11-18 | 2020-06-02 | 上海维谛信息科技有限公司 | Exception handling method, system, terminal and medium based on log analysis |
| CN111563022A (en) * | 2020-05-12 | 2020-08-21 | 中国民航信息网络股份有限公司 | Centralized storage monitoring method and device |
| EP3699766A1 (en) * | 2019-02-25 | 2020-08-26 | Zcaler, Inc. | Systems and methods for monitoring, analyzing, and improving digital user experience |
| CN111984844A (en) * | 2020-07-27 | 2020-11-24 | 新浪网技术(中国)有限公司 | Method and system for automatically supplementing graph based on big data |
| CN112000806A (en) * | 2020-08-25 | 2020-11-27 | 携程旅游信息技术（上海）有限公司 | Abnormal log monitoring and analyzing method, system, equipment and storage medium |
| CN112422344A (en) * | 2020-11-18 | 2021-02-26 | 青岛海尔科技有限公司 | Log abnormity warning method and device, storage medium and electronic device |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9384112B2 (en) * | 2010-07-01 | 2016-07-05 | Logrhythm, Inc. | Log collection, structuring and processing |
-
2021
- 2021-04-15 CN CN202110404375.4A patent/CN113220543B/en active Active
Patent Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2017115458A1 (en) * | 2015-12-28 | 2017-07-06 | 日本電気株式会社 | Log analysis system, method, and program |
| WO2020012579A1 (en) * | 2018-07-11 | 2020-01-16 | 日本電気株式会社 | Log analysis device, log analysis method, and program |
| CN111078513A (en) * | 2018-10-22 | 2020-04-28 | 杭州海康威视数字技术股份有限公司 | Log processing method, device, equipment, storage medium and log alarm system |
| EP3699766A1 (en) * | 2019-02-25 | 2020-08-26 | Zcaler, Inc. | Systems and methods for monitoring, analyzing, and improving digital user experience |
| CN110427307A (en) * | 2019-06-21 | 2019-11-08 | 平安科技（深圳）有限公司 | Log analytic method, device, computer equipment and storage medium |
| CN111221702A (en) * | 2019-11-18 | 2020-06-02 | 上海维谛信息科技有限公司 | Exception handling method, system, terminal and medium based on log analysis |
| CN111563022A (en) * | 2020-05-12 | 2020-08-21 | 中国民航信息网络股份有限公司 | Centralized storage monitoring method and device |
| CN111984844A (en) * | 2020-07-27 | 2020-11-24 | 新浪网技术(中国)有限公司 | Method and system for automatically supplementing graph based on big data |
| CN112000806A (en) * | 2020-08-25 | 2020-11-27 | 携程旅游信息技术（上海）有限公司 | Abnormal log monitoring and analyzing method, system, equipment and storage medium |
| CN112422344A (en) * | 2020-11-18 | 2021-02-26 | 青岛海尔科技有限公司 | Log abnormity warning method and device, storage medium and electronic device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113220543A (en) | 2021-08-06 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110493348B (en) | Intelligent monitoring alarm system based on Internet of things | |
| US11093349B2 (en) | System and method for reactive log spooling | |
| US20200136890A1 (en) | Anomaly detection and classification in networked systems | |
| WO2020147480A1 (en) | Stream processing-based monitoring index abnormality detection method, device and equipment | |
| CN107229556A (en) | Log Analysis System based on elastic components | |
| CN110535713B (en) | Monitoring management system and monitoring management method | |
| CN111274094B (en) | Interface early warning method, system, equipment and storage medium | |
| WO2011017955A1 (en) | Method for analyzing alarm data and system thereof | |
| CN108809734B (en) | Network alarm root analysis method, system, storage medium and computer equipment | |
| CN113220543B (en) | Service automatic alarm method and device | |
| CN112506743A (en) | Log monitoring method and device and server | |
| US8909768B1 (en) | Monitoring of metrics to identify abnormalities in a large scale distributed computing environment | |
| CN108108445A (en) | A kind of data intelligence processing method and system | |
| US11640401B2 (en) | Alert rule evaluation for monitoring of late arriving data | |
| CN104618192B (en) | Method and device for testing database audit equipment | |
| CN111526109B (en) | Method and device for automatically detecting running state of web threat recognition defense system | |
| US9817973B2 (en) | Method and device for monitoring virus trend abnormality | |
| CN112256548B (en) | Abnormal data monitoring method and device, server and storage medium | |
| CN114253806A (en) | Access stratum log collection, analysis and early warning system | |
| CN112948215A (en) | Real-time anomaly detection method and system based on distributed database log data | |
| CN115102848A (en) | Log data extraction method, system, device and medium | |
| CN112395116B (en) | Adjusting and optimizing method and system for message middleware | |
| CA3140769A1 (en) | Method and system for positioning fault root cause of service system | |
| CN113760669A (en) | Problem data warning method and device, electronic equipment and storage medium | |
| CN113676509A (en) | Active detection method and system for health state of HTTP (hyper text transport protocol) interface |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20230407 Address after: Room 501-502, 5/F, Sina Headquarters Scientific Research Building, Block N-1 and N-2, Zhongguancun Software Park, Dongbei Wangxi Road, Haidian District, Beijing, 100193 Applicant after: Sina Technology (China) Co.,Ltd. Address before: 100193 7th floor, scientific research building, Sina headquarters, plot n-1, n-2, Zhongguancun Software Park, Dongbei Wangxi Road, Haidian District, Beijing, 100193 Applicant before: Sina.com Technology (China) Co.,Ltd. |
|
| TA01 | Transfer of patent application right | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |